Once connected, everyone is inside the bubble, even on WPA protected networks (also see FireSheep). The trick with the black box is possible due to certain operating systems being configured out of the box to connect automatically to unprotected networks. You know, for convenience. Android and Windows are particularly bad in this respect, not sure about iOS.

The only fix is to disable the autoconnect (if possible), and use only SSL/TLS connections to anything/anywhere.