This is why I don't trust public wifi, anywhere. I use my phone as a hot spot everywhere I go unless there's no other option. And I still don't trust my phone that much either so I don't do any online banking unless I VPN back to my house first.
Even ISPs will do all sorts of obnoxious things like this, although some public wifi is horrible. I got a $15/year ramnode VPS about a year and a half ago and removed all services except ssh on port 80 with chacha/poly1305 and public key encryption. I mostly use SOCKS with sshuttle to catch anything not configured for SOCKS (sshuttle in theory is a better method, but in practice it leaks DNS requests somehow). Quite simple and I highly recommend it. Traffic accounting seems to undercount substantially with this usage so I didn't get anywhere near my limit (I don't have the highest bandwidth usage, but not the smallest either). One public wifi I would like to use more often somehow manages to break this setup (and half the internet even without a VPN so no idea what they are doing), but I haven't had trouble anywhere else. I started doing this after getting SSL downgrade errors using public wifi.
Yes, even with the --dns option, although only with the default method. tproxy mode might (most likely would?) fix it. I tried it once and it didn't work at all, but I have since learned that I did it wrong since you need to explicitly exclude the address you are connecting to.
I didn't report it since I didn't gather enough information to make a particularly useful report. It is at least known that FreeBSD has an issue with DNS forwarding (that might be the same?), although I am on arch. I hope to look into it more at some point.
If you request a password reset, sites typically send you an email containing a link with a secret in the URL. If the network is able to see your browser requesting that URL, it should be able to interrupt your connection and go change the password itself.
A good point, (although step 1 still saves you) the universal Achilles Heel strikes again!
I wish more sites would use a second factor for resets. This would prevent so many of these types of problems. Also, Windows knows that it's an untrusted network. Maybe warn about proxies if you have it (WPAD) turned on for Big Corp reasons?
the chance that a mobile network provider will use DHCP for phone connections over Edge, 3G, LTE, etc... is extremly high.
And I would guess Android and iPhone will actually honor WPAD
