← BACK TO PUBLIC-WIFI

Public WiFi is Spying on You

That free airport wifi is not your friend. Here's what's actually happening and how to use public networks without handing over your life.

The uncomfortable truth

You connect to “Free_Airport_WiFi” and your phone celebrates. Full bars. You open your banking app. You log into your email. You shop for shoes.

Meanwhile, someone three tables over is watching everything.

Not metaphorically. Literally.

How public wifi attacks work

Public networks are open by design — no password, no encryption between you and the router. That means anyone on the same network can see what you’re sending if it’s not encrypted.

Here’s how they do it:

  • Packet sniffing — intercepting the unencrypted data flying between your device and the router. Login forms, cookies, search queries. If it’s plain HTTP, they see it all.
  • Rogue hotspots — attacker sets up a wifi network named “CoffeeShop_GuestWiFi” right next to the real one. You connect to theirs by mistake. Now everything goes through their laptop.
  • Man-in-the-middle — attacker positions themselves between you and the website you think you’re visiting. You load your bank’s login page. It looks right. It’s actually a perfect copy served by the attacker.
  • DNS spoofing — they hijack the network’s phonebook so “chase.com” resolves to their server instead of the real one

This isn’t theoretical. These tools are free, automated, and the laptop doing it looks like any other laptop on a table.

What’s actually safe vs not safe

Here’s the part most guides get wrong. Not everything is equally risky.

Safe on public wifi:

  • Websites using HTTPS (the URL starts with https:// and your browser shows a lock icon) — the connection is encrypted even on open wifi. The network owner can see that you visited chase.com, but not what you did there.
  • Apps that enforce their own encryption — most banking apps, most major apps with certificate pinning
  • Anything you’re only reading, not logging into

Actually risky:

  • Any site still on HTTP — the network can read your traffic in plaintext
  • Logging into accounts over HTTP (some forum sites, older platforms)
  • File sharing or SMB access on the same network
  • Using the same network for work without a VPN

The real danger isn’t HTTPS sites. It’s the exceptions — mixed-content pages, apps that fall back to unencrypted, certificate warning pages you click through because you’re impatient.

How to use public wifi without being stupid

  1. Stick to HTTPS sites. Your browser enforces this for you. If you see a certificate warning, stop. Don’t click through it.
  2. Use a VPN. This is the real fix. A VPN encrypts everything between you and the VPN server, so the local network sees nothing but encrypted traffic. Even your DNS queries go through the tunnel. Mullvad, ProtonVPN, IVPN — pick one that’s no-logs and actually trustworthy. Avoid free VPNs; they’re the attacker.
  3. Turn off auto-connect. Your phone shouldn’t silently join “attwifi” without asking. Disable auto-join for open networks in your wifi settings.
  4. Don’t log into anything sensitive. If you can wait to check your bank account until you’re home, wait. If you need to, use your mobile data instead.
  5. Use mobile data for anything important. LTE/5G is encrypted by the carrier. It’s not on a shared network. For banking, email login, work stuff — switch off wifi and use your cell connection.
  6. Forget the network after you leave. Don’t let your phone auto-reconnect to “Free_Airport_WiFi” next time you’re at that airport. A persistent attacker can weaponize a remembered SSID.

The “I don’t have anything to hide” argument

Yeah you do. You have bank credentials, email access, work logins, identity documents stored in accounts. The question isn’t whether you have something to hide. It’s whether you want some random dude at a coffee shop reading your email.

What to do if you think you were compromised

  1. Change passwords for any account you logged into on that network
  2. Enable 2FA on those accounts if you haven’t
  3. Check those accounts for unauthorized logins or changes
  4. Run a malware scan if you downloaded anything or clicked through any warnings

The bottom line

Public wifi isn’t a death sentence. Most of your traffic is probably already encrypted via HTTPS. But the exceptions — the HTTP site, the app that downgrades, the cert warning you ignore — those are where people get burned.

Use a VPN. Stick to HTTPS. Use mobile data for anything sensitive. That’s it. You’re now safer than 95% of people on that network.