What the risks actually are
Public Wi-Fi carries two broad risks. One is that someone else on the same network could watch the traffic going past; the other is that the network itself is fake. Most websites and apps now encrypt what they send, so it is rare these days for a password to be visible simply because someone is in the same café. Even so, details such as which sites you visit can leak, and older sites or apps that do not encrypt are still exposed. The bigger danger is when the attacker runs the hotspot.
Look-alike hotspots
Anyone can name a Wi-Fi network whatever they like. Set up a hotspot nearby with the café's exact name, or something plausible like Free Airport Wi-Fi, and phones cannot tell the difference while people are easily fooled. Once you join, all your traffic passes through the attacker's equipment, which can steer you to fake login pages or trigger certificate warnings in the hope you click through. Confirm the exact network name with staff or a posted notice, and be suspicious when several similar names appear. Be especially careful with open networks that show no lock icon.
What the sign-in page asks for
Many public networks show a sign-in page asking you to accept terms or complete a simple check. A legitimate page usually wants no more than a tap to agree or a phone number confirmation. If it asks for a card number, the password to an account you use, ID details, or for you to install an app or program, stop there. Nothing needs installing to use free Wi-Fi. If the page offers sign-in with a social account, it is hard to confirm the window really belongs to that service, so skipping it is the safer choice.
Habits once you are connected
What you do after joining matters more than the joining itself. Check the padlock in the browser's address bar to confirm an encrypted connection, and if a certificate warning such as your connection is not private appears, do not click through. On a public network that warning is a good reason to suspect interception. For sensitive tasks such as banking, trading or payments, switch off the Wi-Fi and use mobile data, or connect a laptop to your phone's personal hotspot. Keeping the operating system and apps updated is the baseline for closing known holes.
Check your device settings
Laptops and phones have settings that are convenient at home but risky outside. When you first join a public network, marking it as public lets the operating system shut off several sharing features for you.
- Mark the network as public to turn off device discovery and file sharing
- Turn off automatic joining of unknown networks
- Forget public networks after using them
- Set nearby file transfer to contacts only, or off
A VPN is not a cure-all
A VPN encrypts the link between your device and the VPN service, so people on the same Wi-Fi and the network operator can no longer read the contents. But you are handing all your traffic to that company instead, so who runs it matters. Free services of unknown origin sometimes collect logs or inject ads. A VPN also does nothing against phishing, where you type a password into a fake login page yourself, or against installing a malicious app. If you use one, check who operates it and read its privacy policy, and treat it as an addition to good habits rather than a replacement for them.
If the Wi-Fi has a password
A café network with the password on the wall is better than an open one, but everyone who knows that password is still on the same network. Depending on the encryption in use, watching other people's traffic may be more or less difficult, and above all someone can set up a fake hotspot with the same name and the same password. A password, then, is no reason to treat a public network like your home one. At home, by contrast, the basics are changing the router's admin password from the default and keeping its firmware up to date.
Deciding by situation
There is no need to avoid every public network. Sort what you are doing by how sensitive it is.
- Reading news, checking maps, watching videos: public Wi-Fi is fine
- Checking email and messages: fine if apps are updated and no certificate warnings appear
- Banking, payments, changing important passwords: use mobile data or your own hotspot
- A sign-in page wants an install or sensitive details: disconnect at once
🌍 Search the web for this
Each button runs this keyword on that search engine