What makes public Wi-Fi different
At home, you know who set up the network and who is on it. In a cafe, hotel, airport or library, you share the connection with strangers, and you rely on the venue to have set it up sensibly. Often you cannot tell who is operating it or how well it is run.
The situation is less alarming than it used to be. Most apps and websites now encrypt the data they send, which makes it much harder for other people on the same network to read it. But shared networks still carry some risks, and a few careful habits cover most of them.
The main risks
- Fake networks. Someone can set up a hotspot with a name that looks like the venue’s, such as a slightly altered version of the cafe’s name. Connecting to it sends your traffic through their equipment.
- Poorly protected apps. Most major apps encrypt their traffic, but some smaller or older apps may not do it well, which can expose what you send.
- Fake sign-in pages. Many public networks show a page when you connect, asking you to accept terms or enter an email. A malicious network can show a convincing page that asks for more than it should, such as a password or card number.
- Snooping on sensitive tasks. Even with encryption, a shared network is not an ideal place for tasks that would be costly to expose.
Confirm the network name
Before connecting, ask staff for the exact name of the network and check that it matches. Be suspicious of two networks with nearly identical names or a network with no password in a place where the real one has a password on the receipt. If you are unsure, use your mobile data instead.
Turn off automatic joining
Phones can remember networks and rejoin them automatically. This is convenient at home, but less so in public. Turn off auto-join for open networks, and “forget” a network after you finish using it. That prevents your phone from quietly connecting to a lookalike with the same name later on.
Be selective about what you do
You can reduce risk by choosing which tasks to do on shared Wi-Fi.
- Browsing, streaming and reading are lower risk.
- Banking, payments, changing passwords and signing in to important accounts are better done on mobile data or a trusted network.
- If you do need to check an important account, make sure you are using the official app or typing the website address yourself, and look for the lock symbol in the address bar of your browser.
- Do not ignore security warnings. If your phone or browser warns that a connection is not private or a certificate is invalid, stop and do not continue.
Mobile data from your carrier is generally a safer choice for sensitive tasks than an unknown shared network. If your plan allows it, a personal hotspot from your own phone is another option, protected by a strong password.
What about a VPN?
A VPN, or virtual private network, creates an encrypted tunnel between your phone and a server run by the VPN provider. On a public network, this can make it harder for the network operator or other users to see what you are doing. It does not make you anonymous, and it does not stop you from falling for a phishing page or installing harmful software.
If you choose one, remember that you are moving trust from the Wi-Fi operator to the VPN company, so pick a reputable provider from an official app store, and be skeptical of free services with vague claims. Many people find that careful habits and mobile data are enough.
Keep the phone itself in good shape
Safe habits on public networks work best when the phone is up to date. Install software updates so that known problems are fixed, since flaws in the system are a way attackers can act on a shared network. Keep apps limited to those from official stores, and keep your app permissions in check, so that a compromised app has less to reach.
Turn off sharing features, such as file sharing or discovery that lets nearby devices see yours, when you are away from home. Bluetooth and similar features that you are not using can be turned off too.
Protect your accounts in case something goes wrong
Even careful people sometimes get caught. Using unique passwords and two-step verification means that a stolen password alone is not enough for someone to take over an account. If you suspect that you connected to a fake network or entered details on a suspicious page, disconnect, change the passwords involved from a trusted network, and review recent activity on those accounts.
A quick checklist
- Confirm the exact network name with staff.
- Turn off auto-join and forget the network afterward.
- Save banking and password changes for mobile data or home.
- Do not continue past security warnings.
- Keep your phone and apps up to date.
- Use a reputable VPN if you want an extra layer, understanding its limits.
Public Wi-Fi is a convenience, not a danger to be feared. A little caution about what you do on it goes a long way.