Wi-Fi: Public Networks and Your Own
The coffee-shop Wi-Fi horror story needs an update. A decade ago, an attacker on the same open network could read half your traffic outright. Today nearly everything is encrypted with HTTPS, and the eavesdropping threat is smaller than the folklore suggests. But "smaller" is not "gone" — and the network most likely to hurt you is the one in your own living room.
Public Wi-Fi: the honest 2026 threat model
What an attacker on shared Wi-Fi can still do:
- See where you go. Domain names still leak through DNS and connection metadata, even when content is encrypted. That's a privacy problem more than a theft problem.
- Run an evil twin. Anyone can broadcast a network named "Airport_Free_WiFi" and hand you a fake captive portal that harvests the email and password you type in — which, statistically, you also use elsewhere.
- Attack your device directly. Being on the same LAN exposes whatever your laptop is sharing: AirDrop set to everyone, file shares, development servers you forgot were running.
The countermeasures are simple: never type real credentials into a captive portal (they need a checkbox, not your email password); keep your device's firewall on and sharing services off when roaming; use encrypted DNS or a reputable VPN if the privacy leak bothers you; and prefer your phone's hotspot for anything sensitive — cellular is a harder target than café Wi-Fi.
Your home network: the ten-minute hardening pass
1. Log into your router — yes, actually
The device that stands between the internet and everything you own often runs firmware from years ago with the password admin. Change the admin credential, apply pending firmware updates, and turn on automatic updates if offered. If the manufacturer stopped shipping updates entirely, the router is not old — it is expired.
2. Use WPA3, or at minimum WPA2 with a real passphrase
Your Wi-Fi passphrase can be captured offline and cracked at leisure, so length is the whole game: four random words beats any clever eight characters. Disable WPS — the push-button pairing feature has been a known weakness for over a decade.
3. Segment your strangers
The guest network isn't just for guests. Put every smart TV, camera, doorbell, and plug on it, isolated from the laptops and phones that hold your actual life. A compromised $30 gadget should never share a network segment with your tax returns. (More in Securing the Connected Home.)
4. Kill remote administration
Unless you deliberately need it, your router's admin page should not be reachable from the internet. This single checkbox has been the entry point for entire botnets.
The checklist
- Public: firewall on, sharing off, no real credentials into portals, hotspot for banking.
- Home: admin password changed, firmware current, WPA3/WPA2 with long passphrase, WPS off.
- IoT on the guest network; remote admin disabled.
- Once a year, look at the router's client list and evict anything you can't name.
Stop trusting networks by their name. Think about what your device is offering to strangers. Connect as a guest everywhere — including at home.