Public Wi‑Fi: what’s true and what’s myth

The short version

Café Wi‑Fi is not automatically a spy movie. It also isn’t “just like home.” In 2026, the real risk sits around rogue networks, the rare leftover non‑encrypted sites, sketchy captive portals, and the simple fact that strangers share the same access. Many myths date from before HTTPS became normal. Others still matter — especially if you join anything that looks free without checking.

Myth 1: “Anyone can read all my messages”

Mostly outdated. Major apps and sites use HTTPS / TLS: your traffic to the bank, Gmail, Instagram, and similar is encrypted between your phone and the server. A neighbor on the same Wi‑Fi doesn’t casually read your feed in cleartext like 2010 demos suggested.

What’s still true: if a site is plain HTTP, or an app is poorly built, traffic can leak. Metadata (who you’re connecting to) is also more exposed than content.

Myth 2: “Public Wi‑Fi steals my password the moment I join”

Overstated. Joining doesn’t magically siphon your passwords. Real scenarios look more like:

• a fake hotspot (“Airport_Free_WiFi”) mimicking the real one
• a phishy login page asking for email / password
• ordinary phishing once you’re online
• a device already compromised (malware) — Wi‑Fi is then a side detail

The danger is less “Wi‑Fi itself” than who controls the access point and what you type next.

Myth 3: “If there’s a password on the counter, it’s safe”

False. A shared chalkboard password is just a filter against random passersby. It doesn’t strongly authenticate clients to each other. On many public networks, users may still be visible to one another (depending on setup). Barista Wi‑Fi password ≠ personal security.

Risks that still matter in 2026

• Evil twin hotspots: same name, wrong box
• Captive portals: marketing emails, murky terms, sometimes shady pages
• File sharing still open on a misconfigured laptop
• Updates / sync over a network you don’t control
• Targeted attacks rare for most people, more plausible for sensitive roles (journalists, executives, business travel)

CISA-style guidance lands in the same place: caution, HTTPS, updates, and don’t treat public Wi‑Fi as a trusted network.

Checklist before you join

Tick these before the first captive-portal load:

• I know the exact network name (asked staff — not the clone “Airport_Free_WiFi_2”)
• File sharing / AirDrop “Everyone” is off; firewall on
• For banking / admin / tax: I have an alternative (cellular, personal hotspot) — otherwise I wait
• The captive portal is not asking for my email / bank password (name + accept terms = OK; “log in with Google for Wi‑Fi” = slow down)
• OS and apps are updated; I’m not launching a huge system sync / update on an unknown hotspot
• Optional: a trusted VPN already installed and tested (/en/tools/vpn) — what a VPN is actually for

Only then: browse. If something feels off (weird certificate, a page re-asking credentials outside the portal), disconnect.

What actually matters

Public Wi‑Fi in 2026 is mainly an untrusted shared network, not a machine for reading your WhatsApp. HTTPS changed the baseline. Social engineering and fake networks didn’t vanish. Act like you’re in a public place: you can sit down — you don’t leave your wallet open on the table.

If you travel often, build a boring default: personal hotspot for banking, VPN on hotel Wi‑Fi, no password reuse, and a quick look at the network name before you join. That routine beats any single “security tip” screenshot that goes viral after a scare story.

Going further

• CISA — Using caution with public Wi-Fi: official tips that still hold up.
• EFF — Surveillance Self-Defense: practical network and privacy guides.
• ANSSI / cyber.gouv.fr: French government cyber hygiene resources.
• FTC — consumer security tips: everyday network hygiene.