11.2 Public Wi-Fi Risks and Safe Browsing Habits
The Evil Twin: Same Name, Different Owner
A rogue access point costs one laptop and a USB radio. The attacker broadcasts the cafe's SSID -- often with a stronger beacon -- and, because 802.11 management frames are unauthenticated without PMF, a single deauth frame can kick you off the honest AP. Auto-join does the rest: your device scans, sees the familiar name, and associates. The attacker then serves a cloned captive portal harvesting "Wi-Fi password" or email logins, plus ARP and DNS spoofing to redirect traffic. HTTPS still protects content, but a convincing fake login page and a distracted user break without touching any crypto.
Your Phone Advertises Where It Has Been
Before it even connects, a phone probes out its saved network names -- the air fills with "CafeGuest" and home SSIDs, letting an attacker pick the bait. Modern systems randomize the MAC address used in those probes, but the SSID list still leaks. The counter is disabling auto-join: association becomes an explicit choice you make per network, and you forget the network afterward. Asking staff to confirm the exact name works precisely because your device now joins only what you tell it to.
A Tunnel Moves Trust, It Does Not Remove Risk
A VPN tunnel works by encapsulation: every outbound IP packet is encrypted -- IPsec ESP, a TLS record as in OpenVPN, or WireGuard's Noise-style messages -- and wrapped in a fresh outer packet addressed to the gateway. On the hostile LAN, the attacker sees one opaque stream between your client and the gateway; ARP and DNS spoofing have nothing to grab because your inner packets and DNS queries never travel in the clear over the cafe radio. Trust merely relocates: the provider now sees what the cafe used to, so choose an audited no-logs service or run your own WireGuard endpoint on a VPS you control. Site TLS still does the end-to-end work; the tunnel removes the local observer, not the encryption.
Habits That Do Not Need a Tunnel
HTTPS with HSTS keeps the content honest, so public Wi-Fi is survivable with discipline: prefer mobile data for sensitive work, check certificate warnings before typing credentials instead of clicking through them, never enter passwords into surprise captive-portal popups, keep the OS patched so portal exploits have fewer targets, and turn auto-join off. A phone hotspot is, cryptographically speaking, just private Wi-Fi.
Architecture Diagram
Key Takeaways
- Evil twins abuse unauthenticated management frames: deauth off the real AP, beacon the same SSID, let auto-join finish the job.
- Probe requests leak your saved network names -- turn auto-join off and forget networks after use.
- A VPN encapsulates and encrypts packets to a gateway, so the local network sees one opaque stream and cannot spoof ARP or DNS.
- The tunnel moves trust from the cafe to the provider: pick audited services or self-host WireGuard.
- HTTPS plus HSTS, certificate skepticism, and mobile data for sensitive work beat cleverness on hostile Wi-Fi.