Public Wi-Fi risks in plain English

Public Wi-Fi is risky for two plain reasons: the network is run by someone you do not know, and it is shared with people you do not know. Whoever runs it can see which sites and services your phone connects to, and depending on how the network is set up, so can other people on it. HTTPS covers most of what you type and read; a VPN covers the rest by putting everything into one encrypted stream that the local network cannot read.

That is the honest size of the problem. It is not a horror story, and it is not nothing.

Who is on a public network

Three parties matter on any Wi-Fi you do not control.

The operator is whoever set up the router: the café, the hotel, the airport, or a contractor they hired. Their equipment sees every packet your phone sends, because every packet passes through it. That is not sinister; it is how a network works. But it means the operator, and anyone with access to their equipment, can log which servers you talk to.

The other users are everyone else who joined. On an open network with no password, the radio traffic between your phone and the router is not encrypted at all, and anyone nearby with the right software can record it. On a password-protected network, the radio link is encrypted, but a shared password is a weak barrier: everyone who knows it is inside the same fence.

The imitators are people who set up a hotspot with a familiar name and wait for phones to join it. A phone that joins the wrong network hands all its traffic to whoever runs that network. This is common enough to have a name, and the post on fake hotspots covers it separately.

What is actually exposed

It helps to separate what travels in the clear from what does not.

The middle rows are the ones most people underestimate. Even when every page is HTTPS, the network still sees the list of places you went, in order, with timestamps. The post on what the Wi-Fi owner can see goes through exactly how much of that list is available.

Plain HTTP is rarer than it was, but it is not gone. Some apps still fetch images, updates or adverts over HTTP, and anything fetched that way can be read and altered by the network on the way through.

What HTTPS gets right

Most of the scary claims about public Wi-Fi date from when banking sites and email ran over plain HTTP. They do not any more. A modern app or browser encrypts the request before it leaves the phone, and checks a certificate so that it knows it is talking to the real server and not to something in between. Someone recording the radio traffic gets the destination and the size of the exchange, not the content.

That is why the realistic attack on public Wi-Fi is not reading your traffic. It is a fake page, served before HTTPS is involved, that asks you to sign in to something. The HTTPS and VPN explainer sets out where each one stops.

Where a VPN fits

A VPN closes the gaps HTTPS leaves. With the tunnel up, the network sees one encrypted connection from your phone to one server. It cannot see DNS lookups, cannot read server names, cannot alter a plain HTTP page, and cannot tell which app is doing the talking. Other users on the network see the same thing: one stream, unreadable.

What a VPN does is move the party that can see your traffic from the café to the VPN provider, so it matters what that provider does with the view. Culvert VPN does not log the sites you visit, your DNS queries or the contents of your traffic, its servers see only an opaque connection id rather than an account, and it keeps the client IP address for up to 30 days for abuse handling; the privacy policy states this in full.

What a VPN cannot do

A VPN is not a security suite. It does not stop a phishing page from looking convincing, it does not patch an old Android build, and it does not help if you type your password into a fake portal before the tunnel is connected. It also cannot connect until the network's own sign-in page has been accepted, which is why the first minute on a new network is the least protected one.

A short routine for any network you do not own

1. Join the network the venue actually names, and ask staff if two names look alike.
2. Accept the sign-in page, then connect the VPN before opening anything else.
3. Keep Android and your apps updated, so that a known flaw in an old browser is not the way in.
4. Use mobile data instead for anything you would rather not do on a shared network at all.

For the second step, Culvert VPN connects with one tap, tries several connection methods in order so that it works on networks that filter ports, and shows the exit IP it verified through the tunnel, on Google Play.