Wi-Fi Threats and Public Hotspots: Real Risks, Sensible Habits

Free Wi-Fi is everywhere: cafés, airports, hotels, libraries and trains. Dr. Al-Doori devotes two chapters to it. Chapter 18 describes the threats that target Wi-Fi users, and Chapter 19 applies them to public hotspots. Because both chapters center on the same attack, a fake network pretending to be a real one, we teach them together here. The book's fourth threat, piggybacking on a home network, moves to Lesson 5.10, where it belongs with running your own router.

What you'll be able to do

Explain how fake hotspots and eavesdropping work, and decide when public Wi-Fi is fine and when to use mobile data or a VPN. By the end of this lesson you will be able to:

• describe sniffing, rogue access points and evil twins in plain words;
• explain why public Wi-Fi is much less risky than it used to be, and which dangers remain;
• choose sensibly between public Wi-Fi, mobile data and a VPN for a given task.

Three Wi-Fi Threats, in Plain Words

Sniffing means listening in. Normally a device ignores network traffic that is not addressed to it, but, as the book explains, freely available software can switch a computer into a mode where it collects everything travelling over the air nearby. Think of someone quietly picking up a second phone handset to listen to your call.

A rogue access point is an unauthorized Wi-Fi access point added to a network, by an attacker or simply a careless employee, creating a back door around the network's normal defenses. This is mostly a risk for organizations.

An evil twin is a fake network that copies the name of a real one. As you learned in Lesson 2.4, a network name proves nothing about who runs it, and devices tend to join a familiar name with a strong signal. So your phone may happily connect to "Airport_Free_WiFi" run by someone at the next table instead of the airport. The book notes that the operator of a fake hotspot sits in the middle of your connection.

What Has Changed: Encryption Did the Heavy Lifting

When the original text was written, much of the web still travelled unencrypted. On an open network, a sniffer or an evil-twin operator could read passwords and card numbers as they passed. That is why the book advised treating public Wi-Fi as hostile.

Since then, the web has moved almost entirely to HTTPS, the encrypted connection you studied in Lesson 5.7. Mozilla reported in 2025 that only about 2.4% of page loads in Firefox still used plain HTTP, and most apps encrypt their traffic too. As a result, widespread HTTPS encryption has greatly reduced the classic public-Wi-Fi sniffing risk. The US Federal Trade Commission (FTC) said in 2023 that, because most websites now use encryption, using public Wi-Fi is usually safe.

Be precise about why. The protection comes from the encryption between your browser or app and the website, not from the hotspot itself. Many public networks are open, with no Wi-Fi password and no encryption on the radio link at all. Some newer networks do encrypt the radio link, using WPA3 or a feature called Wi-Fi Enhanced Open, which encrypts even password-free networks. That is a welcome extra, but you usually can't check who operates a network, and it is not the reason public Wi-Fi became safer.

What can a hotspot operator still see? Mainly which sites you connect to, not what you type into them. Your passwords and card details travel inside the HTTPS connection.

What Still Goes Wrong

The remaining risks need you to do something, which means you can avoid them.

Fake sign-in pages. Many hotspots show a captive portal, a web page that appears when you join, asking you to accept terms or enter a room number. A fake hotspot can show a fake portal instead, asking for your email address and email password, your card details, or for you to install something "to connect". A genuine portal may ask you to accept terms or enter a code you were given; it should never need your email password or a software install.

Certificate warnings. If an attacker tries to sit in the middle of an HTTPS connection, your browser usually shows a full-page certificate warning. That warning is your protection working. As Lesson 5.7 taught, never click past it.

Automatic joining. Your phone and laptop remember networks you have used and rejoin them automatically. That is convenient at home, but it means a fake network using a common name can draw your device in without you noticing. Turn off auto-join for public networks, and "forget" networks you no longer use.

Out-of-date devices. Joining a network puts your device alongside everyone else's on it. The book advises keeping software updated and the firewall on, and the FTC and the UK's National Cyber Security Centre (NCSC) still emphasise updates.

Mobile Data or a VPN for Sensitive Moments

For everyday browsing on HTTPS sites, public Wi-Fi is generally fine. For more sensitive moments, such as online banking, a work login or anything you would hate to get wrong, the NCSC advises using mobile data or your phone as a personal hotspot, or a VPN, instead of an unknown hotspot.

A VPN (virtual private network) creates an encrypted tunnel from your device to a VPN provider's servers, and your traffic leaves from there. On public Wi-Fi this hides even the names of the sites you visit from the hotspot operator. But a VPN does not make risk disappear: it shifts your trust to the VPN provider, which can now see what the hotspot could have seen. Choose a provider you have good reason to trust, such as one supplied by your employer or school, and be cautious of free services. A VPN also does not turn a fake website into a real one, or remove malware from your device.

A quick decision guide:

• Reading news or browsing HTTPS sites: public Wi-Fi is fine.
• Banking, work systems or anything sensitive: use mobile data, your own hotspot, or a trusted VPN.
• A sign-in page asks for your email password, card details or an install: leave the network.
• A certificate warning appears: do not continue.

Real-World Example

Imagine Daniel at an airport, waiting for a delayed flight. His laptop finds "Free Airport Wi-Fi" and joins. A page appears: "Sign in with your email account to get 2 hours free". It shows a familiar email logo and asks for his address and password. The page looks professional and has the usual connection icon.

Daniel stops. A genuine airport portal might ask him to accept terms, but it has no reason to need his email password. He disconnects, turns off auto-join for that network, and uses his phone's mobile data as a personal hotspot instead. Had he typed his password, HTTPS would have done nothing to help: the encrypted connection would simply have delivered his password safely to the attacker.

From the Book to 2026

What the book teaches. Chapters 18 and 19 describe sniffing, rogue routers, evil twins and unauthorized connections; explain that a fake hotspot owner can record what you send, including passwords and card numbers, and that open networks are unencrypted; and advise using a VPN, checking for HTTPS, keeping software updated and keeping the firewall on. The book also notes that these Wi-Fi threats do not apply to mobile data.

Why it made sense. When much web traffic was unencrypted, a sniffer or fake hotspot really could capture passwords and card numbers, so a VPN was the strongest everyday protection.

What has changed. Security guidance has evolved since the original text. Widespread HTTPS encryption has greatly reduced the classic sniffing risk, and the FTC now describes public Wi-Fi as usually safe. Fake hotspots and fake captive or login pages remain possible, so the danger has moved from silent eavesdropping to tricking you into typing secrets. The advice on VPNs has softened: the NCSC suggests mobile data or a VPN for sensitive tasks, and a VPN moves your trust to its provider. Mobile data is a sensible alternative to an unknown hotspot, though phones face other risks, such as scam texts and SIM swaps (Lesson 5.6).

What to do now. Current guidance now recommends using public Wi-Fi normally for everyday HTTPS browsing; treating auto-join carefully; never giving passwords, card details or installs to a Wi-Fi sign-in page; never clicking past certificate warnings; keeping devices updated with the firewall on; and using mobile data or a trusted VPN for sensitive situations.

Watch: How Do I Use an Open Wi-Fi Hotspot Safely?

In this video, Leo Notenboom of Ask Leo! answers a real reader's question about using café Wi-Fi safely. It is practical and calm, and it covers several habits from this lesson.

As you watch, notice:

• how he tells apart a network that asks for a password before you can connect from an open one that only shows a sign-in page in your browser afterwards;
• his point that, even when you use an open hotspot correctly, someone can still see which sites you visit, even though they can't see what you send;
• his "solid alternative": using your phone's mobile connection, by tethering or as a personal hotspot, instead of the open network.

The video reinforces what you just read — the lesson is complete without it.

What Would You Do?

At a train station you need to send a file from your work email. You join "Station_Free_WiFi", and a page asks you to "sign in with your work email and password to continue". Your phone has mobile data. What do you do?

Knowledge Check

Key Takeaways

• Sniffing, rogue access points and evil twins are real ideas, but widespread HTTPS encryption has greatly reduced the classic public-Wi-Fi sniffing risk.
• Today's real dangers are fake hotspots, fake sign-in pages, ignored certificate warnings, careless auto-join and out-of-date devices.
• Never give a Wi-Fi sign-in page your email password, card details or permission to install something.
• For sensitive tasks, use mobile data, your own hotspot, or a trusted VPN, remembering that a VPN shifts your trust to its provider.

Further Study

Optional and external; the lesson is complete without it.

• Do VPNs Really Protect Privacy? (IBM Technology) — a longer, balanced look at what a VPN does, how it shifts trust to the provider, and what it cannot do. Note that its opening scenario, in which an evil twin "sees all your packets", leaves out HTTPS; the presenter acknowledges later that most websites now use encryption.

Sources

• US Federal Trade Commission — Are Public Wi-Fi Networks Safe? What You Need To Know (2023)
• UK National Cyber Security Centre — Small Business Guide (public Wi-Fi advice)
• UK National Cyber Security Centre — Exercise in a Box: Connecting securely micro exercise
• Wi-Fi Alliance — Wi-Fi CERTIFIED WPA3 Technology Overview
• Wi-Fi Alliance — Wi-Fi CERTIFIED Enhanced Open delivers data protection in open Wi-Fi networks
• Mozilla — HTTPS-First in Firefox 136 (2025)
• Dr. Tahseen Al-Doori — Cyber Security Essentials, Chapters 18 and 19