Is the coffee-shop Wi-Fi actually dangerous, or is that just something VPN companies say to sell subscriptions?

The honest answer lives between the two camps that shout past each other. One says public Wi-Fi will steal your identity the moment you connect. The other says everything is fine now because of encryption. Both are wrong in instructive ways, and the truth is more useful than either.

The classic threat you were warned about, a hacker at the next table quietly reading your passwords and emails out of the air, is largely dead. It was killed by HTTPS. Today nearly every website and app encrypts its traffic end to end, so what actually travels over that coffee-shop network is ciphertext. The person sniffing the air sees gibberish, not your Gmail. The old image of the lurking packet-sniffer stealing your banking login simply does not work the way it did a decade ago, and a great deal of VPN marketing quietly depends on you not knowing that. We would rather tell you the truth, the same way we would about any security claim: the fear is outdated.

But the threat did not vanish. It evolved into something the old advice does not cover at all.

What actually still bites

The fake network itself. This is the big one, and it is a completely different shape of attack. The danger is no longer someone eavesdropping on the network you joined. It is you joining the attacker’s network without realizing it. An “evil twin” is a fake hotspot that copies the name of a real one, “FreeAirportWiFi,” “Starbucks_Guest,” and your phone, helpfully, may reconnect to a familiar-looking name automatically. Once you are on their network, they control what you see, and the classic move is to serve you a convincing fake login or captive-portal page that harvests your credentials directly, no sniffing required, because you typed them right in.

This is not theoretical. In 2024, a man was arrested in Australia for running exactly this scheme on domestic flights and in airports, for months, with equipment that fit in a carry-on bag. Passengers connected to his lookalike networks, saw a legitimate-looking sign-in page, and handed over their email and social credentials. And it is not limited to fake networks: in 2026, security researchers reported that attackers had seized administrative control of the real Wi-Fi gateways at hotels and conference centers in multiple US cities, then redirected guests to fake Microsoft login pages and phony “update your browser” prompts that installed malware. A network you trust can be turned against you, too.

Social engineering delivered over the network. Related to the above: the captive portal that wants you to “install an update” to get online, the pop-up warning that your browser is out of date, the certificate error you are tempted to click past. On a hostile network, that certificate warning is not a nuisance. It is the attack, announcing itself. The network’s job, in the attacker’s hands, is to get you to type something or install something.

Your metadata, even when your content is safe. HTTPS hides what you send, but not necessarily where you go. The network can still see which sites you connect to, through your DNS lookups and the server names in your connections, and can build a picture of your browsing patterns. Your bank password is safe. The fact that you visit that bank, that pharmacy, that dating site, that law firm, is visible to whoever runs the network. On a conference network full of people in your own industry, assume someone is reading traffic patterns.

Auto-join and device exposure. The single feature that makes evil twins work is your device silently rejoining networks by name. And on a shared network, your device may be reachable by others on it if it is advertising services it should not.

The proportionate defenses

Notice that none of the real threats are solved by panicking, and most are solved by a short, boring checklist.

Turn off auto-join for open networks. This one change defuses the evil-twin trick more than anything else, because it stops your phone from silently connecting to a spoofed name while it is in your pocket.

Use a VPN, for the right reason. Not because HTTPS is broken, but because a VPN encrypts everything leaving your device into a single tunnel, so even a hostile or fake network sees only ciphertext and cannot see which sites you visit, and cannot easily manipulate your traffic. That is the honest case for a VPN on public Wi-Fi, stripped of the fear-mongering. Just pick a real one: a no-logs, independently audited provider, not whichever brand shouts loudest about coffee-shop hackers.

Never dismiss a certificate warning, and never install what a captive portal tells you to. The portal exists to get you online. It has no legitimate reason to update your browser or your system. If it asks, that is the attack.

Turn on multi-factor authentication, especially for email. If a fake portal does capture a password, MFA is what stops that from becoming a full account takeover, and your email is the recovery key to everything else.

For anything genuinely sensitive, use your own phone’s hotspot or cellular instead of the shared network. It sidesteps the entire category.

Where the phone itself does the work

Most of that checklist is discipline, but a well-built phone quietly handles a lot of it for you. It does not auto-join spoofed networks the way a stock phone eagerly does. It randomizes its hardware address per network, so you are not trackable across the hotspots you use. It makes an always-on VPN and encrypted DNS trivial rather than a chore, so your metadata is covered by default. It keeps a locked-down network posture so there is little for others on the network to poke at. And crucially, it will not quietly install a “browser update” that a captive portal pushes at you, because it only accepts verified updates through its own channel, not whatever a strange network suggests.

That turns the technical threats of public Wi-Fi into mostly a non-event. What no phone can do is stop you from typing your real password into a beautifully convincing fake login page. That part is human, and the whole point of this post is to move your guard to where the danger actually is: not the mythical sniffer reading your encrypted traffic, but the fake network in front of you asking, very politely, for your credentials.

Stop fearing the dead threat and the marketing built on it. Watch for the live ones, the lookalike network, the too-helpful portal, the certificate warning you are tempted to ignore, and public Wi-Fi goes back to being what it should be: convenient, and mostly fine. Proportionate beats paranoid.

If you want a phone that handles the technical half of this for you by default, that is what we build. Email hello@spicycorp.com, or book a call.