Why public Wi-Fi could be a disaster for you

Wi-Fi has drastically changed the world we live in, making it easier than ever to access the internet. Free public Wi-Fi networks can be found everywhere: public parks, coffee shops, churches, malls, libraries, and public transportation like buses and trains. Although this technology has greatly increased convenience for laptop and smartphone users, it’s also opened up a significant number of security risks. Here’s why public Wi-Fi can be dangerous, and here’s how you can protect yourself from these threats.

Help protect your digital life on your devices.

Are you afraid of losing your personal information or all the precious things on your computer? Get comprehensive protection with Norton Security Deluxe across all your devices – up to 5 PCs, Macs, smartphones or tablets.

Create an account today and try it free for 30 days on up to 5 of your devices.

Try it free

Area networks, PSKs, and encryption breaking

To understand some of the most common types of attacks, you need to know how Wi-Fi works. This technology is a type of wireless local area network which exchanges data with your device using radio waves. A device called an access point communicates with your phone, tablet, or computer, then connects to the internet with a network router. The data exchanged between your device and the router is encrypted using a pre-shared key (PSK).

Unfortunately, since everyone within a Wi-Fi hotspot can connect to the same network, it’s possible for anyone within the area to see the data that is being exchanged on the other devices. One common method, called network sniffing, happens when an attacker intercepts visible traffic on a Wi-Fi channel. In some cases, the attacker might manage to intercept the PSK, allowing them to decrypt all data sent to a specific device until the connection is broken or the PSK is changed. Even if they don’t get lucky enough to intercept the PSK, they might use a “brute force application” to try and guess it, which allows attackers to test millions of combinations per second. This means that if the network administrator selected a simple PSK, the attacker can usually obtain it relatively quickly. (This threat can be reduced if the administrator chose a strong key, with mixed case letters, decent length, no dictionary words, and a variety of numbers or symbols.)

Some venues, however, don’t bother to encrypt their data at all. Many locations display nothing more than an advertisement or agreement page before allowing users to connect. Even though businesses typically restrict Wi-Fi use to patrons (for example, by printing the password on a receipt) your data can still be visible to any other customer present. Some attackers even collect data passively and decrypt it later.

Fake networks and page spoofing

There are other potential risks for those who try to connect to public Wi-Fi. One type of attack involves setting up an entirely new Wi-Fi network and tricking users into connecting with it, which then allows the owner of the network to view any data sent. This practice is especially dangerous for users who connect to any open network.

Another strategy used by hackers is to create a fake access point in an area that might plausibly have free Wi-Fi. For example, they might set up a network at a bus station that does not offer Wi-Fi, and label the hotspot “BusStationInternet.” Or a hacker might create a second network at a location that already offers Wi-Fi; if you’re at a library with a hotspot called “CityLibrary1”, they might create another hotspot called “CityLibrary2.” Unsuspecting library patrons might choose a network based on the name alone, and when they link to the hacker’s Wi-Fi, the hacker can easily view any information.

Although some hackers are content to gather whatever data you may accidentally give them, others may try to elicit specific information, such as account logins or email addresses. Some malicious access points rely on a practice called page spoofing to obtain that kind of desirable data. When a page is spoofed, hackers will create a fake webpage that looks just like the real thing, in order to encourage you to enter your information. For example, they may ask you to share something on social media to access the internet; you will be directed to a fake login page that looks exactly like the real one. After you’ve entered your account information, you’ll be shown an error—possibly telling you that you’ve incorrectly entered your password or username—and then you’re unwittingly redirected to the legitimate page, where you’ll be able to log in, but this time with an audience. In this scenario, you may give away access to your social media account without even realizing it.

Privacy from proprietors

Even in those situations where the public Wi-Fi network is safe from hackers, you might still face privacy breaches, but instead from the very establishment offering the hotspot. Although most businesses aren’t trying to steal your identity, they may use your information in ways that you don’t want them to. Many Wi-Fi owners gather data from their users for advertising or statistical purposes. They may also request that you leave am email or phone number in exchange for network access, or that you share their business on your social media profiles. Some businesses triangulate your physical location using Wi-Fi signal strength, in order to determine how crowded their establishments are or to learn about the routes you take through a store.

How to stay safe

So how do you protect yourself against invasions of your privacy and malicious hacking? The most foolproof way is to avoid using public Wi-Fi networks at all, but not everyone is willing to make that sacrifice. If you do want to connect, always verify the legitimacy of the Wi-Fi network beforehand. Don’t rely on the name alone; ask a staff member for the correct network or look for a posted sign. If you’re concerned about the business’s access to your data, check the terms of service carefully before agreeing.

When you’re on a public Wi-Fi network, only access websites that do not require you to login, and don’t make purchases online. If you absolutely must access an online account—for example, your email inbox or a social media page—then only visit websites that use HTTPS encryption. Do not ignore browser warnings if the security certificate is invalid.

Avoid downloading any files or software, since they may contain viruses, and make sure that you have a good firewall and current antivirus software. Finally, consider using a virtual private network (VPN), which can mask your IP address and add another layer of encryption to your connection. Public Wi-Fi hotspots can be dangerous, but with some sensible precautions you can keep yourself safe.