Personally, I don't worry. As long as any sites you log into start the address with https:// the user name and password will be encrypted.

As an extra layer of protection, I don't use the same password on more than one site. Especially don't if you have sites that just use http:// as those sites send the login information unencrypted. Never let the bad guys figure out the password to a good site by them capturing information from a compromised site.

I suppose going through a bad router could allow them to redirect you to an alternate website. They could capture your username and password if you didn't realize it. The chances of being sent to a perfect clone website seems remote to me.