[alexkus]

Indeed. The biggest weakness is that users aren't well trained in ensuring that the page they're typing their username/password into (to access one of the public access points) may not be genuine.

I know I've seen some faked BT Openzone login pages in the UK, luckily the BT Wifi App is clever enough only to attempt to login to the real webpage.