Culvert VPNFake hotspots, and how a VPN helps
An evil twin is a hotspot named like the real one so phones join it. What its owner can see, what a VPN protects once connected, and what it cannot.
An evil twin is a Wi-Fi hotspot set up with the same name as a real one, or a name close enough, so that phones join it instead. Whoever runs it becomes the network, and sees everything the network can see: which sites you visit, your DNS lookups, anything sent over plain HTTP, and any sign-in page they choose to put in front of you. A VPN helps because, once its tunnel is up, all of that becomes one encrypted stream the hotspot cannot read or change. It does not help with anything that happened before the tunnel connected, which is why joining the right network still matters.
How the trick works
Wi-Fi networks are identified by a name, and nothing stops two networks from using the same one. Your phone remembers networks it has joined and reconnects to any with a matching name and security type. An attacker sitting in a café, airport or hotel lobby starts a hotspot called what the venue's network is called, often with a slightly stronger signal, and waits.
The refinement is a sign-in page. Real venues use captive portals, so a fake portal looks normal. It might ask for an email address and password "to connect", or a card number for "premium access", and a person who has seen a hundred real portals fills it in. Nothing about the VPN can help at that moment, because the VPN cannot connect until the portal is accepted.
What the operator of a fake hotspot can see
It is the same list as for any network you do not control, with the difference that this operator is hostile by design. The public Wi-Fi risks post covers the general case; on an evil twin, specifically:
| Traffic | Without a VPN | With a VPN connected |
|---|---|---|
| Names of the sites you visit | Visible | Hidden inside the tunnel |
| DNS lookups | Visible, and answerable with wrong addresses | Sent to the VPN server's resolver inside the tunnel |
| HTTPS page contents | Encrypted; certificates stop impersonation | Encrypted twice |
| Plain HTTP content | Readable and changeable | Hidden inside the tunnel |
| The fake sign-in page | Fully exposed | Happened before the tunnel; still exposed |
The DNS row is the one that makes evil twins dangerous rather than merely nosy. On an ordinary network your phone asks the network's resolver where a site lives. A hostile resolver can answer with its own address. HTTPS still protects a properly built site, because the certificate will not match, but any plain-HTTP request, and any app that does not check certificates carefully, can be steered. The DNS privacy post explains why moving DNS inside the tunnel matters.
What a VPN does once it is connected
A VPN tunnel is authenticated as well as encrypted. WireGuard, for instance, connects only to a server whose public key the app already holds, and a TLS-wrapped transport verifies the server's certificate the way a browser does. A fake hotspot cannot pretend to be the VPN server, and it cannot read or alter what goes through the tunnel. From its side, your phone sends one encrypted stream to one address, and that is the end of what it learns.
Every app on the phone is inside that stream: the browser, but also the messaging app that fetches images over HTTP, the game that phones home, and the DNS lookups they all make. That whole-device coverage is the reason a VPN adds something on top of HTTPS here.
What a VPN does not do
It cannot connect before the sign-in page. The fake portal is where most of the damage on an evil twin is done, and it happens while the VPN is waiting. A portal that asks for anything more than a tick box, a room number or a name should be treated as fake.
It does not check the network name. Joining the wrong hotspot is a decision the phone makes, not the VPN app. Android's "Block connections without VPN" setting reduces the window, since nothing outside the tunnel is allowed, but it also blocks the real portal, which the captive portal post explains.
It does not fix a phishing page. If the fake portal, or a site it steered you to before the tunnel came up, persuades you to type a password, the VPN carries that traffic faithfully once connected. The HTTPS and VPN post sets out where each layer stops.
Reducing the chance of joining one
- Ask staff for the network's exact name, and notice if two similar ones are in range.
- Prefer the venue's password-protected network over an open one with the same name; a fake usually cannot know the password.
- Turn off auto-join for public networks, or forget them when you leave, so the phone does not silently rejoin a namesake elsewhere.
- Treat any sign-in page that asks for an account password or payment as a reason to disconnect.
- Connect the VPN immediately after the real portal, before opening anything with a login, and check that the exit IP it shows belongs to the VPN server.
Culvert VPN authenticates its servers by key and certificate, moves DNS inside the tunnel, and shows the exit IP it verified through the tunnel so you can see the stream is really leaving from the VPN server, on Google Play.
Questions people also ask
How do I tell a fake hotspot from the real one?
Often you cannot, from the name alone. Ask staff for the exact network name, be wary of an open network where the venue's real one has a password, and treat a sign-in page that asks for an email password or card details as fake.
If I joined a fake hotspot with the VPN on, am I safe?
Mostly. Once the tunnel is up the hotspot sees one encrypted stream and cannot read or alter your traffic. Anything you did before the tunnel connected, including on the sign-in page, was exposed.
Can a fake hotspot break HTTPS?
Not for a properly built site or app; your phone checks the server's certificate and refuses a forged one. What it can do is serve a fake page of its own, or tamper with a plain-HTTP request, which is where a VPN closes the gap.