Sharing files on public Wi-Fi: which risks are real and which are folklore

The standard advice about public Wi-Fi has not caught up with the last decade of browser security. Most of the scary demos you have read about were neutralised by HTTPS becoming universal. A few risks remain, and they are not the ones people warn you about.

What used to be true and no longer is

The classic warning is that anyone on the same café network can watch your traffic with a packet sniffer and read your passwords and files. That was accurate when much of the web ran over plain HTTP. It largely is not now. Effectively all significant sites are HTTPS-only, browsers mark plain HTTP as "Not secure", and HSTS tells the browser to refuse an unencrypted connection to a site it has seen before. Someone sniffing the air today sees which servers you connect to — not what you send them.

The same applies to the once-standard "always use a VPN on public Wi-Fi". A VPN moves the trust from the café's router to the VPN operator. That is a genuine improvement if you distrust the network more than the operator, and it hides which sites you visit from the network. It does nothing extra for the contents of an HTTPS session, which was already protected.

What is still genuinely dangerous

The rogue access point. Cheap, easy, and still effective. Someone runs an access point named Airport_Free_WiFi or duplicates the café's real network name. Your phone, which remembers networks by name, may join it on its own. Now the attacker is your network, and everything below follows from that.

Captive portal phishing. The single most productive attack on public Wi-Fi. The "sign in to use this network" page is attacker-controlled and asks for a Google or Microsoft login, or an email and password "to receive the access code". People type it in because a login page at that exact moment is completely expected. No legitimate network needs your email password.

DNS manipulation and downgrade. The network controls DNS resolution, so it can point a hostname somewhere else. Against a site you have visited before, HSTS blocks the downgrade. Against one you have not, an attacker can try to keep you on HTTP. This is the case where the browser's certificate warning is the last line of defence — and clicking through it is the actual mistake.

Your own device advertising itself. The most overlooked one. Network file sharing, an SMB share, a development server on port 3000, printer sharing, AirDrop set to Everyone — all of these announce themselves to whoever else is on the network. On a home network that is convenient. On hotel Wi-Fi it is an open door, and nothing about your browsing habits affects it.

What to actually do

1. Tell the OS the network is public. Windows asks "make this PC discoverable?" — the answer on any network you do not own is no. macOS: turn off File Sharing and set AirDrop to Contacts Only. This one setting closes the largest hole.
2. Turn off auto-join for open networks, and remove saved open networks you no longer use. This is what defeats the evil-twin access point.
3. Never enter an account password into a captive portal. Ever. If the network insists on a login, it wants an SMS code or a room number, not your email password.
4. Never click through a certificate warning on a network you do not control. On a public network that warning is not a glitch; treat it as the attack it usually is.
5. Prefer tools that encrypt before the data reaches the network. If a file is encrypted on your device before it is uploaded, the network's honesty stops being part of your threat model — see what end-to-end encryption actually protects.

More guides