One often hears/reads that with SSL or better an VPN your data is safe even if the WLAN is not secure.
I don't understand much about Handshakes and SSL or VPN security but it was always hard to believe that one could establish a secure connection over an malicious one. Since I now more often use public WLANs, this becomes an issue for me, so I started reading a bit, but the answers are always a bit vague. So maybe an example is the better way to explain/ask what I mean.
Let's say you are in a library with an unencrypted WLAN. Somebody brought his Pineapple 5 one hour before I arrive at the library, fakes the SSID of that network.
An hour later I arrive, start my laptop and login into the WLAN of the library, but little do I know, it has the same name and the landing page looks similar, but the hacker redirected me to his fake site. He now has for sure my login for the library - which is bad but not my main concern.
I see that I now have a established connection to the WLAN. Now I start my Cyberghost VPN and connect with it everything goes well.
Are the passwords that go through this channel secure?
In my head the answer would be: "How on earth should it be secure??" if the hacker can read the negotiation like "use AES, 256 bit, and the private key is XXX" he can "unwind" the encryption and read the cleartext of my communication or am I missing something?