The Threat Model Changed — Most Advice Didn't
The classic public Wi-Fi warning — "hackers can see everything you do!" — was written for an internet where most traffic was unencrypted HTTP. That era is over. Today, virtually every website and app you use connects over HTTPS, which encrypts content end-to-end between you and the site. Someone sniffing café Wi-Fi sees noise, not your passwords or messages.
That does not make public networks harmless. It changes what the real risks are:
- Evil twin networks: a fake "Airport_Free_WiFi" hotspot that captures whatever you type into any page it serves — the attack works on people, not encryption.
- DNS tampering: networks that redirect your lookups to inject ads or block content — visible as certificate warnings if you pay attention.
- Captive-portal phishing: the login page itself harvesting more than it needs (an email address is fine; a password is a red flag).
- Metadata exposure: without a VPN, the network sees which domains you connect to (not the content — the addresses).
Notice what is missing: passive reading of your HTTPS traffic. Thepadlock in your browser address bar is doing real work.
What HTTPS Already Protects (and What It Doesn't)
When you see the padlock, everything in the page — passwords, messages, card numbers — travels encrypted. Even on a hostile network, an attacker cannot read or modify that content without triggering a loud certificate warning.
What HTTPS does not hide:
- Which sites you visit — DNS lookups and connection targets are visible to the network unless you use encrypted DNS (DoH) or a VPN.
- Anything you type into a page served without HTTPS — vanishingly rare for real services, but exactly what evil-twin pages present.
- Your device's traffic patterns — some apps phone home to non-HTTPS endpoints; games and IoT gadgets are the usual offenders.
Practical takeaway: the browser is largely safe on public Wi-Fi; the fringe is where the risk lives.
The 4 Habits That Actually Matter
- Verify the network name with staff. Evil twins win by naming themselves plausibly. Thirty seconds asking the barista beats an hour of damage control. If two networks have near-identical names, assume the one asking for a password on login is fake.
- Keep OS and browser auto-updates on. The rare network-level attacks that do work exploit known, already-patched vulnerabilities. An updated device shrugs them off; a two-year-old laptop does not.
- Turn off auto-connect and sharing. Set your laptop to treat public networks as "Public network" (Windows) which disables file sharing and discovery. Disable auto-join for every café network — your phone silently rejoining "CoffeeHouse_Guest" across town is how evil twins harvest regulars.
- Use encrypted DNS or a VPN for the fringe. Enable secure DNS in your browser settings (Chrome, Firefox, Edge all support it), and run a VPN from our tested VPN list when you will be doing anything sensitive or want your browsing metadata hidden.
High-Risk Scenarios Worth Extra Care
Some situations deserve more than the basics:
- Logging into banking or work accounts: fine over HTTPS, but if you see any certificate warning — even once — stop and switch to mobile data. Warnings on trusted sites on public networks are the classic evil-twin signature.
- Hotel and conference Wi-Fi: the highest-value evil-twin targets because everyone expects a clunky login portal. Prefer your phone's hotspot for anything sensitive; hotel Wi-Fi for streaming and browsing.
- Long flights and travel: airplane and border networks are exactly where our privacy checklist — aliases, secondary email, minimal signups — pays off.
And the simplest security upgrade of all: your phone's mobile hotspot. Your own encrypted cellular connection beats any public network for sensitive work, and it is already paid for.
