Skip to main content

Nervous about using public Wi-Fi while you travel? You shouldn’t be. Here’s why

When you’re out and about, and especially when you’re traveling, you might find yourself feeling quite a bit of anxiety when logging into public Wi-Fi. Maybe you’re sitting in an airport waiting for your flight, and the siren call of that Wi-Fi network is making your ears itch. You’ve got one of the best laptops you can buy, but you’ve always heard that public Wi-Fi is dangerous, or your work strictly prohibits it. So what is a traveling techie to do? I sat down with Chester Wisniewski, Principal Research Scientist for Sophos to find out just how terrible it was.

Funny story. It turns out it’s not so bad.

Most of what you’ve heard about public Wi-Fi likely dates back a decade or more. That’s where the terrible reputation comes from. But things have changed, and it’s important to understand how, and part of the how includes the why. There’s a little history to go over to see how we got here though.

“Today if I go to Starbucks and I try to hack you, I get nothing. At best the most I’ll see is ‘Adam is going to Facebook’ but I have no idea what he’s doing on Facebook. I don’t know if he’s logging in as him, or if he’s logging in as his alter ego. I have no concept because all of that is encrypted and protected at the application layer rather than the network.”

How we got here

Many moons ago, the internet was largely unsecured. We relied on our networks to keep our network traffic protected. As a result, people were vulnerable to attacks with cute names like “evil twin” and “man in the middle.” These attacks allowed a hacker to see everything that was happening as it flowed through the internet. Type in www.facebook.com and enter your username and password and all of that was just sitting there, waiting to be intercepted. But it was cool because the network protected everything.

Hands over a laptop with lines of binary code.
EThamPhoto / Getty Images

But just under a decade ago, a man named Edward Snowden popped up on the world’s radar and everyone suddenly realized that everything we do on the internet could be watched and/or collected. When that happened, we all freaked out. Fortunately, we freaked out in a good way; we started locking everything down as much as possible.

This brings us to where we are today. Says Wisniewski “Today if I go to Starbucks and I try to hack you, I get nothing. At best the most I’ll see is ‘Adam is going to Facebook’ but I have no idea what he’s doing on Facebook. I don’t know if he’s logging in as him, or if he’s logging in as his alter ego. I have no concept because all of that is encrypted and protected at the application layer rather than the network.” Spoiler alert, I wasn’t logging in at all, and in fact, I never go to Facebook, but that’s another article for another time.

How things are today

It took some time for all of this to be put into place, but in 2019, Google reported that almost 92% of all traffic on the internet was encrypted. It turns out the answer was in our address bar all this time. The “s” in “https://” indicates that the traffic you’re generating is encrypted. It uses Transport Layer Security (TLS) to encrypt data sent over the internet, and it does this at the application level. It’s worth noting that “the application level” refers to both the website, such as facebook.com and the Facebook app.

The only information that leaks unencrypted is DNS lookup information. For example, if you open a browser and go to www.digitaltrends.com, and someone intercepts your signal, they can see that you went to the best tech website ever, but they wouldn’t be able to see what you did when you got there. Even that is changing according to Wisniewski. Both Firefox and Google Chrome hide DNS lookup information by default, and most other web browsers offer the ability to do so. Windows 11 has a system-wide option that you can enable to hide that information in any browser.

So what that all boils down to is that for the most part, public Wi-Fi is about as safe as you can reasonably ask for.

Additionally, HTTP Strict Transport Security (HSTS) adds another layer of security. HSTS basically teaches your computer what a website looks like on your first visit. Every subsequent visit confirms for your browser that you’re at the correct one. There’s even an HSTS preloaded list of tens of thousands of domains that your browser knows about even before your first visit. This prevents man-in-the-middle attacks from sending you to the wrong site made up to look like the right site and compromising your traffic.

Exceptions to the rule

So what that all boils down to is that for the most part, public Wi-Fi is about as safe as you can reasonably ask for, but there are a few caveats to that. This will sound similar to our Scream trailer smart home hacking article, but similar circumstances call for caution in this case. If you are the kind of person who routinely handles extremely sensitive information and/or information that other people would really want, then you should think twice before connecting to any network that you or your company/agency didn’t set up yourselves. While the encryption we use every day is robust enough to handle casual attackers, if you handle information that others would literally kill for, public Wi-Fi is not for you.

Three young professionals working on devices at a coffee shop bar.
Image used with permission by copyright holder

Another big caveat comes in the form of companies whose policies specifically forbid you from using public Wi-Fi. If you work for such a company or agency, simply don’t do it. In the company’s opinion, there aren’t enough protections in place, and they sign your paychecks, so who are you to argue? The bottom line is, companies have rules and as an employee, it’s your job to follow them, despite what a tech website has to say about the matter.

Finally, check in with your gut. If you feel uncomfortable logging into your bank from your local airport, don’t. After all, this is your data. You can use a banking app to log in from your phone on 5G or LTE which is about as secure as networks can get.

Other ways to stay safe

So are there ways that you can make your web traffic even safer? I asked about VPNs for example. One theory is that a Virtual Private Network is a good way to hide data, and to an extent, Wisniewski agrees. But in cases like that, he describes a VPN as “reassigning trust.” While most of your traffic is already encrypted, using a VPN shifts the unsecured stuff (like DNS lookups for example) over to the VPN. If you trust your VPN more than the network engineers at Starbucks, that will help you out with the limited amount of data that isn’t already encrypted.

One of the most important messages Wisniewski left me with was a warning against clicking through security messages. When you’re visiting a website, and your browser pops up a warning saying the site may not be safe, it’s probably not safe. The problem may be as simple as a typo, or an expired security certificate, but suffice it to say, if you’re getting a warning, there’s a reason. Double-check everything, and when in doubt, just skip it and come back another time.

In general, for most people, public Wi-Fi is safe, and the reason for that is because as a society, we’re a lot more security conscious than we were even 10 years ago.

Beyond that, password managers are a great tool to use to stay safe on the internet, regardless of how you’re connecting. Password managers are inherently stringent when it comes to security, and they prevent reuse or oversimplification of passwords. Plus, if a password suffers a breach, it’s simple enough to change.

But the overall message here is that in general, for most people, public Wi-Fi is safe, and the reason for that is because as a society, we’re a lot more security conscious than we were even 10 years ago. As such, we have demanded that our information be more protected, and the internet has responded. So if you’re traveling or just out and about, it’s probably OK to grab a coffee and take in some Netflix.

Adam Doud
Former Digital Trends Contributor
Adam had been writing in the tech space for nearly a decade. When not hosting the Benefit of the Doud podcast, he can be…
Wi-Fi 6 has finally launched. Here’s what that means for you
Linksys WRT3200 ACM router review

The long wait is over. Wi-Fi 6 has finally launched. But what is Wi-Fi 6 and what does its arrival mean for the average consumer?

According to the Wi-Fi Alliance, the Wi-Fi Certified 6 program is now available for devices “based on IEEE 802.11ax.” The Wi-Fi Alliance’s press release on the matter sheds some light on what customers can expect from Wi-Fi 6:

Read more
The best Prime Day foldable phone deals of 2024: Samsung, Google, Motorola
A person folding up the Samsung Galaxy Z Flip 5.

Prime Day deals are underway, with plenty of great offers going on right now. In particular, if you’re looking for excellent Prime Day smartphone deals, you’re in luck. For those looking for the deepest discounts and the most stylish and modern designs, how about the foldable phone deals currently going on? We’ve tracked them all down and included some info on how to choose the right foldable phone for you this Prime Day. Here’s everything you need to know so you can score a great new phone for less than usual. These deals cross over with Motorola Prime Day deals, Samsung Prime Day deals, and Google Pixel Prime Day deals.
Best Samsung foldable phone Prime Day deals

In the foldable phone world, Samsung is best known for its Samsung Galaxy Z Fold 5 and Samsung Galaxy Z Flip 5 phones, with both proving very popular for anyone checking out the best folding phones. Makers of some seriously premium devices, here’s the best Samsung foldable phone Prime Day deals right now so you can save some cash on a phone that you're going to love for a long time to come.
Best Google foldable phone Prime Day deals

Read more
Best Garmin Watch Prime Day deals: Nearly every model is on sale
Three Forerunner 165 watches stacked on a forest floor.

There are some great Prime Day deals around now that we've made it to the big sales event itself. In particular, if you've had a close eye on the Prime Day smartwatch deals unfolding, you're going to love how many different Garmin watch models are discounted right now. If you're looking to treat yourself to one of the best running and general fitness brands around, take a look below at all the options around right now. We also have some key buying advice on what to think about before you commit to any of these. All are some seriously good smartwatch deals.
Best Garmin Watch Prime Day deal
Garmin Forerunner 55 -- $186, was $200

For runners, the Garmin Forerunner 55 is an easy-to-use wearable device that's also affordable -- and even cheaper from this year's Garmin watch Prime Day deals. The smartwatch will monitor your heart rate while you're running, and it has built-in GPS so that you'll be able to track the distance you've run, the path that you took, and your speed for the session. The Garmin Forerunner 55's PacePro feature offers GPS-based guidance for certain courses and distances to help you plan your running strategy, and there are other helpful training tools that you can take advantage of such as race time predictions and finish time estimates.

Read more