What about Public WiFi?

This is a complicated topic. It’s true that browsing on public Wi-Fi is much safer and more private than it used to be thanks to the widespread embrace of HTTPS on the web. Other people on the public Wi-Fi network can’t just snoop on everything you’re doing. Man-in-the-middle attacks aren’t as trivially easy as they used to be. The EFF (Electronic Frontier Foundation) recently came down on the side of public Wi-Fi being safe, writing that “There are plenty of things in life to worry about. You can cross ‘public Wi-Fi’ off your list.”

That sounds like sensible advice. And it’d be great if public Wi-Fi was completely safe! I’ve certainly used public Wi-Fi myself and I don’t worry about it as much as I used to.

But, if you’re asking me whether Wi-Fi is entirely safe, I can’t say that. Malicious hot spots, that is, the owner of the hot spot may be gathering data or doing other things he/she is not supposed to do. The community over at Hacker News had quite a few thoughts about the dangers of public Wi-Fi, too. 

Here’s the bottom line: Random people aren’t going to snoop on your activities on public Wi-Fi anymore. But it would be possible for a malicious hot spot to do a bunch of bad things. Using a VPN on a public Wi-Fi network or avoiding public Wi-Fi in favor of your cellular data network is safer. Worse yet, the public Wi-Fi hot spot itself could perform a “man in the middle” attack, modifying the web pages sent to you. The hot spot could change any web page or other content accessed over HTTP. If you downloaded software over HTTP, a malicious public Wi-Fi hot spot could give you malware instead.

Now, HTTPS has become widespread, and web browsers are branding traditional HTTP sites “not secure.” That is very misleading. If you connect to a public Wi-Fi network and access web sites over HTTPS, other people on the public Wi-Fi network can see the domain name of the site you’re connected to (for example, howtogeek.com), but that’s it. They can’t see the specific web page you’re viewing, and they certainly can’t tamper with anything on the HTTPS site in transit. The amount of data people can snoop on has gone way down, and it’d be harder for even a malicious Wi-Fi network to tamper with your traffic. While public Wi-Fi is safer and more private than it used to be, the security picture is still messier than we’d like.

For maximum protection on public Wi-Fi networks, we still recommend a VPN (virtual private networks). When you use a VPN, you connect to a single VPN server, and all of your system’s traffic is routed through an encrypted tunnel to the server. The public Wi-Fi network you’re connecting to sees a single connection—your VPN connection. No one can even see which websites you’re connecting to. I did cover VPN’s in a previous column. I still use Windscribe but there are many others. That’s a big reason why businesses use VPNs. If your organization makes one available to you, you should seriously consider connecting to it when you’re on public Wi-Fi networks. However, you can pay for a VPN service and route your traffic through there when you use networks you don’t completely trust. 

You could also skip public Wi-Fi networks entirely. For example, if you have a cellular data plan with wireless hotspot (tethering) capabilities and a solid cellular connection, you could connect your laptop to your phone’s hotspot in public and avoid the potential problems involved in public Wi-Fi. I do this quite often in hotel rooms but be sure you bring your phone charger as the laptop or router that you use will drain your phone very quickly.