Why shared networks are different
At home, your wireless network is protected by a password that only your household knows, and your traffic is scrambled between your device and the router. On many public networks in cafes, stations, airports and hotels, that protection is missing or weaker. Some require no password at all; others share one password with every customer. That means you are on the same network as strangers whose devices you cannot assess, run by an operator you may know little about.
Public wi-fi is not automatically dangerous, and most sessions pass without incident. The point is to know what is exposed so you can decide what to do on it.
What an open network can expose
Unencrypted traffic. On an open network with no encryption, other people on the network may be able to observe data that travels between your device and the router. Today most websites use HTTPS, which encrypts the content of your connection to the site, so what a snooper can see is usually limited to things like which sites you contact. Sites or apps that still send data without encryption are the real concern.
Fake hotspots. Someone can set up a wireless network with a name similar to a genuine one, such as a cafe’s. Devices that connect to it send their traffic through equipment the attacker controls. This is sometimes called an “evil twin” network. Where a site is properly encrypted, the attacker still has limited visibility, but they may try to trick users into entering details on a fake page.
Other devices on the same network. On a poorly configured network, devices may be able to see or probe each other. File sharing left switched on can make your own files visible.
Redirects and pop-ups. Many public networks show a login or terms page before connecting. Genuine ones exist, but a fake page asking for payment details, email passwords or personal information is a warning sign.
Simple precautions
None of these is perfect, but together they greatly reduce the risk.
Before you connect
- Confirm the exact network name with staff or a sign, rather than choosing the strongest-looking name.
- Turn off automatic connection to open networks, so your phone or laptop does not join one without asking.
- Make sure your device and apps are current. Software updates fix flaws that attackers target on shared networks.
- Switch off file and printer sharing when you are away from home.
While you are connected
- Look for the padlock or “https” in the address bar before logging in to anything, and be wary of browser warnings about certificates. If a warning appears, do not click through it.
- Avoid banking, shopping and anything involving official documents when you are on an unfamiliar network. Waiting until you are on your home connection, or using your mobile data, is usually easy.
- Do not enter passwords on a page reached through a pop-up you did not expect. Go to the service by typing its address.
- Use two-factor authentication on important accounts, so a captured password alone is not enough to get in.
Afterwards
- Tell your device to forget the network once you have finished.
- Sign out of accounts on shared computers, such as those in libraries or hotels, and do not allow the browser to save passwords there.
Mobile data and personal hotspots
Using your own phone’s mobile data, or sharing it as a personal hotspot, avoids most of the problems of a shared network, because the connection is between your device and your mobile provider. It may use up your data allowance, so check your plan, but for sensitive tasks it is often a reasonable choice. If you do create a hotspot, set a strong password so others cannot join it.
What about a VPN?
A virtual private network encrypts traffic between your device and the VPN provider, which can hide your activity from others on the same wireless network. It does not make you anonymous, and it moves trust to the VPN provider, who can see your traffic instead. Services vary in quality and privacy practices, and some free ones earn money in ways that work against your privacy. If you consider one, check who runs it and what it says about logging, or use a service provided by your school or employer if one is offered. Since most websites already use HTTPS, a VPN is useful but not essential for everyday browsing.
Studying in public places
Libraries and cafes are popular study spots, and a few common-sense habits help beyond the network itself. Do not leave a device unattended, even briefly. Use a screen that is hard to read from the next table when you are entering a password. Keep your work saved in more than one place so that a lost or stolen laptop does not mean lost coursework; a simple backup strategy covers this. Many learners also use cloud storage to keep files accessible, which makes it more important to protect that account properly.
Putting it in proportion
Reading emails, watching a lecture or searching for information on a public connection carries limited extra risk when you stick to encrypted sites and keep your software current. The sensible approach is to match the activity to the network: casual browsing is usually fine, while sensitive transactions are best left for a trusted connection. For guidance specific to your country or institution, consult your IT support or the official cyber security advice published by your government.