Public Wi-Fi Safety: What a Cafe Network Can See — and What Actually Helps

The hotel lobby problem

In 2017, researchers at the DEF CON Wi-Fi Pineapple village showed a version of a trick security teams already feared: a laptop that looks like the hotel's network. Travelers click the familiar name, land on a lookalike login page, and type a password they also use for email. HTTPS has closed a lot of the old "anyone can read your traffic" story. It has not closed impersonation, misconfigured captive portals, or the colleague who turned on a hotspot named Marriott_Guest.

From the record

Assume a shared network is a crowded room. Speak as if someone nearby can hear the metadata, even if they cannot hear every word.

Adapted from CISA guidance on public Wi-Fi

How cafe Wi-Fi actually works

A coffee-shop access point is a shared radio. Everyone at the tables is, in a real sense, on the same small network. The router may isolate clients. Many do not. A captive portal — the page that asks you to accept terms — sits in front of the internet and is a favorite place for lookalike logins. An evil twin is a nearby laptop broadcasting a name you already trust, like the hotel SSID. You join the wrong radio. From there, the attacker does not need to 'break HTTPS.' They need you to type a password into a page that is not the real bank.

HTTPS still does the important job of encrypting the content of a real website. What the local network can often still see is metadata: that you talked to a given hostname, when, and how much data moved. DNS queries, if they leave your device unencrypted, are another list of names. A VPN wraps that hop so the cafe sees a tunnel to a VPN server instead of a shopping list of destinations.

What still gets exposed

On an open or poorly segmented cafe network, a nearby device can sometimes see which destinations you contact, inject ads on unencrypted sites, or serve a fake portal. Modern browsers paint a lock on HTTPS pages, which already encrypts the content of those sessions. A VPN still helps when a site is misconfigured, when DNS is being watched locally, or when you do not want the coffee shop to log every hostname you visit.

A travel checklist that is not a brand

Before you leave home

• Update the OS and browser while you are on a network you trust. Do not wait for airport Wi-Fi to patch a hole.
• Install a password manager and turn on two-factor for email — email recovers everything else.
• Write down or print vault recovery materials. Do not email them to yourself.

On the network

• Prefer official apps over typing passwords into a browser on a kiosk.
• Confirm the SSID with the front desk instead of picking the strongest signal named Marriott.
• Skip software downloads and 'free VPN' APKs from unknown networks.
• If you already typed a password into a page that felt wrong, change it from a trusted network and assume email is next.

Where a VPN fits — after the habits

A VPN is the layer for the hop you do not control. Turn on a kill switch so traffic does not leak if the tunnel drops on flaky hotel Wi-Fi. That is a setting, not a slogan. If you want a privacy-first option with a real free tier to learn those settings, Proton VPN is the example this guide mentions — after the checklist, not instead of it.