Staying Secure on Public Wi-Fi
Public Wi-Fi is far less dangerous than it was a decade ago and still not something to be casual about. The useful question is not "is it safe" but "what exactly can this network see".
What encryption already handles
Nearly all web traffic now runs over TLS, and modern browsers refuse plain connections loudly. That means the network you are on cannot read the contents of what you send to a site, cannot alter the page you receive, and cannot lift a session cookie out of the air. The classic café attack of watching someone's login credentials go past in plaintext belongs to an era before HTTPS was universal.
What the network can still see is metadata: which servers you connect to and when, and roughly how much data passes. Server Name Indication in the TLS handshake historically revealed the hostname in the clear, and while Encrypted Client Hello is now closing that gap, deployment is uneven and you should not assume it is protecting you. Your DNS lookups also leak unless your device is configured to use DNS over HTTPS or DNS over TLS, which most current operating systems support and not all enable by default.
The attacks that actually still work
- The rogue access point. Anyone can name a hotspot after the café. Your device, which remembers networks by name, may join it automatically. This is the single most practical attack against a traveller and the easiest to defend against.
- Captive portal confusion. Hotel and airport sign-in pages train people to click through certificate warnings and to type personal details into an unfamiliar form. That habit, not the portal itself, is the vulnerability.
- Downgrade attempts. An attacker cannot break TLS, but can try to push you to a plain-HTTP version of a site. Browsers now resist this, and HTTPS-Only mode removes the question entirely.
- Local network exposure. On an open network you share a broadcast domain with strangers. File sharing, printer discovery and local services that are fine at home are visible to everyone in the room.
- Shoulder surfing. Unglamorous and effective. Cafés, trains and airport lounges are full of screens that can be read from two metres away.
Turn off automatic joining for open networks, and delete saved public hotspots when you leave a city. A phone that will not silently attach to anything called "Airport_Free_WiFi" has removed the most practical attack against it.
What a VPN does and does not do
A VPN encrypts your traffic between your device and the VPN provider's server, which means the café network sees only an encrypted tunnel to one address. That is genuinely useful: it hides your destinations and your DNS lookups from the local network, and it defeats a rogue access point trying to observe where you go.
It does not make you anonymous. You have moved your trust rather than eliminated it — the provider now sees what the café would have seen, and its jurisdiction, logging policy and business model matter enormously. It does not protect a site you log into from knowing it is you. It does not defend against malware, phishing or a compromised device. And it may not help at all with the more mundane problem of a hotel network that is simply slow.
Our own view is unglamorous: a reputable VPN is a reasonable tool for untrusted networks, and mobile data is often the better answer. Attaching to a mobile network via an eSIM profile puts you on a carrier's infrastructure rather than a stranger's router, which sidesteps the entire local-network threat model. It costs data, and for anything sensitive it is usually worth it.
Treat every public network as hostile and every account as if its password will eventually leak. Both assumptions cost very little and remove most of the risk.
Device hygiene worth ten minutes
- Enable the firewall on your laptop and turn off file and printer sharing before you travel.
- Turn on full-disk encryption. Theft is a far more likely threat to a traveller than interception, and an encrypted disk turns a stolen laptop into a hardware loss rather than a data breach.
- Keep the operating system and browser current, and let updates run on a connection where the data is not precious.
- Use a password manager so that a leak at one service cannot open others.
- Move second factors off SMS. An authenticator app or a hardware security key survives SIM-swap fraud and a lost local number; SMS survives neither. This matters more when travelling, because a data-only eSIM cannot receive text messages at all.
- Carry a privacy filter if you regularly work in trains and lounges. It defeats the oldest attack in the list.
Hotel and coworking networks are not the same thing
A coworking space usually runs managed equipment, client isolation between users and a network someone is responsible for. A hotel network is frequently a consumer router with a portal bolted on, shared with every room, and configured once at installation. Treat the two differently: the hotel is a network to tunnel out of or avoid, the coworking space is closer to an office, though still not one you administer.
If you are choosing where to do something sensitive — payroll, a client system, a signed contract — that difference is worth more than any software you could install.
A workable routine
Join the network, do not click through any certificate warning, and check that the browser shows a secure connection before typing anything. Prefer your own mobile data for banking, payroll, client systems and anything covered by a confidentiality obligation. Use the VPN when you are on a network you have no reason to trust and cannot use mobile data. Turn Wi-Fi off entirely when you are not using it, which also saves battery. And when you leave the city, clear the saved networks so your phone does not go looking for them somewhere else.
None of this is onerous. It is roughly the same amount of effort as locking a door, and it is worth about the same.