Is Using Public Wi-Fi Safe?

You've probably heard that public Wi-Fi is dangerous. Tips for avoiding this are almost as widespread as public Wi-Fi itself. Some of these tips are out of date, and public Wi-Fi is more secure than it used to be. But there are still risks.

Is Public Wi-Fi Safe Or Not?

This is a complicated subject. It's true that browsing on public Wi-Fi networks is much more secure and private than it used to be thanks to the widespread adoption of HTTPS on the net. Other people on the public Wi-Fi network can't just spy on everything you're doing. Man-in-the-middle attacks aren't as trivially easy as they used to be.

The EFF recently leaned on the side of public Wi-Fi security, writing that “There are many things in life to worry about. You can cross 'Public Wi-Fi' off your list. "

Sounds like sensible advice. And it would be great if the public Wi-Fi network were completely secure! We certainly use public Wi-Fi ourselves and don't worry as much as we used to.

But, if you ask us if the Wi-Fi connection is completely secure, we can't say that.

Here's the bottom line: random people are no longer going to snoop on your activities on public Wi-Fi. But it would be possible for a malicious hotspot to do a lot of bad things. Using a VPN on a public Wi-Fi network or bypassing a public Wi-Fi network in favor of your mobile data network is more secure.

Why Public Wi-Fi Is Safer Than Ever

Widespread HTTPS encryption on the web has solved the main security problem with public Wi-Fi networks. Before HTTPS went mainstream, most websites used unencrypted HTTP. When you accessed a standard website over HTTP on public Wi-Fi, other people on the network could spy on your traffic, see the exact web page you were viewing, and monitor the messages and other data you sent.

Worse still, the public Wi-Fi access point itself could perform a "man in the middle" attack, modifying the web pages that are sent to it. The hotspot could change any web page or other content accessed via HTTP. If you downloaded software over HTTP, a malicious public Wi-Fi access point could generate malware instead.

Now, HTTPS has gone mainstream and Web browsers are marking traditional HTTP sites as "not secure". If you connect to a public Wi-Fi network and access websites through HTTPS, other people on the public Wi-Fi network can see the domain name of the site you are connected to (for example, howtogeek.com), but that's it. They can't see the specific web page you are viewing and they certainly can't alter anything on the HTTPS site in transit.

The amount of data that people can spy on has decreased and it would be more difficult for even a malicious Wi-Fi network to manipulate your traffic.

It Is Still Possible To Snoop

While the public Wi-Fi connection is now much more private, it is still not completely private. For example, if you are browsing the web, you could eventually end up on an HTTP site. A malicious access point could have tampered with that web page when it was sent to you, and other people on the public Wi-Fi network could monitor your communications with that site - what web page you are viewing, the exact content of the web page you are viewing and any messages or other data you upload.

Even when using HTTPS, there is still little potential for spying. Encrypted DNS is not widespread yet, so DNS Requests can be seen by other devices on the network. When you connect to a website, your device communicates with your configured DNS server over the network and finds the IP address connected to a website. In other words, if you are connected to a public Wi-Fi network and browsing the web, someone else close to you could control the websites you visit.

However, Snooper could not see the specific web pages that were loading on that HTTPS site. For example, they would know that you are connected to howtogeek.com but not what article you are reading. They could also see other information, such as the amount of data being transferred from one side to the other, but not the content of the data.

There are still security risks on public Wi-Fi networks

There are also other potential security risks related to public Wi-Fi.

A malicious Wi-Fi access point could redirect you to malicious websites. If you connect to a malicious Wi-Fi hotspot and try to connect to bankofamerica.com, it could forward you to the address of a phishing site posing as your real bank. The hotspot could execute a "man-in-the-middle attack", loading the actual bankofamerica.com and presenting it with a copy over HTTP. When you log in, it will send your login details to the malicious hotspot, which could capture it.

That phishing site wouldn't be an HTTPS site, but would you really notice HTTP in your browser's address bar? Techniques such as HTTP Strict Transport Security (HSTS ) allow websites to tell web browsers to only connect over HTTPS and never use HTTP, but not all websites take advantage of that.

Applications, in general, can also be a problem: do all the applications on your smartphone correctly validate certificates? Are all the applications on your computer set to transfer data over HTTPS in the background, or are there some applications that use HTTP automatically? In theory, applications should correctly validate certificates and avoid HTTP in favor of HTTPS. In practice, it would be difficult to confirm that all applications behave correctly.

Other devices on the network could also be a problem. For example, if you are using a computer or other device with unrepaired security holes, your device could be attacked by other devices on the network. This is why Windows PCs come with a firewall enabled by default and why that firewall is more restrictive when it tells Windows that public Wi-Fi is connected instead of a private Wi-Fi network. If you tell the computer that it is connected to a private network, the shared folders on your network may be available to other computers on the public Wi-Fi network.

How To Protect Yourself Anyway?

While public Wi-Fi is more secure and more private than it used to be, the security landscape is still more complicated than we'd like. But to stay on a safer side use total security software in your device, because when you are using public Wi-Fi anything can happen and it will protect you.

For maximum protection on public Wi-Fi networks, we still recommend a VPN. When you use a VPN, you connect to a single VPN server, and all traffic on your system is routed through an encrypted tunnel to the server. The public Wi-Fi network you are connecting to sees only one connection: your VPN connection. No one can even see which websites you are connecting to.

That's a big reason why companies use VPNs (Virtual Private Networks). If your organization offers you one, you should seriously consider connecting to it when on public Wi-Fi networks. However, you can pay for a VPN service and route your traffic through it when using networks that you don't fully trust.

You can also bypass public Wi-Fi networks entirely. For example, if you have a mobile data plan with wireless access point (tethering) capabilities and a strong cellular connection, you can connect your laptop to your phone's access point in public and avoid potential Wi-Fi-related problems.