Is Public Wi-Fi Dangerous? Settings for Using It Safely, and What Not to Do on It

What risks still remain today

The biggest threat used to be someone on the same Wi-Fi reading everything you sent. Now that almost every website is encrypted with HTTPS, there are far fewer situations where your traffic can simply be read. But that doesn’t mean the risk has gone.

Note that the top three all work because the user connects or types something in themselves. Tricks that exploit human mistakes have become a more realistic threat than technical eavesdropping.

Settings to make before and while connecting

Most protections keep working once set. Doing them before a trip or business travel saves you from having to think about it on the spot.

1. 1

   Confirm the correct SSID with staff or signage

   When similar names are listed, always check against the provider’s sign. A generic name like “Free_WiFi” can be set up by anyone. Even SSIDs containing the venue’s name sometimes include one that differs by a single character.

2. 2

   Turn off auto-join

   Automatically reconnecting to SSIDs you’ve joined before also means connecting automatically to a fake hotspot with the same name. For Wi-Fi in public places, turn off “auto-join” after connecting.

3. 3

   Turn off file sharing and network discovery

   On Windows, set the network type to “Public” when connecting. On a Mac, check the sharing settings. On a smartphone, set the feature for sending files to nearby devices to “contacts only” or “off”.

4. 4

   Keep your OS and browser up to date

   Many of the mechanisms that block interception are built into the OS and browser. A device with pending updates has outdated protections.

5. 5

   Delete the network when you’re done

   A saved SSID keeps looking for a signal with that name. It is safer to remove Wi-Fi networks for places you won’t visit again from your saved list.

Also be careful with the login page shown after connecting (the captive portal). Registering an email address is common, but if it asks you to link a social media account or for details such as your date of birth or phone number, think about whether that is really necessary. Some are simply collecting personal data in exchange for free Wi-Fi.

Things to avoid doing on public Wi-Fi

You don’t need to avoid everything. Checking maps, reading the news and watching videos rarely cause problems, but for actions where you have a lot to lose, it is safer to choose your connection.

• Online banking and money transfers: the action with the biggest potential loss. Switch to mobile data or tethering.
• Entering a credit card number for the first time: typing a number on the spot is riskier than paying with a saved card.
• Logging in to important accounts on a new device: email accounts in particular, once taken over, are used to reset the passwords of other services.
• Accessing work systems: if your company specifies a VPN or connection method, always follow it.
• Changing passwords: there is no need to do it in a public place. Wait until you are back on a safe connection.
• Sending or receiving important files: for contracts or files with personal data, switch connections or do it later.

A VPN is a valid option, but not a cure-all. It hides the content of your traffic, but the VPN provider ends up handling your traffic route itself. Rather than use an untrustworthy free VPN, it is safer to switch to tethering.

Protect your accounts, not just your device

A point often overlooked in public Wi-Fi safety is “what would happen if one set of credentials were stolen?”. If you keep that small, the damage stops at one service whatever connection you use.

• Don’t reuse passwords: this is the most important measure for stopping one leak from spreading to other services. Email and financial services in particular must have their own unique passwords.
• Turn on two-factor authentication: even if a password is stolen, it isn’t enough to log in. Authenticator apps and passkeys are safer than SMS.
• Start with the most important accounts: email, finance, and the phone number used to recover them. Securing these three first stops most chain reactions.
• Check your login history: major services show the devices and locations that have logged in. Looking once after a trip or business travel helps you spot anything unusual.
• Use a screen lock on your device: it guards against shoulder surfing and leaving it behind. Sometimes it helps more than technical measures.

1. 1

   Find the passwords you reuse

   Check whether you use the same password, or ones differing only by a number, across several services. If anything comes to mind, that is your weakest point.

2. 2

   Create a unique password for each service

   Passwords you think up yourself end up looking alike. A random password generator gives you a patternless string for each service. At 16 characters or more, brute force is not a realistic threat.

3. 3

   Store them instead of memorising them

   Memorising dozens of unique passwords is unrealistic. Save them in your browser’s or OS’s password manager, or a dedicated manager, so the only one you need to remember is the master password.

4. 4

   Turn on two-factor authentication in order of importance

   Set it up for email, then finance, then social media. Keep recovery codes somewhere offline, for example printed out.

What really makes public Wi-Fi safe is not some special action on the spot but this preparation done in advance. Stop reusing passwords and turn on two-factor authentication, and even if you once connect to a suspicious network, the paths for the damage to spread are already closed.

FAQ

Is public Wi-Fi really dangerous?

The nature of the danger has changed. With almost all websites encrypted, there are far fewer situations where your traffic can simply be read. The realistic threats now are fake hotspots named like the venue, fake login pages shown right after connecting, and ignoring certificate warnings. All of these work because users connect and type in information themselves, so checking the SSID and never ignoring warnings are the core of protection.

Is Wi-Fi with a password safe?

With Wi-Fi that uses a posted password, everyone there shares the same password. Anyone who knows it is inside the same network, so the padlock doesn’t mean others can’t get in. Treat shared Wi-Fi in shops and airports as “a place with other people on it”, whether or not it has a password.

Can I use online banking on public Wi-Fi?

It is a prime example of what to avoid. It isn’t that your data will certainly be stolen, but the potential loss is large and there is no reason to choose that connection. Switch to mobile data or tethering. Likewise, entering a new card number, logging in to your email account on a new device and changing passwords are best done once you are back on a safe connection.

Does a VPN make public Wi-Fi safe?

It helps by hiding the content of your traffic, but it isn’t a cure-all. Using a VPN means entrusting your traffic route to that provider, so it depends on the provider being trustworthy. Rather than use a free VPN of unknown origin, tethering is safer. A VPN also can’t stop you typing information into a fake login page, so combine it with account-side measures such as not reusing passwords and turning on two-factor authentication.