Public Wi-Fi: what the hotspot can see
Cafés, airports, and hotels — when to tether, when to use a VPN, and how to confirm the IP changed.
Public Wi-Fi is a network you do not run. Airports, cafés, hotels, and trains share that trait. Someone else chose the password — or there is no password. Someone else sees which devices join. Cyber security on that network is about assuming the local path is unfriendly until you add your own tunnel.
What the hotspot can see
On an open network, older unencrypted sites and some apps still leak. Modern HTTPS hides page contents from a casual sniffer, but the hotspot can still see that you connected, which IP you used, and often which domains you look up unless you protect DNS too.
A fake hotspot with a convincing name is a classic trick. “Airport_Free” next to “Airport Free WiFi” is enough. You join, you get a login page that asks for an email password, and you have handed over a real account to a box in a backpack.
Shared networks also mean shared mistakes. Another guest’s infected laptop can scan the LAN. Guest isolation on a well-run café helps. You cannot count on it.
What to do before you work
Prefer your phone’s cellular connection for banking and for the password manager if the Wi-Fi feels sloppy. Tethering to yourself is an underrated security control.
If you must use the venue Wi-Fi, confirm the network name at the counter. Complete the captive portal. Then start a VPN you already installed at home. Check your public IP on a site you trust. It should show the VPN, not the café’s ISP.
Turn on the VPN kill switch. A two-second drop is enough to dump a session onto the raw hotspot.
Avoid random charging kiosks with a data cable if you can. Power is fine. A cable can speak USB. Carry your own charger.
Settings that help even without a VPN
- Use HTTPS sites. Leave “always show the full URL” on so you can see the host.
- Auto-join should be off for networks that are not yours.
- File sharing and AirDrop to everyone should be off in a terminal.
- Updates can wait until you are on a network you trust if you are only passing through.
After you leave
Forget the network on your device so your phone does not keep bleating for “Airport_Free” in the next city. If you typed any password on a page that felt wrong, change it on cellular. Review mail logins.
Public Wi-Fi is not forbidden. It is a place where your usual home assumptions fail. Add a VPN, prefer cellular for the accounts that matter, and treat the login page that appeared the moment you joined as a stranger until you know it belongs to the venue.