Public Wi-Fi and VPNs: What They Protect and What They Do Not

Free Wi-Fi at the airport, the café or the hotel is convenient, and the advice you read about it is often contradictory: "never use it" on one side, "just use a VPN" on the other. The truth is more nuanced and more reassuring. In this lesson you will see what the real risks are, how a VPN works, what it genuinely protects, and what it does not.

In the last lesson you learned that HTTPS encrypts the connection between your browser and a website. That fact changes the risk picture of public Wi-Fi quite a lot, so let us look at the situation carefully.

How a Wi-Fi network works

When you connect to a network, your device sends data through a box called a router or access point, which passes it on to the internet. Whoever controls that box can see that your device communicates, with which addresses, and how much. If the content is not encrypted, they can see that too.

At home you control the router. In a café, you do not, and you cannot be sure the network is run by the café at all.

The real risks of public Wi-Fi

• Fake networks ("evil twins"): an attacker sets up a network with a plausible name, such as "Airport Free WiFi" or the café's name, and waits for people to connect. Whoever runs the network can observe and sometimes tamper with unprotected traffic.
• Fake login pages ("captive portals"): many public networks show a page asking for an email address or a phone number. A malicious one may ask for more, such as a password or card details, or push you to install something.
• Eavesdropping on unencrypted traffic: any site or app that does not use encryption is visible to others on the same network.
• Other devices on the same network: on poorly configured networks, other users may be able to probe your device.
• Surveillance by the network owner: even honest networks may log which sites you visit.

Because almost the whole web now uses HTTPS and modern apps encrypt their traffic, passive eavesdropping on the content of what you do is much harder than it used to be. The bigger risks are therefore fake networks and fake pages, plus your own attention.

Sensible rules for public Wi-Fi

1. Prefer your mobile data for anything sensitive: banking, payment, administrative accounts. Your phone's connection is under your control, and you can share it with your laptop as a "hotspot" protected by a strong password.
2. Check the network name with the staff, rather than picking the one that looks right.
3. Turn off automatic connection to open networks, and delete saved networks you no longer use. Your device may otherwise join a fake network that copies a familiar name.
4. Look at the address bar: only enter passwords on pages that use HTTPS and show the correct domain. Heed browser warnings.
5. Never install software or "certificates" that a network asks you to install in order to connect.
6. Turn off file sharing and make sure the firewall is on, and treat the network as "public" if your system asks you to classify it.
7. Log out and forget the network after use.

What is a VPN?

A VPN (virtual private network) creates an encrypted tunnel between your device and a server run by the VPN provider. All your internet traffic goes through the tunnel, and from the provider's server it continues to its destination.

A good analogy: imagine sending your letters inside a locked box to a trusted relay office, which then forwards them to their destination under its own return address. People along the road to the relay office see only locked boxes. The relay office, however, sees everything, and the recipients see the relay office's address, not yours.

What a VPN protects

• Your traffic from the local network. The owner of a public Wi-Fi network, or someone connected to it, sees only the encrypted tunnel, not the sites you visit or the unencrypted content. This is a real benefit on untrusted networks.
• Your internet provider's view, to a degree. The provider sees that you connect to the VPN, but not the sites behind it.
• Your apparent location and IP address from the websites you visit, which see the VPN server's address instead. This can be useful against basic tracking and to reach services from another country, within the rules of the service.
• Work resources: companies use VPNs to give employees secure access to internal systems. That is a different, legitimate and very common use that we will meet in Chapter 6.

What a VPN does not protect

• It does not make you anonymous. The VPN provider can see your traffic and your real address. You have moved trust from the network owner to the provider.
• It does not stop phishing, scams or malware. A fake site is just as fake through a VPN.
• It does not stop tracking by accounts and cookies. If you are logged into a service, it knows who you are whichever address you use. Browser fingerprinting and cookies also continue to work.
• It does not protect you from a compromised device or from your own mistakes.
• It does not make illegal activities legal. Using a VPN does not place you above the law, and serious investigations can still identify people.
• It does not fix an insecure website. Data that a site stores badly is still at risk.

Do you need a VPN?

For many people, the honest answer is: not necessarily. If you use HTTPS sites, a password manager and two-factor authentication, you already have the main protections. A VPN becomes useful if:

• You regularly use untrusted networks and want an extra layer.
• You want to hide your browsing from a local network or your provider.
• You work for an organization that provides its own VPN, in which case you should use it as instructed.

If you decide to use a personal VPN, choose it with the same care as a password manager: a transparent company with a clear policy of not logging activity, ideally confirmed by independent audits; support for current, well-regarded protocols; clear information about who owns it and where it operates; and a paid service rather than a "free" one. Switch on the kill switch option if there is one, which blocks traffic if the tunnel drops.

Securing your own home Wi-Fi

While we are talking about networks, take a few minutes to secure your own:

• Change the default administrator password of the router, which is the one for the settings page, not for Wi-Fi.
• Use the strongest encryption available, WPA3 if possible, otherwise WPA2, with a long passphrase as the Wi-Fi password. Do not use an open network.
• Keep the router updated, and turn off remote administration if you do not need it.
• Create a guest network for visitors and for connected objects, so they stay separate from your computers and phones.
• Disable features you do not use, such as old setup shortcuts.

Your turn

Exercise. You are at an airport and need to check your online bank balance. Describe the safest way to do it, and say whether a VPN would be enough on its own.

See a solution

1. The safest way: use your mobile data rather than the airport Wi-Fi. Open the bank's official app, which you installed earlier from the official store, or type the address yourself, and sign in with your password manager and second factor.
2. If you must use the Wi-Fi: confirm the network name with the airport information desk, avoid any sign-in page that asks for more than an email address, check the domain and HTTPS, and ideally add a trustworthy VPN. Log out afterwards and forget the network.
3. A VPN alone is not enough: it does not protect you against a fake banking page, a fake message or malware on your device. It helps against local snooping, but your habits (the checks from lesson 4.1) remain essential.

Add to your Security Notebook

Under "4. Browsing and communication", write your public Wi-Fi rule ("sensitive things on mobile data only") and your decision about a VPN with one reason. Add a to-do item: change the router's administrator password and check the Wi-Fi encryption.

Next, we look at the most used communication tool of all: email and messaging.