You find a seat, open your laptop, and see four networks that all include the café's name. One of them has three bars instead of two, so you pick that one. A login page appears, you type your email address and the password you use nearly everywhere, and you are online. Nothing about that sequence felt unusual, which is exactly why public Wi-Fi deserves a little attention: the risky part is rarely dramatic. It is usually a small detail nobody checks.
What Actually Goes Wrong on Public Wi-Fi
There is a persistent idea that anyone on café Wi-Fi can read everything you do. That was closer to true years ago, before most of the web moved to HTTPS. Today the realistic threats are narrower, and understanding them keeps you from either panicking or shrugging.
The first is a look-alike network, sometimes called an evil twin: an access point using a name that copies or almost copies the real one, set up so your device connects to it instead. The second is a fake login page, a captive portal that exists mainly to collect an email address, a password, or card details. The third is your own device's memory. If it has joined a network called "CafeGuest" before, it may reconnect on its own to any network using that name, with no prompt and no confirmation from you.
Verifying the Hotspot Before You Connect
Before you type a single character, confirm that the network you are looking at is the one the venue actually runs.
- Ask. Ask a barista or the front desk for the exact network name. Staff can usually read it off the router or a card by the till.
- Compare. Scan the list for near-duplicates: "Airport_WiFi_Free" sitting next to "Airport WiFi Free". Two names that differ by a character or an underscore is a reason to slow down, not to guess.
- Read the security label. A network marked "Open" or "None" offers no encryption between your device and the access point. That is common and not automatically malicious, but it means anything sent without HTTPS is exposed to the room.
- Check the venue's own signage. Airports, hotels and chains often print the network name and the portal domain on a card, a receipt, or a sign near the counter. Use that spelling exactly.
- Ignore signal strength as a test. The strongest network is often simply the closest one, and an attacker with a laptop in the corner can easily be the closest one.
Captive Portals: Where Most Traps Live
Once your device joins, the portal decides what happens next. A legitimate one usually asks for something small: a button press, a room number, a code printed on your receipt, or an email address if you want the newsletter. That is normal. What is not normal is a portal that behaves like a form you would never fill in on a stranger's website.
- It asks for the password to your email, bank, or social account "to verify" you. No network needs that to give you internet access.
- It asks for full card details on a network advertised as free.
- It wants you to install a certificate, a configuration profile, or a "connectivity helper" app.
- The address bar shows a bare IP address instead of a domain, or a domain with no obvious connection to the venue.
- The page is full of spelling mistakes, or uses branding that belongs to a different chain.
The address bar is your best evidence. Before entering anything, look at where the page is actually hosted. If it does not use HTTPS, or if your browser warns you that the connection is not private, close the tab, disconnect from the network, and try again. If you have already entered a password, change it from a connection you trust and turn on two-factor authentication if it is not already enabled.
Making Your Own Traffic Boring
You cannot control the network, but you can control how interesting you are to anyone watching it.
Keep your browser and operating system updated, and take certificate warnings seriously rather than clicking through them. When you need to sign in to something sensitive, prefer your phone's own connection over an open hotspot. Use a password manager so that a reused password is not the thing that links one breach to five accounts, and enable two-factor authentication wherever it is offered, since a stolen password alone then gets an attacker very little.
A VPN is useful if you already trust the provider, but be clear about what it does. It hides your traffic from the local network. It does nothing if you hand your credentials to a fake portal, and it will not protect you from something malicious you choose to download. If you use a free VPN, it is worth understanding how the service pays for itself.
Then reduce what your device broadcasts. Turn off file and printer sharing, set new networks to the "Public" profile on Windows, and on macOS enable the firewall option that blocks all incoming connections. Set AirDrop to contacts only, or off, and switch Bluetooth off when you are not using it. These take a minute and remove the easiest ways for a stranger on the same network to reach your machine.
When to Tether Instead
Sometimes the network is simply not worth the effort. Switch to your phone's hotspot when you notice any of the following:
- Certificate warnings appear on sites you use daily without issue.
- The portal address looks unrelated to the venue, or odd in any way.
- You are being redirected to pages you never asked for.
- The same venue name appears twice, or the connection drops and reappears constantly.
Tethering is not a cure for everything, but it replaces an unknown network with one you control. Turn on the hotspot with WPA2 or WPA3 and a long password, keep the phone with you, and turn the hotspot off when you are done. For long sessions, USB tethering saves battery and is usually faster than a weak café signal. Watch your data allowance, and remember your carrier can see the traffic, so HTTPS still matters. For banking, tax paperwork, or anything involving a work account, tethering is the better default.
A Two-Minute Routine Before You Connect
Ask for the network name. Check that it matches what you see. Turn off auto-join for open networks so your device stops making the decision for you. Connect, then read the portal's address bar before typing anything into it. If something seems off, stop and tether.
When you leave, forget the network. Your laptop should not carry a list of every café it has ever met, ready to greet a stranger using the same name tomorrow. None of this requires special software or a security background, just a habit of looking once before you click. If you handle sensitive client data or regulated information, check your organisation's policy, since it may require a managed device and a company VPN on any network outside the office.
Photo: Gustavo Fring / Pexels
