How to use public Wi-Fi without giving your data away

Joining cafe, airport or hotel Wi-Fi is routine, and the risk is narrower than the old warnings suggested. Most traffic between a current browser and a website is encrypted, and newer Wi-Fi standards encrypt open networks too. What still goes wrong is the network you pick and what you do after joining it.

An open network is not automatically unsafe

The industry group that certifies Wi-Fi equipment requires a feature called Wi-Fi Enhanced Open on certified devices, as its wi-fi.org security page explains. That feature encrypts traffic on open networks with no password, so a hotspot labelled open can still protect the link between your device and the access point. It is not a promise about every network you meet, but a name alone proves little.

Confirm the name before you connect

The US Cybersecurity and Infrastructure Security Agency is direct in its guidance: always confirm the name and password of a public hotspot before you use it, as cisa.gov states. The reason is an attack called an evil twin. Someone sets up an access point pretending to be the venue's network, often with a stronger signal, so nearby devices connect to it first and their traffic passes through equipment the attacker controls. Asking staff for the exact network name takes seconds. Two networks that look like the same venue are a warning, not a convenience.

What to check once you are connected

• Look at the address bar. A padlock and https mean the page is encrypted between your device and the site. Log in only after you see them.
• Move sensitive logins to mobile data. Banking, tax and email are better done on your own connection when you have signal.
• Turn on two-factor authentication. If a password does leak, the second step still blocks most account takeovers.
• Install the updates you postponed. A patched browser is harder to exploit than one ignored for months.
• Switch off automatic joining. Disable file sharing and any setting that connects to open networks on its own.

What a VPN does, and what it does not

A VPN encrypts everything from your device to the provider, which helps on a network you do not control. It does not turn a fake hotspot honest, does not rescue you from a page where you typed your password yourself, and moves your trust to the VPN company rather than removing it. If you use one, pick a provider you have reason to trust.

The bottom line

Public Wi-Fi is usable. Ask for the real network name, look for https before logging in, keep sensitive accounts on mobile data, and let updates run.