Public Wi-Fi Risks Most People Underestimate

A man-in-the-middle (MITM) attack occurs when someone positions themselves between your device and the network, intercepting the data passing between them. On an open or poorly secured public network, this is technically feasible with widely available software. The attacker doesn't need physical access to your device — just to be on the same network.

What's at risk: login credentials sent over unencrypted connections, session cookies that can be used to impersonate you on websites, and form data you submit. Sites using HTTPS encrypt traffic in transit, which significantly raises the bar for this attack — but not all sites or apps use it consistently for every request.

This is one of the most underestimated threats. An attacker creates a Wi-Fi network with a name nearly identical to a legitimate one — "Airport_WiFi_Free" instead of "Airport Free WiFi" — and waits for devices to connect. Once connected, all your traffic flows through their equipment.

Your device has no reliable way to tell the difference. The fake network may even load websites normally by forwarding your traffic through a real connection. The attacker simply logs what passes through. This is why verifying the exact network name with a staff member before connecting matters more than it seems.

Most smartphones and laptops are set to automatically reconnect to networks they've joined before. This convenience feature becomes a liability when a rogue hotspot uses the same name as a network you've previously used — your device may join it without any prompt.

The fix is straightforward: disable auto-connect for public networks in your device's Wi-Fi settings. On most operating systems, you can tell your device to "forget" a public network after you leave, preventing future automatic connections. This is a low-effort habit that removes an entire class of risk.

Even when a website uses HTTPS, the apps on your phone don't always follow suit. Some apps — particularly older or less-maintained ones — transmit data over unencrypted connections, or use a mix of encrypted and unencrypted requests. This means that even if your browser traffic is protected, a background app could be leaking account tokens or personal data.

You generally can't audit this yourself without technical tools. The practical mitigation is to use a VPN on public networks, which encrypts all traffic leaving your device regardless of what the individual app does. This is one of the genuinely useful protections a VPN provides in this context.

Captive portals are the login pages that appear when you first join a public network — the screen asking you to accept terms or enter an email address. While they're standard, they also represent a moment of reduced security. Before you authenticate, your device's connection is open, and the portal page itself may not be fully encrypted.

More importantly, captive portals can be spoofed. A rogue hotspot can serve a fake portal that mimics a real one, collecting whatever information you submit — including email addresses or, in some setups, payment details. Enter only the minimum information required, and never submit a password on a captive portal page.

Even without active interception, simply being on a public network exposes metadata. The network operator — or anyone monitoring the network — can see which domains you're connecting to, how often, and for how long, even if the content of those connections is encrypted. This is sometimes called traffic analysis.

For most casual browsing, this level of observation is low-stakes. But if you're accessing sensitive accounts, conducting business, or handling personal information, that metadata can reveal more than you'd expect. A VPN routes your traffic through an encrypted tunnel, making traffic analysis significantly harder for passive observers on the same network.