Common Mistakes When Using Public Wi-Fi in Cafes and Airports

Common Mistakes When Using Public Wi-Fi in Cafes and Airports

Gate 22 has been moved twice, the coffee has gone cold, and the airport Wi-Fi is free. You tap the network, accept a splash page you didn't read, and start catching up on email. Somewhere else in the terminal, someone is hoping you'll do exactly that.

Public networks have improved a lot, and much of the advice from a decade ago no longer applies. What hasn't changed is this: the signals travelers use to feel safe — a padlock in the address bar, a VPN icon in the corner, an official-looking login page — mean less than they appear to. The mistakes below are common because the reassuring parts are real, just narrower than people assume.

The Padlock Is a Narrow Promise

HTTPS protects one connection: the one between your browser and a single website. It stops whoever runs the café's router from reading the password you type into a login form. That's genuinely valuable, and it's where the guarantee ends.

The padlock tells you that the site you're on is using encryption between your browser and that site's server. It does not tell you the site is honest, the network is safe, or the app on your phone is doing the same thing. If you log into an airline account over HTTPS, the person on the airport Wi-Fi may not see your password. But they might see the domain you visited, the timing of your request, the amount of data you sent, and every unencrypted request your device makes in the background.

Example: you connect to Airport_Free_WiFi and open your webmail. The webmail page is HTTPS, so the message body is encrypted. But your phone also tries to sync photos, check for app updates, and contact push servers. Some of those connections are properly encrypted; some are not. A malicious hotspot can learn which apps you use, when your phone wakes up, and which services it trusts. That's not your password, but it's a map of your digital life.

Encryption is not a blanket. It's a narrow beam, and it only covers what it's pointed at.

A Captive Portal Is Not a Security Check

The splash page feels official. It has the café's logo, a checkbox for terms you won't read, and a button that says Connect. Surely someone vetted this. In reality, captive portals are just web pages. Anyone can run one. A fake portal can look identical to the real one and collect whatever you type.

At a hotel, you might enter your last name and room number. At a café, you might click "Connect with Facebook" or type an email address. Those details may be used for marketing — or they may be used to train you to hand over information without thinking. A fake portal can also inject a fake login page for your email or bank after you connect, hoping you'll blame the coffee shop when your credentials disappear.

What to do: before entering credentials, close the portal and try to reach a known site. If the portal reappears, check the URL carefully. Better yet, use your phone's hotspot for anything sensitive.

The VPN Icon Is Not a Force Field

A VPN encrypts traffic between your device and the VPN server. That's useful on public Wi-Fi, especially for unencrypted apps or when you don't trust the local network. But the icon in your menu bar doesn't mean all your traffic is protected, and it doesn't mean every mistake you make is forgiven.

Common mistakes include:

• Assuming a VPN hides everything. It doesn't hide what you do after traffic leaves the VPN server, and it doesn't protect you from malware or phishing.
• Using a free VPN you don't recognize. Some free VPNs log and sell browsing data, inject ads, or are outright malicious.
• Leaving split tunneling on without knowing it. Some apps may bypass the VPN entirely, especially if they were configured before you turned it on.
• Trusting the VPN more than the network. A VPN can encrypt your traffic, but it can't stop you from logging into a phishing page that looks exactly like your bank.

If you use a VPN, choose a reputable paid provider, enable a kill switch, and verify that it's actually connected before you open sensitive accounts. A VPN is a tool, not a magic shield.

The Network Name That Looks Official

One of the oldest tricks is the evil twin: a hotspot with a name almost identical to the real one. Cafe_Free_WiFi becomes Cafe_Free_WiFi_2. Airport Wi-Fi becomes Airport_WiFi. The difference is easy to miss when you're tired and your gate has changed twice.

The real network may require a password from staff, while the fake one is open and eager. The fake one may even have a stronger signal because it's sitting in the next seat, powered by a battery pack and a phone. Once you connect, the attacker can see which sites you visit, redirect you to fake login pages, or simply record the metadata of your session.

Ask staff for the exact network name. Turn off "auto-join" for open networks. If two networks look similar, forget both and start over. A few extra seconds of skepticism is cheaper than a compromised account.

What You Give Away Without Typing a Password

Even if you never log into anything, public Wi-Fi can expose more than you think. Your device broadcasts its name, its preferred networks, and sometimes its MAC address. A laptop named MacBook-Pro-Emily or a phone named Alex's iPhone is a small identity leak, but it's still a leak.

Example: you sit down, open your laptop, and your phone automatically connects to a network called HomeWiFi. That tells anyone watching that you have a home network by that name, which can help them guess your router password or craft a convincing fake page later. Meanwhile, your laptop may be sharing files or accepting AirDrop requests from everyone.

Use a device name that doesn't identify you. Turn off file sharing and AirDrop to everyone. Set your phone to use a random MAC address for each Wi-Fi network if that option is available. These are small habits, but they shrink the amount of information you hand over before you've even opened a browser.

A Practical Routine for Café and Airport Wi-Fi

You don't need to treat every free network like a trap. You do need a routine that works when you're distracted. Try this:

1. Ask for the exact network name. Don't guess from the list.
2. Turn off auto-join. Make your device ask before connecting to open networks.
3. Forget old open networks. A network you trusted last year may not be the same one today.
4. Use your phone's hotspot for sensitive tasks. Banking, work email, and medical portals belong there if you can manage it.
5. Stick to HTTPS. If a site or app doesn't use it, avoid logging in.
6. Use a VPN if you have one. Turn it on before you open anything sensitive, and check that it's connected.
7. Don't ignore updates. An outdated browser or app is easier to exploit on a hostile network.
8. Log out and forget the network when you're done. Don't leave your device auto-connecting to a network you'll never verify again.

When to Skip Public Wi-Fi Entirely

There are moments when convenience isn't worth it. If you're checking a bank balance, filing taxes, accessing patient records, sending legal documents, or logging into a work system with sensitive data, use cellular data or wait. A few gigabytes of mobile data cost less than a compromised account.

If you absolutely must use public Wi-Fi for something important, combine every layer you have: a reputable VPN, two-factor authentication, a password manager that won't autofill on a lookalike domain, and a browser that warns you about known phishing sites. Then close the session as soon as you're finished.

The goal isn't fear. The café Wi-Fi can be fine for reading news, checking the weather, or watching a video while you wait. It's the moments when you're tired, rushed, and telling yourself it's probably fine that deserve the most caution. Gate 22 may move again. Your banking session doesn't have to.

Photo: Vitaly Gariev / Pexels