Public Wi-Fi and your home network
Learn what a café or hotel network can really see, the few risks that still matter, and four settings that make your home router much harder to abuse.
WHAT THEY SEE
What the network owner can and can't see
When a site or app uses HTTPS, whoever runs the network can't read your passwords, messages or card numbers. They can usually still see which sites you connect to and when, and how much data moves. Anything sent without encryption, like an old http:// site, they can read in full.
Sara checks her email on hotel Wi-Fi. The hotel can see she connected to her email service at 9pm. It can't read her inbox.
WHAT STILL WORKS
The tricks are about you, not the radio waves
The attacks that still work on public networks mostly need your help: joining a fake network, typing a real password into its login page, clicking past a browser warning, or installing a "certificate" or "profile" the network asks for. Refuse those four and most of the danger is gone.
A Wi-Fi login page that says "sign in with your email and password to get online" is asking for the one thing it has no reason to need.
Check yourself
Negin is at an airport. She sees two open networks with almost the same name and picks one. A page appears: "Free Wi-Fi. Sign in with your email address and email password." What should she do?
- Sign in, because airports often ask for an email before giving free access
- Try the other network with the same name and sign in there instead
- Sign in with her email but make up a password, since Wi-Fi can't check it
- Leave it, and use mobile data or ask staff for the real network name
Show the answer
Leave it, and use mobile data or ask staff for the real network name
Right. A Wi-Fi login may ask for an email or a phone number, but never your email password. Two near-identical names are a hint that one is fake.
Evil twin
A fake Wi-Fi hotspot set up to look like a real one, usually with the same or a very similar name. Anyone can name a network anything, so a name proves nothing. Once you join, the fake network can show you its own login pages and see which sites you visit.
"Cafe_Roya_Guest" next to "Cafe Roya Guest". One belongs to the café. The other belongs to someone sitting at a corner table with a laptop.
Check yourself
Omid is on hotel Wi-Fi. His bank's site shows a full-page warning: "Your connection is not private." Hotel networks are often badly set up, so it's reasonable for him to click "proceed anyway" and log in.
Show the answer
False
False. That warning means the browser can't confirm it's really talking to the bank. A badly set-up network is one explanation; someone intercepting the connection is another, and from the warning alone he can't tell which. He should close the page and use mobile data.
Using public Wi-Fi sensibly
- Ask for the exact network name
From staff or a sign on the wall, not from the list on your phone.
- Save money tasks for mobile data
Banking, payments and logging into your email can wait, or can go over your own phone's data or hotspot.
- Keep sharing off
Turn off file sharing on your laptop, and set nearby sharing on your phone to contacts only or off.
- Forget the network when you leave
And turn off auto-join for open networks, so your phone doesn't jump onto the same name somewhere else.
Check yourself
Rahul is in a café on its open Wi-Fi. Sort what he wants to do.
- Reading a news site
- Paying his phone bill with his card
- Installing a profile the Wi-Fi page says he needs
- Watching a video during lunch
- Logging into his bank app to move money
- Clicking past a certificate warning on his email site
Show the answer
Fine on café Wi-Fi: Reading a news site, Watching a video during lunch
Better on mobile data: Paying his phone bill with his card, Logging into his bank app to move money
Never do it: Installing a profile the Wi-Fi page says he needs, Clicking past a certificate warning on his email site
YOUR OWN NETWORK
Your home router is a door too
Many routers ship with a default admin password that anyone can look up. Four settings fix most of it: change the admin password, use WPA2 or WPA3 with a long Wi-Fi password, install firmware updates, and give visitors a guest network so they never touch your main one.
You don't need to understand every menu. Log in once, change those four things, write the new passwords in your password manager, and you're done for a long while.
Check yourself
Match each home network problem to its fix
Show the answer
- The router still logs in with admin / admin → Change the router's admin password
- A former flatmate still knows the Wi-Fi password → Set a new Wi-Fi password and reconnect your devices
- Relatives visit and want Wi-Fi → Turn on a guest network for them
- Nobody has touched the router in four years → Check for and install firmware updates
Lesson recap
- With HTTPS, a public network can see which sites you visit, not what you type.
- The real risks need your help: fake networks, password-hungry login pages, clicking past warnings, installing profiles.
- Get the exact network name from staff, and keep banking and payments for mobile data.
- At home: new admin password, WPA2 or WPA3 with a long password, firmware updates, a guest network.