wifi hijacking is here to stay.

The solution is to detect it happening, and then switch to a different 'mode' where you ignore all https certs but never send any private data and never trust any data received.

You have use a client side app firewall to prevent all traffic until you have acquired your session.

This is extremely difficult to do even for skilled people.