HTTPS is used on virtually every site out there these days. That is used to encrypt your traffic from the get go. So specifics of the traffic/request won't be obvious/known. The EU could be big enough to force manufacturers to inject their certificates into devices... could be a man in the middle attack. But you can always just remove certs you don't trust from your devices.

DNS by default is often plaintext. You can setup your device to use DoH or other encrypted versions of DNS.

That leaves just the raw connection analysis... eg, that your device is sending traffic to some known IP... many site share hosts so that can be hard to determine though often not really... Proxy or VPN services can make it impossible to do this type of analysis... but then those services will be able to tell.

Ultimately being able to say that "Shalafi sent some packets to an IP that google owns and received a bunch back" could be email... could be youtube... could be any number of things... at some point it become educated guess at best. And what specifically happened (ex: Watched a video about tying shoes) is simply unknown. It would take a bunch of external additional data to actually tie you to anything directly, eg server logs or other sources... which usually means more than one party is already working together against you. At that point you've got bigger issues usually.

You don't HAVE to be comfortable. But if you use any sort of public WiFi, this is no riskier than any of those networks. They can grab some metadata unless you use a VPN, but likely less than what your ISP already has on you anyway. Basically, there's no reason this should be putting up any major red flags. We're past the days when a malicious access point could MitM most connections due to lack of encryption.

Every site uses HTTPS which encrypts your data in transit. Even if they sniff the packets, they would spend literal decades trying to decrypt it.

Just be wary of visiting sites or sending traffic not over HTTPS. Its rare, but it does happen.

What the others said. If you want a practical example of this working, have a look at eduroam. It's the joint WiFi of all European universities and I cannot recall that there ever were any privacy issues.

Someone runs MongoDB unauthenticated, bound on 0.0.0.0 with production data, on a computer without a VPN, and the problem is the WiFi?

Like I get what you are saying, but this sounds like saying that we should ban speedbumps because imagine there is a guy with a loaded gun pointed at a kid with no safe, finger on the trigger, and high on coke, if the car hits the speedbump the toddler is gone. Yeah, but I would hardly say the speedump is the issue.

Just keep your firewall set to public network and you will most likely be fine.

Anything can be hacked, even on your private home network.

That's the point, you don't have to. The system works on the assumption that the AP is untrusted.

How do we know intelligence agencies are not in collusion with certificate authorities though? What if they actually have access to ROOT CA private keys and can just automatically strip https from most of the traffic in their mass surveillance software? This is something I found with a very quick search: https://en.wikipedia.org/wiki/DigiNotar

The EU only cares about blocking the private sector from getting their citizen's data. They actively harm privacy when it's about government access

LOL 'dude'
The EU just bent over to get fucked by US tarrifs.
They shouldn't worry about Russia as much as they should about US imperialism that causes all the trouble.
But these sell outs will gladly suffer as good obedient vasals. 🤡