How to protect your data on public Wi-Fi: café, hotel, airport
What the owner of an open access point can see, which attacks show up on public networks, and five simple rules that protect mail, banking, and work accounts.
Public Wi-Fi is convenient, but you do not know who runs the access point or who else is connected to it. The good news: most of the risks are closed by a couple of habits and a VPN that encrypts all of the device’s traffic.
What is visible on an open network
When you join Wi-Fi in a café or a hotel, all traffic passes through someone else’s router. Its owner and, in some cases, other people on the network can see:
- which sites and services you open (from DNS queries and server names);
- when you send data and how much;
- the contents of pages, if a site opened without HTTPS for some reason.
HTTPS protects the contents, but it does not hide where you go. And on many networks DNS queries still travel in plain text.
Typical threats
A fake access point. Someone creates a network named “Airport_Free_WiFi”, or a copy of the café’s name. Everyone who connects sends traffic through that device.
Swapped login pages. Through a fake network it is possible to show a forged Wi-Fi sign-in page, or to swap a DNS answer and send you to a copy of the site you wanted.
Unprotected apps being intercepted. Old apps and smart-home devices sometimes send data without encryption.
Five rules for public networks
- Turn the VPN on before you open work services. A VPN encrypts all of the device’s traffic, including DNS queries, and the access-point owner only sees a connection to the VPN server.
- Ask the staff for the network name. A network with a similar name can be fake.
- Turn off auto-join for open networks. The phone should not attach itself to every “Free Wi-Fi”.
- Turn on two-factor authentication for mail, banking, and work accounts. Even if a password leaks, there is no way in.
- Do not ignore certificate warnings. If the browser says the connection is not secure, close the page.
How to check that the VPN is working
Open the IP check with the VPN off and with it on. With the VPN on, the IP address and the provider should change, and the WebRTC check should not show your real address.
How to set this up with CHEBA VPN
CHEBA VPN uses the VLESS protocol with standard TLS encryption. One subscription works on a phone, a tablet, and a laptop. Guides: Android, iPhone, Windows.
If you travel often, see the VPN for travel page.
Short version
On an open network your traffic passes through someone else’s equipment. A VPN, two-factor authentication, and attention to the network name close almost all of the risks.
