Public Wi-Fi risk is still being underestimated by users

At a glance

What this is: This article explains why public Wi-Fi is a routine attack surface and shows how unencrypted networks, MITM attacks, and evil twin hotspots expose data.

Why it matters: It matters because employees, contractors, and travellers routinely use unmanaged networks, creating a broader access and identity risk that IAM, device security, and policy teams must account for.

By the numbers:

• 31% of American travelers use public Wi-Fi while traveling within the U.S., 10% while abroad, and 59% in both scenarios.
• 24.7% of public hotspots worldwide do not use any form of encryption.
• 67% of reported incidents took place on planes, 59% at airports, and 52% in cafés or on public transportation.
• 12% of incidents were traced back to employees using unsafe networks while traveling.

👉 Read Jscrambler's analysis of public Wi-Fi threats and safer browsing habits

Context

Public Wi-Fi is a convenience layer, not a trust boundary. The problem is that users often treat open networks as if they were private infrastructure, even though traffic on those networks can be observed, redirected, or manipulated by nearby attackers. For identity and access programmes, that creates a real exposure point whenever a user authenticates, manages sessions, or reaches corporate resources from an unmanaged network.

The article is strongest when it connects travel behaviour to security exposure. That intersection matters to IAM and NHI teams because the same unmanaged network conditions that threaten human credentials can also affect VPN sessions, device trust signals, and access to internal applications. The user behaviour described here is typical, which is exactly why policy and technical controls need to assume it will keep happening.

Key questions

Q: How should security teams handle public Wi-Fi risk for remote users?

A: Treat public Wi-Fi as an untrusted environment and make access conditional on stronger verification. That usually means VPN enforcement, step-up authentication for sensitive apps, and device posture checks before users can reach corporate systems. The goal is not to ban travel connectivity, but to prevent weak network trust from becoming an easy path to credential or session theft.

Q: Why do public hotspots create more access risk than most users realise?

A: Because the network can be fake, shared, or unencrypted, and the user has little way to verify who controls it. That weakens the confidence behind every login, message, and transaction. Security teams should treat the network as part of the trust decision, not as a neutral pipe carrying secure traffic.

Q: What breaks when users rely on auto-connect on public Wi-Fi?

A: Auto-connect can place a device onto a spoofed or compromised network without the user noticing, which removes the human check that would otherwise catch a fake hotspot. Once that happens, the attacker can observe traffic, redirect sessions, or capture credentials before the user realises anything is wrong.

Q: Who is accountable when sensitive data is accessed over public Wi-Fi?

A: Accountability is shared, but the security team owns the policy, the endpoint team owns device controls, and the business owns user compliance. In regulated environments, the organisation must show that it assessed the risk, defined protected-use rules, and enforced controls for remote access and sensitive transactions.

Technical breakdown

Why open networks enable credential interception

Public Wi-Fi often lacks encryption at the transport layer, which means traffic between a device and the access point may be readable to anyone on the same network path. Even when websites use HTTPS, metadata, session handling, DNS queries, and badly protected applications can still leak useful information. The core risk is not just packet sniffing. It is the exposure of identities, sessions, and sensitive workflows on infrastructure the user does not control.

Practical implication: treat public Wi-Fi as hostile and require secure transport, VPN enforcement, and stronger access conditions before sensitive apps are reachable.

How man-in-the-middle attacks and evil twin hotspots work

A man-in-the-middle attack inserts an attacker between the user and the destination so traffic can be monitored, altered, or diverted. An evil twin hotspot does this by impersonating a legitimate Wi-Fi network with a convincing name, tempting users to connect without noticing the difference. Once joined, the attacker can harvest credentials, inject malicious content, or redirect traffic to spoofed services. The user believes they are online safely, but the network itself has been weaponised.

Practical implication: pair network verification with certificate validation and user guidance so spoofed access points do not become an easy entry path.

Why public Wi-Fi creates an identity and access problem

Public Wi-Fi is not only a network issue. It is also an identity assurance issue because users often authenticate from devices and locations that provide weak confidence signals. If auto-connect, shared networks, or compromised hotspots are involved, the organisation may be making access decisions on degraded trust. That becomes especially relevant for remote access, password resets, and cloud application login, where session integrity matters as much as username and password.

Practical implication: add contextual access rules for location, network trust, and step-up authentication when logins originate from public networks.

Threat narrative

Attacker objective: The attacker wants to steal credentials, sensitive data, or session access from users who believe they are on a safe network.

1. Entry begins when a user joins an untrusted public Wi-Fi network or a convincing evil twin hotspot that imitates a legitimate service.
2. Escalation occurs when the attacker intercepts traffic, captures credentials, or injects malicious payloads into sessions and browsing flows.
3. Impact follows through account compromise, theft of personal or corporate data, and possible device infection through malware or redirected content.

NHI Mgmt Group analysis

Public Wi-Fi is a trust-collapse problem, not just a connectivity problem. The article shows that users routinely make access decisions in places where network provenance is weak and attacker proximity is high. That means security teams should stop treating public connectivity as an edge case and instead model it as a recurring exposure path for identity, session, and data theft. The operational conclusion is simple: trust must be re-established before access is granted, not after the device is already online.

Network trust and identity assurance now overlap more than many programmes admit. When users authenticate over public Wi-Fi, the risk is not limited to packet interception. The organisation also loses context about device integrity, location certainty, and session legitimacy. That creates a governance gap between network security and IAM, especially where remote access, password resets, and sensitive SaaS use depend on assumptions about the client environment. Practitioners should treat public-network context as a factor in access policy, not an afterthought.

Named concept: public-network trust gap. This is the disconnect between the convenience users expect from open Wi-Fi and the level of assurance security teams actually need before permitting sensitive activity. The article illustrates how that gap leads to unsafe logins, unmanaged sessions, and preventable exposure. The practical takeaway is that policy must account for hostile connectivity conditions and require stronger controls when trust is low.

VPNs reduce exposure, but they do not fix weak access decisions. Encrypting traffic helps, yet it does not compensate for poor endpoint hygiene, auto-connect behaviour, or user activity on compromised networks. The broader lesson is that layered protection has to start with network awareness, then move into identity, device, and application controls. Practitioners should design for the weakest part of the chain, which is often user behaviour on public infrastructure.

The article reinforces a familiar pattern: convenience drives most risky connectivity decisions. That matters because security programmes rarely fail on missing theory. They fail when everyday workflows make unsafe defaults feel normal. In practice, the control model has to reduce friction for safe access and increase friction for sensitive access on untrusted networks. Teams should focus on policy that matches how people actually travel and work.

What this signals

Public-network trust gap: organisations increasingly need access policy that understands where a session originates, not just who is authenticating. When users operate from airports, cafés, and hotels, access decisions should incorporate network trust, device posture, and sensitivity of the target system before the session is allowed to proceed.

The identity lesson is broader than VPN adoption. Human identity, device trust, and session governance now intersect in ways that make weak connectivity an access-control problem. Teams that rely on one-factor convenience for travel workflows will keep inheriting avoidable risk, especially where sensitive data and administrative systems are involved.

For practitioners

• Classify public networks as untrusted access conditions Update remote access and SaaS policies so logins from public Wi-Fi trigger stricter checks, especially for finance, admin, and sensitive collaboration tools.
• Disable auto-connect on user devices Require endpoint teams to turn off automatic joining for remembered networks and to prompt users before connecting to any open hotspot.
• Enforce secure transport and step-up controls Require HTTPS-only browsing, VPN use where appropriate, and step-up authentication when the device is on an untrusted network or the network cannot be verified.
• Train users to verify hotspot identity Teach travellers to confirm the official network name with staff and to avoid joining lookalike SSIDs that mimic trusted venues.
• Reduce sensitive activity on open networks Block or warn on banking, admin, and corporate actions from public Wi-Fi unless the session is protected by approved controls and the endpoint meets policy.

Key takeaways

• Public Wi-Fi becomes dangerous when users treat open networks as trusted infrastructure rather than contested access paths.
• The article's evidence shows that unencrypted hotspots, MITM attacks, and fake SSIDs are practical threats, not theoretical ones.
• Security teams should respond with network trust controls, step-up authentication, and clear rules for sensitive activity on untrusted connections.

Key terms

• Public Network Trust Gap: The difference between the convenience users expect from open Wi-Fi and the assurance security teams need before allowing sensitive activity. It appears when network location is treated as harmless, even though the connection may be spoofed, shared, or observed by an attacker.
• Evil Twin Wi-Fi: A rogue wireless network that imitates a legitimate access point so users connect without realising the network is hostile. It is used to intercept traffic, harvest credentials, or present fake login portals that turn convenience into account takeover risk.
• Man-in-the-Middle Attack: A man-in-the-middle attack is an interception technique where an attacker positions themselves between two parties that believe they are communicating directly. The attacker can read, alter, or replay traffic, which makes the attack especially dangerous when credentials, sessions, or certificates are involved.
• Step-up Authentication: Step-up authentication is an additional verification step triggered when a session becomes higher risk or a user attempts a sensitive action. It is used to reduce exposure without forcing extra friction across every interaction, which makes it useful for runtime access governance.

What's in the full article

Jscrambler's full article covers the practical user guidance and risk scenarios this post intentionally leaves for the source:

• User-facing examples of how fake hotspots and public-network attacks are set up in real travel environments
• Step-by-step advice for checking network names, disabling auto-connect, and avoiding sensitive activity on open Wi-Fi
• Plain-language explanations of HTTPS, VPNs, and file-sharing settings for non-specialist readers
• Traveller-focused safety guidance that can be adapted into internal security awareness material

👉 Jscrambler's full article covers user examples, network attack patterns, and practical safe-use steps.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It gives practitioners a structured way to connect identity controls to broader access and lifecycle risk.