Guides
The classic scare story — someone in a café stealing your password out of the air — is mostly obsolete, because HTTPS already encrypts the content of nearly all your connections. What remains on public Wi-Fi is subtler: visible metadata like domain names, fake access points, captive portals, and other devices sharing the network with you.
Almost every serious website and app encrypts its traffic end to end. Passwords, messages and card numbers travel inside TLS, so a snooper on café Wi-Fi sees ciphertext, not your data. That part of the old threat is largely gone.
Encryption hides what you say, not whom you talk to. DNS lookups and the server names in TLS handshakes reveal which sites and services you use, and the network operator or anyone positioned on it can collect that list.
Anyone can broadcast a hotspot named after the café or airport. Your device joins the strongest familiar-looking signal, and from then on the attacker is your gateway. This, not password sniffing, is the realistic modern attack.
Less than the folklore says, more than zero. A decade ago much of the web ran unencrypted, and a laptop in the corner really could capture logins from the air. Today nearly all meaningful traffic is wrapped in TLS: banking, mail, messengers and shops encrypt content between your device and their servers regardless of the network you sit on.
What survives is a different set of risks: metadata that encryption does not cover, access points that are not what they claim to be, portal pages that ask for personal data, and the simple fact that you share a local network with strangers.
TLS hides the content of your traffic but not its destinations. When your device looks up a hostname, that DNS query is often readable by the network, and when it opens a TLS connection, the server name usually appears in plaintext in the handshake — the SNI field. Whoever runs or watches the hotspot can build a tidy list of every site and app you touched, timestamped.
For most people this is a privacy issue rather than an emergency: the list of domains you visit says a lot about you, and on a public network you have no idea who collects it or why. Encrypted DNS narrows the leak but does not remove SNI.
This is the one gap a VPN closes completely on hostile networks: inside the tunnel, DNS and handshakes are invisible to the hotspot, which sees only that you are connected to a VPN server.
Nothing stops anyone from broadcasting a Wi-Fi network named after the café, hotel or airport you are in. Devices happily join the strongest signal with a familiar name, and phones that remember old networks will reconnect to a lookalike automatically, without you touching anything.
Once you are on an attacker's access point, they are your gateway: they assign your DNS, route every packet and can try to redirect you to convincing fake pages. TLS still protects properly secured sites — your browser will warn loudly if someone impersonates them — but anything unencrypted, any app that ignores certificate errors, and anything you type into a page the attacker serves is exposed.
The practical defenses are unglamorous: turn off auto-join for public networks, forget hotspots you no longer use, and never ignore a certificate warning while you are on one.
The page that greets you on hotel or airport Wi-Fi — asking for a room number, an email address or a social login — is itself worth treating with suspicion. It runs with the network operator's privileges, it is trivial to imitate on a fake hotspot.
Give portals the minimum: a throwaway email if a field is mandatory, never a password you use anywhere else, and never card details. A portal has no legitimate reason to ask for payment credentials to give you free Wi-Fi.
One practical note: VPN apps usually cannot connect until the portal is completed, because the network blocks everything else. Finish the portal, then confirm the tunnel is up before doing anything sensitive. Aurora's apps reconnect automatically once the network starts passing traffic.
On public Wi-Fi a VPN does one job extremely well: it makes the local network irrelevant. The hotspot, its operator and anyone else on it see a single encrypted stream to a VPN server — no DNS queries, no SNI, no destinations, nothing to redirect. Protocols like WireGuard do this with little battery or speed cost, so leaving it on is realistic.
What a VPN does not do also matters. It does not vet the portal page you type into, does not protect a device with file sharing exposed to the local subnet, and does not make a phishing site legitimate. It moves your trust from an unknown hotspot to your chosen provider — a good trade, not a magic one.
Most of the real protection comes from a handful of settings you configure once, plus two habits you keep. None of this requires expertise.
The settings matter because attacks on public Wi-Fi are opportunistic: they harvest whatever the careless majority exposes. A patched device that joins nothing automatically, shares nothing locally and tunnels its traffic is simply not a worthwhile target.
To hide your IP address, route your traffic through another server so websites see its address instead of yours. A VPN does this for everything on the device, a proxy for one app, and Tor for maximum obfuscation at the cost of speed. Hiding your IP changes what sites see, not who you are.
"No logs" almost never means a service records nothing. It usually means no activity logs: no record of the sites you visit or the data you transfer. Connection metadata, diagnostics, and payment records are separate categories, and every provider defines them differently. The privacy policy, not the slogan, tells you which ones are kept.
A VPN protocol defines how your device and the server build an encrypted tunnel. WireGuard is the fastest and simplest, OpenVPN the most mature and flexible, IKEv2/IPsec the best at surviving network switches on mobile, and Xray/VLESS over TLS makes tunnel traffic look like ordinary HTTPS. Each trades something for its strength.
