What makes public Wi-Fi different
At home, only people you allow share your network. In a cafe, airport, hotel or library, dozens or hundreds of strangers may be on the same one. Anyone who runs or controls that network, and sometimes other users on it, is in a position to see more than you would like. That does not mean public Wi-Fi is always dangerous. The risk is real but often overstated, and modern websites and apps protect much more than they once did.
What can go wrong
Snooping on unencrypted traffic. Data sent over an open network without protection can potentially be read by others nearby. Most websites now use encrypted connections (the padlock icon and “https” in the address), which scramble the contents so a bystander cannot read them. Older or poorly built sites and apps may still send things in the clear.
Fake hotspots. An attacker can set up a network with a believable name, such as a variation of the cafe’s name. Devices or people who connect to it send their traffic through the attacker’s equipment. This is sometimes called an “evil twin” network.
Fake login or “terms” pages. Many public networks show a page asking you to accept terms or enter details before you get online. A fake version can ask for an email address and password, or push you to install software. A legitimate page should not require your bank or account passwords.
Tampered connections. Someone in a position to interfere may try to redirect you to a lookalike site or show a certificate warning. If your browser warns you that a connection is not private, do not click through.
Other devices on the network. On poorly configured networks, file sharing or exposed services on your device can be reachable by others.
Phishing opportunities. Public networks are also used to lure people into fake sign-in pages, a close cousin of the usual phishing emails.
Safer habits
Confirm the network name. Ask staff for the exact name rather than picking the strongest signal with a similar name. Turn off the setting that automatically joins open networks.
Prefer your phone’s hotspot for sensitive work. Mobile data is typically harder for strangers to interfere with than a shared network. It is a good choice for banking, payments or work that involves private information, though check your data plan first.
Look for the padlock. Use sites with encrypted connections, and never ignore a browser warning. Type sensitive addresses yourself or use bookmarks rather than following links.
Keep software current. Software updates close flaws that attackers can use on shared networks. Turn on automatic updates for your operating system, browser and apps before you travel.
Turn on two-factor authentication. If someone captures a password, a second factor can still stop the sign-in. Be careful with codes: no one at the cafe or from the “network” has a reason to ask for them.
Use a virtual private network if it suits you. A reputable VPN encrypts traffic between your device and the VPN server, which can protect against local snooping. It does not make you anonymous, does not protect against phishing or malware, and shifts trust to the VPN provider, so choose carefully.
Limit sharing. Switch off file and printer sharing, and treat the network as public in your device’s settings if it asks how to classify it.
Log out and forget the network. When you finish, sign out of accounts you used and remove the network from your saved list.
What to do or postpone
Generally fine on public Wi-Fi with encrypted sites: reading news, checking a map, streaming a video. Better to postpone or move to mobile data: online banking, entering card details, accessing work systems with confidential information, and changing account passwords. If you must do something sensitive, use mobile data, or a VPN, plus a second factor on the account.
If you think something went wrong
If you entered a password on a suspicious page or saw odd warnings, disconnect, then change the password from a trusted connection, preferably a different device. Review recent account activity and tell your bank or employer if relevant. For the longer view of wireless habits, the basics of how routers and networks work also help explain why a shared connection behaves differently from your own, and a protected home Wi-Fi setup is a good contrast to the open networks you meet while traveling.
Used with sense, public Wi-Fi is usually fine. Think of it as a shared room: you can chat in it, but you would not read out your card number there.