There are many open Wi-Fi hotspots scattered around from cafes to airports.

I understand that a non-passworded Wi-Fi leaves traffic unencrypted and therefore available for hackers to read. I also know about a man-in-the-middle attack where the Wi-Fi hotspot is malicious.

I therefore always use a VPN connection to encrypt my traffic while using open Wi-Fi hotspots to avoid these attacks.

But the article Even with a VPN, open Wi-Fi exposes users states that even with a VPN connection, an open Wi-Fi hotspot is still insecure. It states:


  In this period before your VPN takes over, what might be exposed
  depends on what software you run. Do you use a POP3 or IMAP e-mail
  client? If they check automatically, that traffic is out in the clear
  for all to see, including potentially the login credentials. Other
  programs, like instant messaging client, may try to log on.


But at the same time the article feels like a disguised advert concluding with (what feels like) a sales pitch for something called Passpoint which I have never heard of:


  The Wi-Fi Alliance has had a solution for this problem nearly in place
  for years, called Passpoint.


Can an open Wi-Fi hotspot be considered secure when using a VPN connection or should you NEVER use open hotspots?

This is actually exactly the type of environment VPNs were designed to work in: when you cannot trust the local network.

If set up properly (i.e. making sure all traffic goes through the VPN and using a secure mutual authentication scheme) it will pretty well protect your connection.

This, however, requires the whole thing to be designed properly. 


Obviously, your VPN must be set up so that ALL your communication goes through the encrypted channel, not just the part that is aimed at the internal network behind it (which is sometimes the case with corporate firewalls or if you're using SSH).    
Avoid using SSL VPN unless you're using a pinned certificate for the server: you'll want to avoid having to perform PKI validation of the server's host name since it can be rather delicate.    
Understand the limitation: you will not be able to "mask" the fact that you're using a VPN, you will not mask the volume and pattern of your exchange (which can be to some extent used to identify the type of service you're using) and your connection will ONLY be secure up to the VPN exit point: everything between that point and the destination server will not be protected by the VPN (although it can also be encrypted on its own).
There is no guarantee against a state actor who would be willing to spend dedicated resources to penetrate your security.

