The advice to never use open networks and always turn on a VPN was formed approximately fifteen years ago, and at that time it was accurate. Since then, the internet has changed so much that most of the statements from those materials no longer correspond to reality, although they continue to move from one text to another. Let's figure out which risks have disappeared, which have remained, and what to do about them practically.

Why the Old Advice Was Correct

In 2010, websites mostly did not encrypt traffic, so anyone on the same network could read the contents of other people's connections. This was clearly demonstrated by the Firesheep browser extension, which made it possible to intercept social network session files on open Wi-Fi literally in a few clicks. The panic around it arose precisely because the tool actually worked. It was from that period that the wording came from that all your traffic was visible to everyone on the network.

What Has Changed

As of 2026, more than ninety-five percent of web traffic is transmitted in encrypted form through HTTPS, and this applies to all major services, including banks, email, and social networks. The practical consequence is that a passive observer on the same network cannot read either your banking password or the contents of your correspondence, since they see only an encrypted stream. Regulators recognized this as well. The U.S. Federal Trade Commission updated its recommendations in March 2026, noting that the spread of HTTPS has significantly improved the security of public networks. Therefore, anyone who in 2026 claims that all your traffic in a café is visible to the neighbor at the next table is relying on an outdated threat model.

What Remains Real

This is where the most important part begins, since the risks have not disappeared but have changed their nature. Previously, the danger was that your content could be read, while now it is that your connection can be manipulated. Fake networks are the main threat. An attacker creates an access point with a name similar to the official network of an establishment, and devices connect to it, after which all traffic goes through the attacker's equipment. Protection against this is not technical, but simple, that is, clarify the exact name of the network with the staff before connecting. Fake login pages work through the mechanism used by hotels and airports, when after connecting a page with terms of use or a login form opens. A fake version of such a page may ask you to enter account details, a card number, or install an app, and it does not need to break encryption at all. Automatic reconnection creates a separate risk, since the phone remembers networks and later connects to any access point with the same name, including a fake one, and does this silently. Metadata leakage remains even with full encryption, since the network operator can see which websites you have accessed, even without seeing the content of the pages. Device infection is possible when the system has not been updated for a long time or when file sharing for everyone on the network is enabled on the device.

About VPN Without Advertising

Since most materials on this topic are written by VPN sellers, I will separately say what these services do and what they do not do. A VPN encrypts your traffic to its server, and this really hides from the network operator the list of websites you access, and also protects the part of the data that for some reason is transmitted without encryption. At the same time, a VPN does not add noticeable protection for ordinary traffic to properly configured websites, since it is already encrypted. It does not make downloading malicious files safer and does not protect against phishing, that is, from a situation when you enter data yourself on a fake page. The most important warning is that an unreliable VPN provider is worse than having no VPN, because you give one company the full log of your browsing. Free services make money precisely by collecting data or by embedding advertising, so there is no point in using them for protection. The reasonable wording looks like this. In 2026, a VPN on public Wi-Fi is a good practice for privacy, not a means of rescue from an immediate threat, and for most everyday scenarios it is not mandatory. Situations where it is really needed concern working with corporate systems, confidential client data, and limiting tracking of your activity by the network operator.

What Works Better Than a VPN

System and browser updates matter more for security on a public network than any VPN, since they are what close the vulnerabilities through which infection is possible. A password manager protects against phishing better than attentiveness, since it will not enter a saved password on a website with a different address, even if the page looks identical to the real one. Two-factor authentication devalues session theft, because login details alone become insufficient for the attacker. I wrote more about its setup in a separate material about account security.

Mobile internet instead of Wi-Fi is the simplest solution for sensitive operations, since cellular traffic is encrypted and is not shared with strangers nearby. For banking operations or submitting documents, sharing internet from a phone is more reliable than any public network.

Practical Rules

Turn off automatic connection to open networks and enable a connection request so that the device does not connect silently. Delete the network from the list of saved networks after you stop using it. Never ignore browser warnings about a certificate problem, since this is the clearest sign of interference with the connection, and in such a situation the correct action is to disconnect from the network. Do not install programs or updates while being on a public network, but wait until you connect to a trusted one. Do not enter account details or payment information on pages that opened by themselves after connecting to the network. Turn off file sharing and device visibility on the network if these functions are enabled for you. Check whether the correct website address is in the address bar, and not just the lock icon, since fake websites can also have encryption.

Ukrainian Specifics

During prolonged power outages, the role of public networks increases, since people work from cafés, coworking spaces, and Points of Invincibility, where there is a generator and connectivity. This means that it will not be possible to completely avoid public networks, and the question is not whether to use them or not, but how exactly. The practical conclusion for such conditions is simple. Ordinary work, reading email, and messengers on a public network do not pose a real problem provided that the device is updated. For banking operations, working with documents, and logging into systems with sensitive data, it is worth switching to mobile internet, even if it is slower. I wrote about how to maintain connectivity during outages in general in a separate material.


Sources: Updated U.S. Federal Trade Commission Guidelines on Public Networks, CISA Materials, Network Security Industry Publications.