Why Public Wi-Fi Is More Dangerous Than You Think — and What Actually Protects You

You've probably connected to public Wi-Fi hundreds of times. Airport lounges, hotel lobbies, client offices, cafes, coworking spaces. It feels normal. It probably felt fine every time.

Here's the problem: most of the risk on public Wi-Fi is invisible. Nothing goes wrong visibly. Your browser shows a padlock. Your email loads. Your files sync. And in the background, depending on how you're connected, someone on the same network may be able to see exactly what you're doing.

This article explains what the real risks are, which ones are overstated, and what actually protects you.

What can actually go wrong on public Wi-Fi?

There are several categories of attack that are realistic on public networks. Understanding which ones are real helps you make better decisions about how to protect yourself.

Man-in-the-middle attacks. This is the most documented threat on public Wi-Fi. An attacker on the same network uses a technique called ARP spoofing to redirect your network traffic through their device before it reaches the router. Your device has no way to detect this automatically. Your connection appears normal. The attacker can read any traffic that isn't encrypted end-to-end.

Rogue access points. An attacker creates a Wi-Fi network with a name that looks legitimate — "Hotel_Guest", "Airport_Free_WiFi", "CoffeeShop_Internet" — and waits for people to connect. Once you're connected to their network, they can see all your traffic, inject content into unencrypted pages, and redirect you to fake login screens.

Traffic interception. Even on a legitimate network, not all traffic is encrypted. Certain email protocols, some internal business tools, older software, and some API calls from background apps may transmit data in plaintext. On a public network, anyone on the same network running packet capture software can read that data.

Session hijacking. Some attacks target session cookies — the small files that keep you logged into websites after you've authenticated. If an attacker can capture your session cookie, they can use it to access the same account without knowing your password.

What doesn't protect you (but people think it does)

HTTPS alone. The padlock in your browser means the connection between your browser and the website is encrypted. It does not mean your entire network connection is secure. Other apps running on your device — email clients, sync tools, background services — may not be using encrypted connections.

Using a well-known network. The fact that a Wi-Fi network is provided by a hotel, airport, or coffee shop you trust doesn't make it secure. These networks are often poorly configured, rarely monitored, and shared with dozens or hundreds of other users.

Your device's firewall. A firewall controls which incoming connections are accepted by your device. It does not encrypt your outgoing traffic or prevent other devices on the network from intercepting it.

What about a VPN app — doesn't that solve it?

A VPN app significantly reduces your risk on public Wi-Fi. When your VPN is active, your traffic is encrypted from your device to the VPN server before it reaches its destination. Someone intercepting your traffic on the local network sees only encrypted data.

But VPN apps have one specific vulnerability that matters in real-world use: the gap.

VPN apps disconnect. They disconnect when you switch from one Wi-Fi network to another. They disconnect when your device wakes from sleep. They disconnect when the app updates in the background. They disconnect when the VPN server has a temporary issue.

When the VPN disconnects, your device typically falls back to the unprotected network connection automatically. Depending on the app and its settings, the kill switch — the feature that should block all traffic when the VPN drops — may take several seconds to activate. In that window, your traffic is exposed.

In addition, VPN apps protect only the device they're installed on. If you're working in a location where multiple devices are connected — a laptop, a phone, a tablet, a client's machine you're using temporarily — each one needs its own VPN running. If any of them isn't running the VPN, it's unprotected.

What actually provides reliable protection?

Hardware-level protection addresses the gap problem by moving protection from the app layer to the network layer.

A hardware VPN router like NomaPort Roam creates a secure network wherever you plug it in. Every device that connects to that network is protected, regardless of whether it has a VPN app installed. The protection is on by default, always, from the moment you connect.

When the VPN connection drops at the router level, the router blocks all outbound traffic immediately at the hardware level, with no detection delay. There is no gap.

This is a different category of protection from a VPN app — not better in every situation, but categorically different in the situations where gaps matter most: when you're working from public networks regularly, with sensitive client data, across multiple devices.

Who needs to worry about this most?

The risk is highest for people who regularly work from locations they don't control — cafes, hotels, client offices, coworking spaces, airports. If you're in an office on a network you manage, your exposure is much lower.

The stakes are highest when you're handling data that has real consequences if it's exposed. Client financial data. Legal documents under NDA. Medical information. Credentials that give access to client systems.

If you combine regular public network use with sensitive data, the question isn't whether this risk applies to you. It's how much of a gap you're willing to accept.