Public Wi-Fi is convenient, free and a great way to stay connected when you’re away from home and don’t have a strong network signal. But is it safe? A 2023 survey from All About Cookies found that nearly half of internet users admit to connecting to Wi-Fi networks they don’t know are legitimate, with one in four regular users experiencing a security issue from a public Wi-Fi network.
Cyber criminals may use a combination of technical know-how and free tools to sneak into unsecured networks and steal sensitive information. This could include passwords, banking information, or personal data that can be used for identity theft. Despite warnings about the potential dangers of connecting to unsecured Wi-Fi networks, habit and convenience outweigh the perceived risks for many.
The i spoke to three cyber security experts to explore the dangers of using public Wi-Fi and what you can do to keep your information secure.
Is public Wi-Fi safe?
Chartered security professional Thomas Balogun does not recommend logging in to public Wi-Fi if you are entering sensitive data. He says: “These networks often lack encryption, meaning any data sent between your device and the internet is vulnerable to interception.”
Being aware of the type of network you are connecting to is critical. “Some Wi-Fi connections will tell you they’re unsecured or clarify that they use deprecated encryption standards (i.e. lower-than-expected industry standards) at connection time,” he says. “You don’t want to access your mobile banking app on these weak Wi-Fi connections as your sensitive information, like passwords, banking details, and personal messages, is at risk.”
How your data may be compromised
Hackers may set up fake Wi-Fi networks that appear legitimate to trick users in to logging on. These so-called evil twin attacks involve the attacker creating a Wi-Fi hotspot, often with a similar name to the genuine local network, such as “Free Airport Wi-Fi”. When an unprotected device connects to this network, the attacker can potentially steal the data it is transmitting.
Balogun says if you unknowingly connect to one of these rogue networks, the hacker can monitor your activity and steal sensitive information. “Hackers can intercept session cookies, which are small pieces of data that websites use to remember you after you log in. If a hacker steals your session cookies on an unsecured Wi-Fi network, they can impersonate you on websites logged in, such as social media or online banking.”
What’s the worst that could happen?
James Bore, cyber security expert and author of The Cyber Circuit, says that if someone else controls the network you are connected to, they can potentially intercept and see everything you are doing. “In the worst-case scenario, you will be giving someone malicious access to your e-mail or bank account and the chance to impersonate you.”
Balogun says that when using public Wi-Fi, “Avoid accessing your bank account, transferring money, or making purchases, as these activities involve highly sensitive information that could be intercepted”.
Where are the riskiest places to use public Wi-Fi?
The research carried out by All About Cookies revealed that specific locations offering public Wi-Fi are more trusted than others. Libraries, for instance, were the most relied upon and trusted sources of free Wi-Fi. This suggests that people may place unwarranted trust in certain settings, potentially putting their cyber security at risk.
Bore believes it’s a myth that some areas are riskier than others when connecting to public Wi-Fi. “There’s sometimes an impression that people are constantly setting up unsafe and malicious Wi-Fi networks, but the reality is that they’re not common at all. The truth is, no publicly accessible place is really any more or less secure against unsafe Wi-Fi.”
How to spot a fake hotspot
Bore says you may sometimes get error messages or certificate warnings when you try to log onto a non-legitimate Wi-Fi hotspot, but “there may be no signs”. He adds: “Anyone can set up a Wi-Fi network however they want to, and there isn’t really a way for most people to tell the difference between a safe and unsafe network.”
Balogun recommends that if you’re logging in to public Wi-Fi in a café or hotel, for example, ask staff for the official Wi-Fi network name to avoid connecting to a rogue network. He says, “Networks that require a password to join tend to be safer than open, unsecured ones. While this doesn’t guarantee complete safety, it reduces the likelihood of attackers lurking on the network”.
How to browse safely on public networks
One of the best ways to minimise public Wi-Fi security risks is to use a virtual private network (VPN), which establishes a private, encrypted tunnel through which your data is sent and received. Your online activities are kept private, as your data is not visible to anyone monitoring your connection.
As Bore says, “When using a VPN, you are effectively on a virtual network, so it doesn’t matter whether or not you can trust the actual Wi-Fi network. It’s worth remembering that there are unsafe VPNs, so research and look for one with a high proportion of positive reviews”.
If you choose to log onto a public Wi-Fi network, limit the amount of personal information you give upfront. Andrew Grill, author of the book Digitally Curious, says that while many public Wi-Fi spots request a lot of personal information when we try to connect, including full name, email address, and even date of birth, none of this is needed to provide the service.
Grill says, “Each time you provide your email address to a company that doesn’t need it, you’re at a higher risk of identity theft and being scammed. The next time you’re asked for your name or email address, try entering “no thanks” as your name and “[email protected]” and see if you still get access to Wi-Fi. If you do, you’ll never have to expose your email address again.”