How to protect your data on a public Wi-Fi network today

Security advice for public Wi-Fi often gets copied from decade-old articles where every cafe had a hacker with a sniffer reading other people's mail. Since then the web has moved to near-total encryption, and the old threat model quietly died. The new one is less spectacular but quite real. Let's see what is dangerous on other people's networks today, what is safe despite the horror stories, and which habits close the remaining risks.

What HTTPS closed

Almost the entire modern web is encrypted between browser and site: the lock in the address bar means page content, passwords and forms cannot be read along the way, including by the Wi-Fi owner and network neighbors. So the classic "they'll grab your password at the cafe" no longer works on a live encrypted site. Browsers also warn when you enter data on the rare unencrypted pages: on someone else's network, read such a warning as a stop command, whatever the screen says.

What stays dangerous

• Fake hotspots. Anyone can bring up a network named after a cafe or an airport: devices connect to familiar names on their own. The owner of such a hotspot cannot read HTTPS, but sees which domains you visit and can slip you fake portals and fake pages for unencrypted requests.
• Login portals. A page saying "enter your phone number for access" collects data by itself, and a fake one also asks for passwords "for your operator's Wi-Fi". A portal asking for your mail or social network password is an attack, since real portals have no use for such passwords.
• Metadata. Even with content fully encrypted, the network sees the names of visited domains and volumes: an interest profile takes shape without reading any traffic.
• Neighbors on the local network. An open network makes your device visible to everyone else: old system vulnerabilities and enabled file sharing become available to all the cafe's visitors.
• Auto-connect. A phone that remembers a network called FreeWiFi will connect to any network with that name anywhere in the world, including a fake one.

A set of habits

The list's main tool is the tunnel. It packs all traffic up to its server, so the other network sees one encrypted stream with no domains or details, as we covered in the article on how a VPN works. Turning it on takes minutes on a phone, and the guide for smartphones walks through the steps. A proxy fits this role with a caveat: it changes the address but does not encrypt the channel itself, and its strength lies in other tasks.

Laptop and phone: different risk profiles

A phone on someone else's network is better protected than it seems: systems strictly isolate apps, and banks encrypt their traffic again on top of any channel. Its weak spot is habits: auto-connecting to familiar names and portals. A laptop is more vulnerable as a device: shared folders, old services, work access. Hence different behavior: a phone needs a tunnel and no auto-connect, a laptop adds public network mode and update discipline. A work laptop with company access should never sit in a cafe without a corporate VPN: at that point your employer's security rules apply, on top of personal hygiene.

A separate tip for frequent trips: tethering from your own phone is almost always safer than a public network. A cellular channel plus your personal hotspot removes both fake hotspots and neighbors from the equation, and an evening of work uses modest traffic.

A two-minute check

Once connected to someone else's network, spend two minutes. Open the address lookup page: whose address does the internet see, the network's or your tunnel's. Look into the anonymity check: WebRTC and DNS leaks show there right away, and they are what gives away the real connection under a tunnel. If you use a laptop with shared folders, make sure the system marked the network as public: one switch closes the device off from neighbors.

What not to fear

For balance: not every open network is a trap. Banking apps protect payments with their own encryption on top of any Wi-Fi, HTTPS sites do not hand passwords to neighbors, and "data leaked through Wi-Fi" in the news almost always turns out to be phishing or a server leak with no link to any cafe. A sensible model: someone else's network is a street, not a home. You walk a street calmly with your bag closed: a tunnel, fresh updates, distrust of portals. That is enough for any trip and any cafe, and extra paranoia costs nerves without adding protection.