Public Wi-Fi and VPNs: What Actually Protects You Now
HTTPS changed airport Wi-Fi from a minefield to a moderate risk. What still threatens you on shared networks, what VPNs genuinely fix, and how to configure a trustworthy setup.
Published · Updated · 6 min read
'Never use café Wi-Fi' is aging advice. Since HTTPS became near-universal, the classic coffee-shop attacks, sniffing passwords from open air, injecting banners into HTTP pages, mostly died. But shared networks still carry real risks, and the VPN industry sells solutions to problems it exaggerates while ignoring ones it cannot fix. Here's the current, honest picture.
What changed: encryption by default
The overwhelming majority of web traffic now loads over TLS. Your logins, messages and page contents travel encrypted end-to-end, invisible to anyone sharing the network. Browsers flag non-HTTPS sites loudly. So the stranger running packet capture next to you sees connection metadata, which domains you contact, roughly how much data, but not your passwords.
What still hurts on hostile networks
- Evil-twin access points: a laptop posing as 'Airport_Free_WiFi' captures everything up to and including your DNS queries; TLS protects content but hides destination domains unless modern encrypted-SNI features are active.
- Captive-portal spoofing: fake login pages harvest email credentials or social logins in exchange for 'internet access'.
- Local service discovery: file sharing, AirDrop/Nearby Share left open, or printer protocols can expose devices to direct attacks from others on the same subnet.
- Non-TLS traffic: some apps, IoT gadgets and plain-HTTP resources still transmit readably.
- Shoulder surfing and camera capture over your shoulder, analog threats no protocol fixes.
VPNs: solving less than advertised
A VPN creates an encrypted tunnel from your device to the provider's server. Against hostile-network snooping it adds little on top of HTTPS, your traffic was already unreadable. Its genuine benefits: hiding destination-domain visibility from the local network, masking your IP from destinations, and sidestepping network-level censorship or geo-blocks.
The trade is trust: your ISP no longer sees your traffic, the VPN provider does. Choose providers with independent no-logs audits, transparent jurisdiction and a track record, or self-host a WireGuard endpoint on a cloud server you control. Free VPNs monetize exactly the data you hired them to protect; avoid them outright.
A sane travel checklist
- Verify you're joining the legitimate venue network name with staff, not whichever signal is strongest.
- Prefer phone tethering for anything sensitive; cellular encryption beats any shared hotspot.
- Enable your operating system firewall and disable file/AirDrop discovery on 'Public' network profiles.
- Turn on HTTPS-only mode in your browser settings.
- Sign out of sensitive sessions rather than staying permanently logged in on shared machines, and never on public PCs.
Shared networks are fine for browsing the news with basic hygiene; they're the wrong place to skip precautions on banking or admin panels. Check where your connection appears to come from with our IP Lookup tool before trusting a hotel network with anything that matters.