Wifi and VPN

What is risky

• Open networks. A network with no password lets anyone in range join and watch for unencrypted traffic. Most websites now use HTTPS, so the page contents are encrypted to the site. The network can still see which sites you contact when the name is not hidden, and it can see anything that is still plain HTTP.
• Fake hotspots. A phone or a travel router can advertise the same name as the hotel ("Hotel WiFi"). The password on the wall then joins you to the wrong box. A VPN does not tell you which box you joined.
• Captive portals. The login page that pops up after you connect (room number, email, a tick box) is run by the network. Use it to get online, and do not type a bank password or an email password into that page. A portal that asks for more than a room number or an email is a reason to stop and use mobile data instead.

Habits that cost nothing

• Prefer HTTPS. Look for the lock and a name you recognise before you type a password.
• Forget the network when you leave. Phones will rejoin a saved name automatically, including a fake one that copies it later.
• Do banking on mobile data, or after a VPN is connected. Do not do it on a portal page, and do not do it in the minute between joining wifi and connecting the VPN.
• Turn off auto-join for public networks, and avoid installing a "wifi login" app a poster tells you to download.

What a VPN changes

A VPN app encrypts traffic from your phone to a server the VPN company runs. On hotel wifi, the local network then sees a connection to that company, and how much data moves, rather than the list of sites inside the tunnel. Sites you open see the VPN server's address.

That is useful on a network you do not trust. It is also the reason some hotels block VPN servers. If the app will not connect, mobile data or another server inside the app is the usual next step.

What a VPN does not do

• It does not prove the network name is the hotel's. You can be inside a tunnel and still attached to a lookalike hotspot.
• It does not inspect the website. A misspelled bank address loads through the tunnel. Read the address.
• It does not replace the lock. HTTPS still matters for the hop from the VPN server to the site, and for spotting a fake page.
• It does not hide you from an account you log into. The bank, the airline, and the messaging app still know that account is yours.
• It does not stop your home carrier billing roaming if cellular data is still on. Wifi and a VPN are separate from the roaming switch.

The hotel-wifi version of this, with the order of steps, is Staying safe on hotel wifi.