I would recommend reading this article on
Firesheep, as it exploited some of the quirks of open-access wifi networks. This points to your first question, as in an open wifi environment with no passwords, internet traffic between you and the router is unencrypted. (HTTPS URLs are still encrypted, as that's done in a different layer than the wireless) Firesheep exploited this by intercepting some of this unencrypted network traffic, retrieving tokens that identify other people to websites, and giving you the ability to use those tokens yourself. Note that this only works on unencrypted wifi; if the wifi requires a non-WEP password, then you're pretty much fine.
Wi-Fi can be a tricky thing, though, because there are a couple attack vectors that go just beyond simple encryption:
- When I connect to [network], how do I know that I'm connecting to the actual network and not someone running a different router named [network], just so that they can get in between you and the internet?
- When I connect to [network], is there anything stopping anyone between you and the broader internet from snooping on the connection? (this is a broader issue than just open internet access points, but it isn't as major a concern when you control most of the path between you and your provider)
Neither of these are things that I'd worry
too much about, and they're relatively easy to mitigate. (use of a VPN or always using HTTPS connections will mitigate most of these)
---
#2, I wouldn't worry about someone getting into your machine just by you being on an open wifi network. The risk is mostly in someone intercepting the traffic that you're sending and receiving to websites, and leveraging that information in some way. Again, though, HTTPS solves a decent amount of this.
