On a 'high speed train' which means it is a directish train that barely stops. The wifi is running through the GSM network which in Scotland means it is really spotty. Of course it is unsecured with a captive portal. It is surprising that there aren't more terrible people around. It would be pretty easy to run your own bridging access point.
I saw an article this week that claimed something along the lines of "50% of mobile traffic is facebook". That makes sense, if most of the traffic is just a few sites (it is) and those sites have strong protections like certificate pinning, then it doesn't really matter if on hop 1 all of your traffic is exposed.
It doesn't stop people fucking with you, but the apps should offer some protection.
Reading: Gun Machine
Montrose, Scotland: 5°C, Rain throughout the day.