TL;DR
- Public Wi-Fi is not the password stealing free for all that it is often made out to be. Most legitimate websites and apps use HTTPS and Transport Layer Security (TLS) to encrypt your data.
- Someone on the same network cannot simply read your passwords, messages or payment details as they pass between your device and a properly secured service.
- A reputable virtual private network (VPN) adds useful protection on an untrusted network, but it is not magic. For most everyday users, it is an additional layer rather than an absolute requirement.
- HTTPS and a VPN will not rescue an unpatched device, stop you visiting a phishing site or make an ignored certificate warning disappear.
- Keep your devices updated, use multi-factor authentication, disable unnecessary sharing and take browser security warnings seriously. The basics still matter.
The coffee shop hacker
Public Wi-Fi has acquired a slightly theatrical reputation. Join the network in a coffee shop, we are told, and a hacker in the corner can immediately steal your passwords and empty your bank account.
It makes for good VPN advertising. It is not a particularly accurate picture of how the modern web works.
Most legitimate websites and apps use Hypertext Transfer Protocol Secure (HTTPS). Transport Layer Security (TLS) encrypts traffic between your device and the service, so another person on the network cannot simply watch your passwords, messages or payment details drift past. There may be some requests that can be seen, such as DNS, so a threat actor may be able to guess what you are doing but not see the details, which is very different from being able to see your password.
Banking and payment services are not relying on the coffee shop router to keep that data secret. The protection sits between your device and the service.
That does not make every public network safe. Phishing sites, malicious access points, invalid certificates and unpatched devices still present risks. A virtual private network (VPN) can add useful protection, particularly for high risk users, but it is an extra layer. It cannot fix a bad click, an unpatched device or an unsafe website. A VPN also shifts some of that trust to the VPN provider, so choosing a reputable one matters.
What HTTPS does and does not protect
HTTPS uses TLS to encrypt data travelling between your device and a website or app. HTTP Strict Transport Security (HSTS) can strengthen this by telling the browser to connect to a particular service using HTTPS only.
In practical terms, someone sitting on the same public network cannot simply see your passwords or banking details as they pass through the router. This is why the likelihood of compromise for everyday users is lower than many public Wi-Fi articles suggest.
However, that protection has limits. HTTPS encrypts the content of your connection, but it does not necessarily hide which services you are using. A network operator or attacker may still be able to see where connections are going, even if they cannot see what is being sent.
A malicious access point may also try to redirect you or steer you towards a phishing website. HTTPS makes interfering with a legitimate connection much harder, but it cannot stop someone entering their details into a convincing fake site.
Not every website is configured correctly either. Some still use HTTP, present invalid certificates or include insecure content. In these cases, the connection may not have the protection you expect.
HTTPS also does not protect your device itself. If your device is outdated, vulnerable or running unnecessary sharing services, another user on the network may still attempt to exploit those weaknesses.
A VPN encrypts traffic between your device and the VPN provider, reducing what the local network can see. For most people accessing trusted websites and apps, this is an additional layer rather than a strict requirement.
That leaves the cases where a connection is not properly protected or the browser cannot verify it. There are usually warning signs, provided you do not click straight past them.
What an insecure connection looks like
Some websites still use HTTP or present certificate errors. This may be caused by a configuration problem or a potentially malicious connection. If you need to shop or bank online using public Wi-Fi, take any browser warnings seriously.
First things first: If you receive an email urging you to take action, do not click any links. It is a common phishing tactic to scare people into action. Best practice in general: if you are unsure, do not click any links you do not expect and just browse to the website yourself.
Once on the website, check the address bar for the browser’s connection controls. The icon varies by browser. Firefox uses a padlock, while Chrome uses a tune icon. Open it to see whether the connection is encrypted or whether the browser has raised a warning. Remember that an encrypted connection does not prove that the website itself is trustworthy.
Browsers show insecure connections and certificate problems in different ways. Some change the address bar controls, while others display a full-page warning.
The address bar may also display a warning icon:
In this example, the website uses HTTPS, but the browser cannot validate its certificate. The traffic may still be encrypted, but the browser cannot reliably confirm that it is connected to the intended website. This might be caused by an expired or misconfigured certificate, a self-signed certificate or someone attempting to intercept the connection. Do not bypass the warning or enter sensitive information.
This may also be presented in other padlock formats to indicate a risk:
If it is unclear, you can click on the padlock and a similar drop-down should appear clearly stating if the connection is secure or not.
Advice to users
When it comes to your device and any installed applications, keep them up to date. It may be tedious, but if you find yourself on the same network as a malicious user, keeping things up to date reduces the risk of your device being exploited.
Familiarise yourself with your phone’s security settings. If you have enabled any sharing mode on the device, disable it or set it to contacts only. File sharing on Windows or Mac is turned off by default. Mobile phones are often configured to “Contacts Only”.
Other measures to consider:
- Forget the Network After Use: Once you are done using a public Wi-Fi network, make sure to forget it so your device does not automatically reconnect.
- Avoid clicking on pop-ups or ads that appear while you are connected to public Wi-Fi.
- Enable Multi-Factor Authentication (MFA), adding an extra layer of security to your accounts.
- Ensure your device has a firewall and up-to-date antivirus software to protect against malicious attacks.
Advice to small business owners
When setting up a Wi-Fi network for your customers, there are a few things business owners should consider. To mitigate the risk of your router being compromised by the very same users to whom you are providing access, it is important to consider the following steps before handing out the password:
- Change the administrator password.
- Regularly update the router.
- Disable remote management features unless necessary.
- Ensure the wireless network uses strong encryption too.
- If possible, enable isolation. This will stop any device from speaking to another device.
The main way users can be exploited is if the access point itself is completely compromised, so keeping this patched should make this more difficult.