The Real Risks of Public Wi-Fi (And What Actually Protects You)

The classic "hacker in a hoodie sniffing packets at Starbucks" scenario is rarer today than it used to be, mostly because HTTPS is now the default across the web. That said, the remaining risks are real.

Rogue access points that mimic a venue's real network name, ARP spoofing on shared networks, and unencrypted traffic from older apps or IoT devices are all still active attack vectors on open Wi-Fi.

A VPN doesn't make you invisible, but it does wrap all of your traffic — not just your browser's — in an encrypted tunnel before it touches the local network, which neutralizes most of these attacks outright.

Combine that with a password manager and up-to-date software, and public Wi-Fi stops being a meaningful risk in your threat model.