Connecting to the free Wi-Fi in a café, hotel or airport is an everyday habit. There are many fears around these networks, some justified and others overtaken by how technology has evolved. Understanding which risks are real today lets you behave sensibly, without paranoia and without naivety.
What has changed in recent years
Until not long ago many websites sent data unencrypted: on an open network, anyone nearby with the right tools could read what passed through. Today the vast majority of websites and apps use HTTPS, an encrypted connection between your device and the server. Even if the Wi-Fi network is open, page content, passwords and card details travel encrypted.
This has greatly reduced the risk of "passive eavesdropping". But it hasn't eliminated it, and above all it has shifted attention to other kinds of attack.
The risks that remain
Fake networks with believable names
Anyone can create a hotspot called "Hotel_Guest" or "Airport_Free_WiFi". If you connect, all your traffic passes through that person's device. HTTPS still protects the content, but the fake network can show you bogus sign-in pages ("enter your email and password to browse") or try to steer you to imitation sites.
Sign-in pages that ask for too much
Many legitimate networks show a captive portal, the landing page where you accept the terms. It's normal for it to ask for your room number or a code. It isn't normal for it to ask for your email or social media password, or card details for a service that is supposed to be free.
Devices visible to others
On a shared network, your laptop sits on the same local network as dozens of strangers. If you have shared folders or services running, they could be visible. Modern operating systems switch to a more restrictive profile when you choose "public network": make sure you choose it.
Metadata
Even with HTTPS, whoever runs the network can see which domains you connect to, when and for how long. They don't see the content, but the overall picture can reveal a lot.
Ignored certificate warnings
If your browser shows a warning such as "your connection is not private", on a public network that's a signal to take very seriously. Don't proceed: it could be an interception attempt.
Recommended habits
- Check the exact network name with staff, instead of joining the first one that looks right.
- Choose "public network" when the system asks, or check your network settings.
- Turn off file and printer sharing when you're away from home.
- Never ignore browser certificate warnings.
- Don't enter credentials on Wi-Fi sign-in pages that ask for more than necessary.
- Tell the device to forget the network when you're done, so it doesn't automatically reconnect to a network with the same name somewhere else.
- Turn off auto-join for open networks in your phone's settings.
VPNs: when you really need one
A VPN creates an encrypted tunnel between your device and a server run by the provider. On a public network, whoever runs it sees only that you're connected to the VPN, not the domains you visit. It makes sense when:
- you need to reach your company network (in that case use the VPN your company provides);
- you often use public networks and want to hide metadata from whoever runs them;
- you use apps you're not sure encrypt their traffic properly.
Remember, though, that a VPN shifts trust: instead of the Wi-Fi operator, it's the VPN provider that sees your traffic. Choose a service with clear policies, avoid free VPNs of dubious origin, and don't assume a VPN protects you from phishing or malware: it doesn't.
The simplest alternative: your phone's hotspot
If you have enough mobile data, sharing your smartphone's connection is often safer than any public Wi-Fi. You control the network: protect it with WPA2 or WPA3 and a long password, and turn it off when you're done.
What to avoid on networks you don't trust
You don't need to give everything up, but for particularly sensitive operations, such as large bank transfers or changes to your accounts' security settings, you can wait until you're on a trusted network or use mobile data. It's a form of caution that costs nothing.
In short
- HTTPS protects content even on open networks, but not against every risk.
- The main danger is fake networks and sign-in pages asking for credentials.
- Set the network as public, turn off sharing and don't ignore browser warnings.
- A VPN hides metadata from the network operator, but doesn't protect against phishing.
- Your phone's hotspot is often the safest alternative.