The public Wi-Fi habit that quietly exposes your accounts

At a security demonstration at a major tech conference, researchers set up a Wi-Fi network called "Free Conference Wi-Fi." Most of the attendees (people who work in technology for a living) connected to it without a second thought. It wasn't the conference's network. It was the researchers' own equipment, built to show exactly how easy this is.

That's the uncomfortable part of public Wi-Fi risk: it isn't a knowledge problem. Most people who connect to a coffee shop or airport network already know, in the abstract, that public Wi-Fi carries some risk. They connect anyway, because the alternative (burning mobile data, or just not checking email) feels like more friction than the risk seems to justify. The gap between what you know and what you do is exactly where this attack lives.

You don't need to become paranoid about every network you join. You need to understand what an "evil twin" hotspot actually does, and match your behavior to how much is actually at stake on that connection.

How an evil twin works, and the three-tier response

Protect Your Digital Life explains the mechanism plainly: an evil twin is an access point set up with a name identical or nearly identical to a legitimate one: "Airport_WiFi" instead of "Airport_Free_WiFi," or in the demonstration above, a name generic enough that nobody questioned it. Once you connect, every request you make passes through the attacker's equipment before reaching the internet. They don't need to break into your device. They just need to sit in the middle of a connection you handed them voluntarily.

A traveler in the book's account learned this the expensive way, connecting to what looked like an airline's in-flight Wi-Fi portal. The fake portal captured credit card details entered during checkout, and the traveler saw thousands of dollars in fraudulent charges within hours: not because their device was compromised, but because the payment information never reached the airline at all.

The book's response to this isn't "avoid public Wi-Fi entirely," which is impractical advice most people ignore. It's matched to what you're actually doing on the connection, laid out as three tiers for the situations where this comes up most:

For coffee shop Wi-Fi, minimal protection means sticking to HTTPS-only sites; a reasonable middle tier adds a reputable VPN; maximum protection is using a personal mobile hotspot instead of the shop's network entirely. For an airport connection, minimal protection means verifying the network name with staff before connecting, since evil twins thrive on airports having several plausible-sounding official networks; the stronger tier adds a VPN and disabling file sharing; maximum protection is mobile data or a dedicated travel router. For Airbnb or hotel Wi-Fi, minimal protection is using the guest network rather than the main one if both are offered; the middle tier adds a VPN and disabling network discovery on your device; maximum is a personal travel router paired with a VPN.

The pattern across all three: the level of protection should track what you're about to do on the network, not just where you are. Checking a weather app on airport Wi-Fi carries little risk either way. Logging into your bank on the same network is a different decision entirely, and deserves the stronger tier regardless of how much friction that adds.

Where people go wrong

The most common mistake is trusting the padlock icon as proof a connection is safe. HTTPS encryption, shown by the padlock, does one specific job: it prevents someone on the network from reading data as it travels between your browser and the site. It says nothing about whether the network itself, or the site you've landed on, is legitimate. Free SSL certificates are trivial to obtain now, so a convincing fake portal will have the padlock too.

The second is assuming home Wi-Fi is exempt from this category of risk. Routers with default admin passwords or outdated firmware are scanned for and compromised at scale, not targeted individually, and a compromised home router can be conscripted into a botnet or used as an entry point to every device connected to it. Changing the default admin password and enabling automatic firmware updates takes a few minutes and closes most of this gap.

The third is treating a VPN as a universal fix rather than one layer among several. A VPN protects the data in transit between your device and the VPN provider: it doesn't protect you from entering your password into a convincing fake login page, which is a phishing problem, not a network problem. The account-level defenses that limit damage when either attack succeeds (password managers, two-factor authentication) are covered in the full digital safety guide.