The real problem is that not every website provides SSL. When using HTTPS the data are still sent to alle participants in the WiFi-network, too, but because the data has been encrypted it is impossible for DroidSheep to decrypt the contect of a message - remaining only a complete mess of letters, with which an attacker can’t do anything. Many providers already offer HTTPS, even facebook, however it must often be enabled in the settings first.

The only satisfying answer is: SSL respectively HTTPS.