Connecting to public Wi-Fi networks - threat or scare?

You've almost certainly come across these warnings – or some version of them – in dozens of articles that pop up online every year as the holiday season approaches. But is it truly the case that if a hacker sets up a fake Wi-Fi network, they can see everything you do online and even steal your banking or login details? This article aims to set the record straight.
We'll examine the three most common myths surrounding public Wi-Fi and reveal what’s actually true. And as a bonus, we’ve tested what a hacker can really see when you connect to a fake Wi-Fi network.

Reality: If you’re on a legitimate website that uses the HTTPS protocol (you'll recognise it from “https://” in the address bar or a message saying “Connection is secure” when you click the padlock icon), your communication with the server is encrypted – meaning the hacker can’t see the page content, text, passwords or any data you enter. However, it can still see some information ‘from the outside’, such as:

• The domain you're visiting (e.g. google.com)
• When and how much data you send and receive
• Some technical information about your device

But they cannot see:

• The content of the visited page (text, images, forms)
• Passwords and personal data from forms
• Messages, login tokens, and so on

Most Czech websites use HTTPS these days, so you rarely come across unsecured ones. Abroad, however, you may still find unencrypted websites. That’s why it’s wise to stay alert when travelling and pay attention to the websites you’re visiting.

Summary: If you’re visiting a legitimate HTTPS site, your communication is encrypted. This means a hacker can’t see the contents, passwords, or personal information you enter. They may, however, see some basic metadata such as the domain name and limited device info. In the Czech Republic, HTTPS is generally standard, but this may not be the case elsewhere.

Reality: First, most people carry out banking through their bank’s official app. These apps are designed to be secure even over unprotected public networks, such as café or airport Wi-Fi. They use strong encryption to protect your data in transit and often include additional security layers like user verification and certificate checks. This applies only if you're using an official banking app downloaded from a trusted source (Google Play, App Store) and keep your device regularly updated – updates often patch security vulnerabilities.

Second, the same principles apply when using a secure browser to access internet banking or other HTTPS sites.
You may have come across articles claiming that even if you enter the correct address of a website, an attacker on a public Wi-Fi network can redirect you to a fake site and find out all the information you enter there. But in reality, it's not that simple for the attacker.Here's an example of what that might look like. 

Summary: If you use internet banking via a web browser and visit HTTPS-secured sites, the browser protects you from being redirected to fake servers by displaying a warning if there are problems with the certificate. However, the greatest risk is when a user visits a fake address themselves - for example, by clicking on a phishing link in an email or SMS, or when they access a site without HTTPS security (HTTP only). Therefore, it is always important to check the entire address in the browser carefully, not just the lock icon. You can learn more about how to protect yourself from phishing attacks in our Cyber Compass course in the Phishing module.

Reality: A VPN is a great tool, but it’s not the only way to protect yourself. A VPN encrypts all data traffic between your device and the VPN server, preventing hackers on the same Wi-Fi from seeing not just your content, but even metadata like the sites you visit, when, and how much data is transferred. This is especially useful for browsing unsecured (HTTP) websites.

A VPN also protects you against DNS attacks (e.g. DNS spoofing). Instead of your phone or computer sending queries to web addresses over a local network that an attacker can control, it sends them over a VPN server over a secure connection. This makes it impossible for an attacker to redirect you to a fake site by changing the DNS response.

But even without a VPN, you can stay safe by:

• Visiting HTTPS websites, which encrypt the communication between you and the server – so a hacker can’t see what you're doing or entering. (Note: this applies only to legitimate sites – phishing sites can also use HTTPS, as shown in Myth 2.)
• Keeping your operating system, browser and apps updated – updates fix vulnerabilities that attackers could exploit
• Being cautious – check what you’re clicking and always verify URLs. Make sure you're really on “facebook.com” and not a fake like “facepook.com”
• Using official apps – e.g. banking apps are designed to function securely even without a VPN

And if you’d like to use a VPN, Masaryk University offers one for free to students and employees. You can easily set it up using the guide here: https://it.muni.cz/en/services/eduvpn

Summary: A VPN is a strong security tool, particularly for HTTP sites and DNS protection. HTTPS connections already provide strong protection, and using official encrypted apps is safe even on public networks. But it won't protect you if you click on a phishing link in an email or SMS.  For more on secure internet communication, check out the Secure Connection module in our Cyber Compass course.

Final word

Public Wi-Fi networks aren’t automatically dangerous – but risks rise if you ignore browser warnings or miss key security signals. Many of the threats associated with public Wi-Fi are based on real attack methods – but are often exaggerated. Today’s devices, apps and browsers include numerous security features. VPNs are a great additional layer of protection, but far from the only one. Visiting HTTPS websites is highly protective – and no VPN can shield you from your own inattention (like falling for a phishing scam).

If you'd like to learn more about cybersecurity, take one of our courses, sign up for training, or explore more of our articles.