In short: public Wi-Fi is dangerous, but not the way the old scare articles claim — and more so than it seems. Ubiquitous HTTPS closed off simple password sniffing, but attacks through fake access points and fake login pages have grown — the gear for them now ships ready-made. Basic protection is three habits plus encrypting your traffic on top of any network. Here’s the breakdown without the fearmongering: what actually threatens you, what no longer does, and the minimum that closes the risks.
What Changed: Old Scares vs the Real Risks of 2026
The classic scenario — “a hacker in a cafe reads your passwords out of thin air” — is largely obsolete: almost the entire web has moved to HTTPS, and the contents of traffic between you and a site are encrypted regardless of the network. If an article scares you with intercepted messages on an open network, it’s from the previous decade.
What’s left, and grew instead:
Fake access points (evil twin). An attacker spins up a network named “CoffeeShop_Free” next to the real one — your phone connects to the stronger signal on its own. From there the network owner controls your connection: sees which sites you reach, slips in fake login pages, redirects you to their own resources. This attack once took skill — now ready-made gear is sold freely, and the barrier to entry has dropped to almost nothing.
Fake captive portals. An “enter your phone number for Wi-Fi access” page can belong to anyone — and so can everything you type into it.
Metadata. Even with HTTPS, the network owner sees which domains you visit and when. For your bank that’s trivial; for privacy it isn’t — a profile of your interests is built from the addresses alone.
Neighbor devices. On an open network your laptop is visible to other participants; an outdated system with open ports is an invitation. The same goes for smart devices connected to someone else’s networks — how IoT devices get exposed is a topic of its own.
Checklist: Minimal Protection in Two Minutes
- Check the network name with staff — the cheapest way to avoid an evil twin: ask for the exact Wi-Fi name, don’t connect to look-alikes.
- Turn off auto-connect to open networks — your phone shouldn’t latch onto any familiar name by itself: the attack counts on exactly that.
- Watch the lock in the address bar — if the browser complains about a certificate on a public network, don’t “continue anyway”: that’s the main symptom of interference in the connection.
- Encrypt your traffic on top of the network. A VPN connection closes both the metadata and the fake points: even if the network is compromised, the owner sees only an encrypted stream to the server. This is the one item on the list that protects against all the attacks above at once, not just one.
- Update your system and turn on the firewall — basic hygiene that closes the neighbor-devices scenario. The rest are collected in the everyday digital hygiene rules.
Tainet handles the fourth item on the list with one button: modern encryption (VLESS masked as ordinary HTTPS traffic), one subscription for your phone, laptop, and tablet. Signing up takes about 30 seconds — through the Telegram bot or in your account, whichever suits you.
Try it →If you work from cafes and coworking spaces regularly, with work documents and logins — there’s a separate set of rules there: staying protected while working remotely is covered on its own.
Mobile Data Instead of Wi-Fi: When It’s the Better Choice
An honest tip VPN services rarely give: for a short sensitive operation — a transfer, a bank login — a phone hotspot or mobile data is safer than any public Wi-Fi. The individual encryption of a cellular network closes most of the attacks described by default. For the full comparison, see which is safer, mobile data or Wi-Fi.
Wi-Fi wins where mobile data is unavailable or expensive: abroad without a local SIM, in roaming, in buildings with poor coverage. In exactly those scenarios, protection on top of the network goes from optional to essential. Travel is a case of its own: preparing your devices for a border crossing is covered separately.
Frequently Asked Questions
Can someone steal my bank password over public Wi-Fi?
Through traffic interception — practically no: banking apps and sites encrypt the connection. The real risk is a fake login page served by a rogue access point. The defense: don’t enter data if the browser complains about the certificate, and encrypt your traffic on top of the network.
Isn’t HTTPS enough — why also a VPN?
HTTPS encrypts the contents but doesn’t hide where you go, and doesn’t protect against connecting to a fake network. Encryption on top closes both gaps. What a VPN still doesn’t solve — we covered honestly in what a VPN does not cover.
Is it dangerous just to connect and not type anything?
The risk is lower, but metadata leaks and your device becomes visible on the network. The rule is simple: once connected, turn on protection before you open any apps.
Is hotel Wi-Fi safer than a cafe’s?
Not really: the network password is shared by all guests, and anyone can stand up a point with the hotel’s name. The level of trust is the same as for any public network.
Which VPN protocol is best for public networks?
Modern protocols with traffic masking — VLESS first of all: from the network’s side such a connection is indistinguishable from ordinary HTTPS, and the point owner can’t tell a VPN from a normal visit to a website.
If this article describes your situation, Tainet handles it without the technical hassle: connect through the Telegram bot or in your account, from $0.10 a day (free trial included). Questions go to support - we answer fast.
