Public Wi-Fi and Captive Portals: Real Risks and Sensible Advice

Public Wi-Fi advice has not kept up with what changed. Ten years ago an open network meant your traffic was readable; today almost everything is encrypted end to end, and the standard warnings describe a threat that has largely moved elsewhere. Knowing what is still true matters, because advice people recognize as outdated gets ignored entirely.

What is no longer the main problem

On an open network, frames are unencrypted at the radio layer, so anyone nearby can capture them. That used to mean reading traffic.

Now it mostly does not. The overwhelming majority of connections use TLS, so a captured frame contains ciphertext. What remains visible is metadata: which hostnames were requested, via DNS unless encrypted and via the server name in the TLS handshake, along with volumes and timing — which is real and is a different exposure from reading content, as discussed under packet capture.

Enhanced Open — the opportunistic encryption in WPA3 — encrypts an open network without any credential, removing passive capture at no usability cost. It authenticates nothing, and it is strictly better than a plain open network wherever it is available.

What is still genuinely risky

The evil twin. An access point advertising a plausible name — the venue's, or a generic one — that devices join automatically. The attacker is then the network, which allows DNS manipulation, redirection, and attempts to downgrade or strip encryption. Certificate warnings are the user's protection, which is why clicking through them is the behaviour that actually matters — the mechanism under pharming, applied locally.

Automatic rejoining. Devices remember networks and reconnect without asking. An attacker advertising a remembered name captures the device silently, and the remembered list itself discloses where the user has been — the client-side leak described under wardriving.

Peer attacks. Without client isolation, other devices on the network can reach yours directly, which matters for a laptop with file sharing enabled or an unpatched service listening.

Shoulder surfing and physical observation, which is unglamorous and remains the most likely thing to actually happen in a café.

Captive portals

The interception page that appears on joining. Mechanically, the network permits DNS and redirects all web traffic to the portal until the device is authorized, usually by address.

Three things follow. It is an access control and record-keeping mechanism, not a security control — it does nothing about encryption and a portal password shared with every customer protects nothing.

It breaks things. Devices detect the portal by fetching a known URL and checking the response, and applications that are not browsers frequently fail confusingly while the portal is pending. Always-on VPNs need a permitted pre-connection window, which is the awkwardness noted under remote access VPN design.

And it trains bad habits. Users learn to accept certificate warnings and enter details on a page that appeared unprompted, which is exactly the behaviour a phishing attack relies on.

Advice worth giving

Advice people will follow, rather than a prohibition they will not.

Use cellular where it matters. Tethering is available, cheap enough, and removes the whole question. This is the single most practical recommendation and the one most often omitted.

Turn off automatic joining for open networks, and prune remembered networks periodically.

Never click through a certificate warning, and treat one on a familiar site as a stop rather than an obstacle. This is the control that survives everything above.

Use a VPN if one is provided, which moves the trust from the local network to the VPN provider — an improvement on a hostile network and not a universal good, since a consumer VPN service is a party that can see the same metadata.

Keep devices patched and file sharing off, which addresses the peer attack.

For managed devices, the organizational answer is better than user advice: an always-on VPN with a captive portal exception, restricted remembered networks, and configuration pushed by policy rather than requested of users.

Exam angles

Know that open wireless networks transmit unencrypted at the radio layer while most application traffic is protected by TLS, so metadata rather than content is the passive exposure, and Enhanced Open encrypts without authentication. Identify evil twin access points and automatic rejoining to remembered networks as the primary risks, with certificate validation as the user-visible protection. Know captive portals as access control and record-keeping rather than security, and that they interfere with always-on VPN and non-browser applications.