Public Wi-Fi and public charging: staying safe

Public Wi-Fi is far safer than it was ten years ago, because most sites and apps now encrypt everything. A few habits cover the risks that remain.

What has changed

Years ago, most websites sent pages in the clear, and anyone on the same Wi-Fi could read them. Today nearly all sites and apps use HTTPS, which encrypts what you send between your device and the service. On a public network, other people and the owner of the hotspot can no longer read your passwords, messages or card details in transit. They can still see which sites you connect to.

So ordinary use of well-known apps on public Wi-Fi is reasonably safe. The risks that remain are below.

The risks that remain

• Fake hotspots. Anyone can set up a network named "Airport Free WiFi" or copy a cafe's name. You connect to the fraudster's hotspot instead of the real one.
• Fake login pages. A hotspot's sign-in page asks for more than it should: your email password, a social media login, card details "for verification", or an app to install.
• Pages without HTTPS. Anything typed into a page that is not encrypted can be read or altered on the way.
• Open sharing. A laptop with file sharing switched on shows its folders to the network.
• Shoulder surfing. In a crowded cafe or train, the person behind you reading your screen is a likelier threat than any hacker.

Habits for public Wi-Fi

1. Ask the staff for the exact network name, and prefer networks with a password.
2. Give a sign-in page only what a Wi-Fi sign-in needs: usually a phone number and an OTP for that Wi-Fi. Never your email, bank or social media password, and never install an app or a "certificate" it offers.
3. Heed browser warnings. "Your connection is not private" on a public network means: stop.
4. Use apps or typed addresses for banking, not links, and check the address. See how to check a link. For the most sensitive tasks, switch to mobile data for those few minutes; it is the simplest fix.
5. Turn off auto-join: on the phone, "forget" public networks after use so that it does not reconnect by itself to any network with the same name. Android: tap the network › Forget. iPhone: Settings › Wi-Fi › (i) › Forget This Network, and turn off Auto-Join Hotspot.
6. Turn off sharing on laptops: on Windows choose "Public network" when asked, which hides the computer; on a Mac, switch off the services under System Settings › General › Sharing.
7. Keep the device updated and its firewall on.
8. A VPN from a company you trust adds a layer by hiding even the site names from the hotspot. It is useful for people who work on public networks often; it is not essential for occasional use, and a careless choice of free VPN creates a new risk.

Your own phone's hotspot is safer than unknown Wi-Fi for a laptop. Give it a long password and switch it off afterwards.

Charging in public: "juice jacking"

A USB cable carries data as well as power. A tampered charging socket or cable could, in principle, try to read data from or send commands to a phone plugged into it. Phone systems guard against this: an unlocked phone asks whether to trust or allow data access to what it is plugged into, and a locked phone gives none.

To be safe:

• Use your own charger in a wall power socket, or a power bank.
• If you must use a public USB socket, keep the phone locked while it charges and answer No, Don't Trust or Charge only to any prompt.
• Do not use cables left behind in public places or handed out by strangers.
• A "charge-only" cable or a USB data blocker passes power but not data.

Other shared equipment

• Cyber cafe and hotel computers: assume they record what is typed. Avoid logging in to email or banking on them. If you must, use a private window, log out, and change the password later from your own device.
• Shared printers and photocopy shops: files you send to a shop's computer or WhatsApp number stay there. Ask for them to be deleted, and do not leave copies of identity papers behind.
• Bluetooth: switch off when not in use, and refuse pairing requests and file transfers you did not start.