Convenient, but not yours
Free Wi-Fi in cafes, airports, hotels, libraries and shopping centers is genuinely useful. The catch is that you share the network with strangers and you have no control over how it is set up or who maintains it. That does not mean you must avoid it altogether. It means thinking about what you do on it.
The risks are real but often overstated, and it helps to separate the likely from the unlikely. Modern websites and apps encrypt most of their traffic, which removes a large part of the danger that existed years ago. Still, a few situations remain worth being careful about.
What can go wrong
Fake or lookalike networks. Anyone can set up a hotspot called “Airport Free WiFi” or something similar to the real name. Devices that connect to it may send their traffic through equipment someone else controls. This is why confirming the exact network name with staff is a sensible habit.
Snooping on unencrypted traffic. On an open network without a password, the wireless link itself is not protected in the way a home network is. Where a website or app does not encrypt its own traffic, others on the network may be able to see what is sent. Most large sites do encrypt, but not every app or smaller site does.
Misleading login pages. Many public networks ask you to open a page and accept terms, or enter an email address. Scammers sometimes imitate these pages to collect information. If a page asks for a credit card, a password for another service, or a lot of personal details to use free Wi-Fi, stop.
Other devices on the same network. On poorly managed networks, other users’ devices may be able to see yours. Sharing settings that are fine at home can be a problem in public.
Before you connect
A few simple preparations reduce the chance of trouble:
- Keep your device updated, since many risks depend on known flaws that updates fix. Our piece on software updates explains how to keep them on.
- Turn off automatic joining of open networks, so your phone does not connect to a name it has seen before without asking you.
- Turn off file sharing and similar discovery features. Many devices ask whether a new network is “public” or “private”; choose public.
- Check the network name with staff rather than guessing from a list that has several similar names.
- Forget the network afterward, so your device does not reconnect on later visits.
What to do, and not do, while connected
Treat public Wi-Fi as a place for low-stakes browsing such as reading the news, checking a map or watching a video. Be more careful with activities that would be costly if exposed:
- Avoid logging in to banking or entering card details if there is a reasonable alternative. If you must, use the official app or type the address yourself, and check that the connection shows as secure.
- Pay attention to browser warnings. A certificate or connection warning on public Wi-Fi is a reason to stop, not to click through. Our notes on browser safety explain how to read those warnings.
- Do not ignore prompts to install software, update a “required” certificate, or download a special app to get online.
- Sign out of accounts when you are finished, and avoid leaving sensitive documents open on a screen others can see.
- Use two-step verification on important accounts, so a stolen password alone is not enough to get in.
Safer alternatives
The simplest alternative is your own mobile data connection. Cellular data is encrypted between your phone and the network, and is generally a better choice for banking, shopping and anything private. Check your plan’s data allowance, and be aware of roaming charges if you are abroad.
Another option is tethering, also called a personal hotspot, where your phone shares its connection with your laptop. Protect it with a strong password and a modern security setting, and turn it off when done. This also uses your mobile data allowance, and drains the battery faster.
Some travelers also carry a portable travel router or a mobile Wi-Fi device from their carrier. These add cost, but give you a private network wherever you go.
Where a VPN fits
Many people consider a virtual private network when they use public Wi-Fi. A VPN encrypts the traffic between your device and the VPN provider, which can reduce what others on the local network can observe. It is not a complete shield, though, and quality varies widely between services. Our guide on VPN limits explains what it can and cannot do, so you can decide whether it fits your needs.
Public computers
Shared computers in hotels, libraries and business centers present their own issues, since you cannot be sure what software is on them. Avoid signing in to important accounts on them. If you must, use a private browsing window, never save passwords, sign out fully, and consider changing the password later from your own device. Where possible, use your own phone or laptop instead.
If you think you were caught out
If you entered a password on a page that looked suspicious, or noticed unusual activity after using a public network, act quickly but calmly:
- Change the password for the affected account from a trusted device, and for any other account that shared that password.
- Review recent activity and sign out of other sessions.
- Contact your bank if card or account details may have been exposed.
- Report scams to your local fraud-reporting service.
The practical middle ground
For most people, the sensible approach is not fear but proportion. Use public Wi-Fi for everyday, low-risk tasks, keep your software current, and switch to mobile data when it matters. Combined with other habits for keeping your devices secure, this will cover most everyday situations while you stay connected on the move.