That assumes that the user isn't connecting to a hotspot he doesn't know is compromised.