Public Wi-Fi gets a scary reputation. The truth is more boring: it's much safer than it used to be, but there are still a few real traps worth knowing about.
What's mostly a myth now
Almost every website and banking app today uses encryption (the padlock, or "https"), so someone sitting on the same cafe Wi-Fi can't simply read what you're doing. The movie scene where a hacker watches your passwords fly by is mostly out of date.
The real risks
- Fake hotspots. A network called "Free_Airport_WiFi" or "Cafe_Guest" can be set up by anyone. If you connect to the fake one, the person running it sees your traffic and can try to send you to fake login pages.
- "Log in to continue" pages that ask for too much. A sign-in page asking for your email, phone number, or worse, a card number "to verify you're human", is a red flag.
- Your device connecting by itself. Phones and laptops remember networks and rejoin anything with a familiar name, including a fake one with the same name.
- Out-of-date devices. An unpatched laptop or phone is easier to attack from the same network than an updated one.
Five habits that cover it
- Ask the staff for the exact network name and password, and don't join similar-looking ones.
- Turn off auto-join for public networks, and "forget" them when you leave.
- Do banking and anything sensitive on mobile data. Your phone's own connection is safer than any shared network, and it's one tap away.
- Pay attention to warnings. If your browser shows a certificate or "not secure" warning, stop. Don't click through it.
- Keep your phone and laptop updated, and turn on two-factor authentication on your important accounts, so a stolen password alone isn't enough.
What about a VPN?
A reputable VPN helps in one specific way: it hides your traffic from whoever runs the Wi-Fi. It doesn't make a fake website real, it doesn't stop you typing a password into a phishing page, and a bad VPN can be worse than no VPN at all. If you travel a lot, a good one is a sensible extra, and I list one I trust on the software page. For everyday use, the five habits above matter more.
Questions about your own setup? Get in touch →
Related: how to spot a phishing email and is my computer infected?