--- title: "Public WiFi Security Risks: What’s Real and What’s Overstated" date: 2026-09-26 author: "Sofia Ramirez" featured_image: "https://sqmagazine.co.uk/wp-content/uploads/2026/09/public-wifi-security-risks-what-s-real-what-s-overstated-v3.jpg" categories: - name: "Cybersecurity" url: "/cybersecurity.md" tags: - name: "Insights" url: "/tag/insights.md" --- # Public WiFi Security Risks: What’s Real and What’s Overstated HTTPS support covers **96%** of the top 1,000 websites globally, according to Internet Society Pulse. Google’s Chrome telemetry shows HTTPS navigations climbing from around **30-45%** in 2015 to the **95-99%** range around 2020. Older warnings about public WiFi security risks assumed traffic anyone nearby could read. Guidance from the Federal Trade Commission now tells consumers that because of the widespread use of encryption, connecting through a public Wi-Fi network is usually safe. Perth District Court still sentenced a man to seven years and four months in November 2025. The term covered evil twin Wi-Fi offending and hacking into women’s online accounts to steal intimate material. His networks captured log-in credentials through a fake portal. No encryption was broken there, and what survives sits above the transport layer, where a device decides which network to trust. ## Key Takeaways - HTTPS support reaches **96%** of the top 1,000 websites globally, though regional support ranges from **65%** in Asia to **93%** in Oceania. - Chrome’s HTTPS navigation share climbed from around **30-45%** in 2015 to the **95-99%** range around 2020, then largely plateaued. - Perth District Court sentenced an evil twin Wi-Fi operator to seven years and four months in November 2025, with parole eligibility after five years. - CVE-2023-52424, the SSID Confusion issue in the IEEE 802.11 standard, carries a CISA-ADP base score of **7.4** HIGH. - Across **2,021,637,607** unique Wi-Fi networks cataloged by WiGLE, **1.83%** carry no encryption and **2.50%** still run WEP. - Phishing and spoofing topped the FBI’s 2025 internet crime complaint counts at **191,561**, ahead of extortion at **89,129**. - The Internet Engineering Task Force published RFC 8110, specifying opportunistic and unauthenticated encryption for the wireless media, in **March 2017**. ## Why Packet Sniffing Stopped Working HTTPS support reaches **96%** of the top 1,000 websites globally, per Internet Society Pulse measurements. TLS 1.3 support covers **88%** of that same set. In the past, the Federal Trade Commission notes, most websites did not use encryption to scramble data and protect it from hackers snooping on the network. Public Wi-Fi networks, or hotspots, sit in coffee shops, malls, airports, hotels and other places. In the early days of the internet they often were not secure. Regional HTTPS support now runs from **93%** in Oceania and **90%** in Europe down to **77%** in Africa and **65%** in Asia. Sub-regional support splits harder still, at **46%** for Southern Asia against **79%** for Eastern Asia and **95%** for Northern America. Region by HTTPS support (%) HTTPS SUPPORT (%) · HTTPS support (%) · Source: Internet Society Pulse, August 2026 HTTPS SUPPORT (%) · SQ MAGAZINE ANALYSIS Region by HTTPS support (%) HTTPS support (%) Internet Society · 2026 100 75 50 25 0 93 Oceania 90 Europe 88 Americas 77 Africa 65 Asia SOURCE Internet Society Pulse, August 2026 ## The Threat Did Not Vanish, It Moved Up the Stack Attackers only need a single insecure navigation, Chrome’s security team notes, so HTTPS adoption does not close the foothold. Many plaintext HTTP connections are entirely invisible to users, because HTTP sites may immediately redirect to HTTPS sites. The largest contributor to insecure HTTP is navigation to private sites such as local IP addresses, single-label hostnames and shortlinks. HTTP on private sites can only be abused by an attacker also on your local network. A hotspot puts the attacker on that local network by design. Excluding private sites, Chrome measures HTTPS at nearly **97%** on Linux, **98%** on Windows and over **99%** on both Android and Mac. Linux alone jumps from **84%** HTTPS to nearly **97%** once the analysis is limited to public sites. In a Chrome 141 experiment, the number of warnings seen by any users was considerably lower than **3%** of navigations. The median user saw fewer than one warning per week. Chrome 154 arrives in October 2026 with a changed default. The browser then asks for the user’s permission before the first access to any public site without HTTPS. ### Does incognito mode help on public Wi-Fi? Incognito mode clears local history on your device and changes nothing about what leaves it. Traffic still crosses the same network, where HTTP to private sites can only be abused by an attacker also on your local network. Encryption on the connection comes from the website instead, confirmed by a lock symbol or https in the address bar. ## How a Real Evil Twin Attack Actually Worked Australian Federal Police charged a 42-year-old West Australian man in May 2024 over fake free WiFi access points. Fake access points allegedly mimicked legitimate networks to capture personal data from unsuspecting victims. Investigators identified data relating to the use of the allegedly fraudulent WiFi pages at airports in Perth, Melbourne and Adelaide and on domestic flights. The investigation opened in April 2024, after an airline reported concerns about a suspicious WiFi network its employees identified during a domestic flight. The man faced nine charges for alleged cybercrime offenses. Analysis of seized data and devices allegedly identified dozens of personal credentials belonging to other people, as well as fraudulent WiFi pages. Investigators also identified data relating to the use of the allegedly fraudulent WiFi pages at locations linked to the man’s previous employment. Perth District Court sentenced him on November 28, 2025 to seven years and four months, with parole eligibility after five years. > **Key finding:** Australian Federal Police allege the man used a portable wireless access device to create evil twin free WiFi networks at multiple locations, luring users into believing they were legitimate services. When people tried to connect, a fake webpage required them to sign in using their email or social media logins, and those details were then allegedly saved to the man’s devices. Nothing in that chain required breaking encryption. The credentials were typed, which is [how credential phishing works](https://sqmagazine.co.uk/what-is-phishing/) anywhere else online. ## Why Your Device Trusts the Wrong Network The device in the Australian case, sometimes known as a WiFi Pineapple, passively listened for device probe requests. Probe requests triggered an instantly created matching network with the same name, tricking a device that it is a trusted network. The device would then connect automatically. CVE-2023-52424, the SSID Confusion issue, describes how the IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network. The cause is that the SSID is not always used to derive the pairwise master key or session keys. Nor is there a protected exchange of an SSID during a 4-way handshake. CISA-ADP scored the issue **7.4** HIGH, with the vector string CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. NVD had not provided its own assessment of the record at the time of capture. Check the network name is standard hotspot advice, and the record shows that name is not always bound to the session that follows. Our [CVE severity distribution](https://sqmagazine.co.uk/cve-statistics/) data tracks the same class of weakness. NSA recommends disabling Wi-Fi, Bluetooth and NFC when not in use, at a minimum. Cyber actors can compromise devices over Bluetooth, public Wi-Fi and Near-Field Communications, which puts personal and organizational data, credentials and devices at risk. ## The Open Network Problem Is Smaller Than the Headlines Suggest Across **2,021,637,607** unique Wi-Fi networks cataloged by WiGLE, **1.83%** carry no encryption at all and **2.50%** still run WEP. WPA2 accounts for **74.50%** of the catalog, WPA3 for **4.82%**, WPA for **1.96%**, and **14.43%** are unidentified. Encryption SHARE OF CATALOGED NETWORKS (%) · Share of cataloged networks (%) · Source: WiGLE network observation database, August 2026 SHARE OF CATALOGED NETWORKS (%) · SQ MAGAZINE ANALYSIS Encryption Share of cataloged networks (%) WiGLE · 2026 74.5% WPA2 WPA2 74.5% Unidentified 14.43% WPA3 4.82% WEP 2.5% WPA 1.96% SOURCE WiGLE network observation database, August 2026 WiGLE’s catalog draws on observations uploaded by **729,067** registered users and records **20,180,440** networks, or **1.00%**, still using a default SSID. The database holds **27,098,721,115** unique Wi-Fi locations and **2,000,438,948** networks with a location fix, and logged **264,124** new unique networks in a single day. That population mixes home and public networks, and no public dataset isolates hotspot encryption, so **1.83%** describes every network rather than yours. > **By the numbers:** WiGLE’s crowd-sourced catalog of **2,021,637,607** networks records WPA2 at **74.50%** and WPA3 at **4.82%**. Another **14.43%** are unidentified, **2.50%** run WEP, **1.96%** run WPA, and **1.83%** carry no encryption at all. The catalog draws on uploads by **729,067** registered users. The Wi-Fi Alliance makes WPA3 mandatory for Wi-Fi CERTIFIED devices and requires Protected Management Frames for all new certified devices. WPA3 networks also disallow outdated legacy protocols, the Alliance says. Protected Management Frames extend security protections to unicast management action frames, protecting against eavesdropping and forging. For multicast management action frames, the protection covers forging. WPA3 delivers increased cryptographic strength for highly sensitive data markets and maintains the resiliency of mission-critical networks, according to the Wi-Fi Alliance. ## What HTTPS Still Leaks on a Hostile Network Scammers create fake websites and encrypt them, the Federal Trade Commission warns. Data may be encrypted on its way to a scam site and still not be safe from the scammers operating that site. The padlock certifies the tunnel and says nothing about the destination. Google’s analysis shows the largest remaining pocket of plaintext traffic is navigation to private sites such as local IP addresses, single-label hostnames and shortlinks. That traffic is typically less dangerous than its public-site counterpart, because there are fewer ways for an attacker to take advantage of it. The exposure requires an attacker already on your local network, such as your home wifi or a corporate network. > **Worth noting:** One caution from the Federal Trade Commission concerns the destination rather than the route. Scammers create fake websites and encrypt them, so if you visit a scammer’s website your data may be encrypted on its way to the site. It will not be safe from the scammers operating it. ### Can someone see what you are doing on public Wi-Fi? Because most websites use encryption, the Federal Trade Commission describes connecting through a public Wi-Fi network as usually safe. HTTP traffic to private sites stays open to an attacker who is also on the local network. Sensitive data in transit can include the log-in information for financial, email or social media accounts. ## Grading Public WiFi Security Risks: Real, Situational, or Overstated HTTPS now covers **96%** of the top 1,000 websites globally. Credential capture through a fake portal, by contrast, was part of the offending behind a sentence of seven years and four months. That term also covered hacking into women’s online accounts to steal intimate material. Networks with no encryption at all still account for **1.83%** of WiGLE’s catalog. | Threat | What blunted it | Why it still works | Grade | |---|---|---|---| | Packet sniffing of logins | HTTPS on 96% of the top 1,000 sites | Residual plaintext to local addresses | Overstated | | Evil twin fake hotspot | Nothing at the protocol layer | Devices auto-join a matching SSID | Real | | Fake captive portal sign-in | Nothing | People type credentials into any sign-in page | Real | | Session hijacking on open Wi-Fi | WPA3 plus Protected Management Frames | WEP at 2.50% and open networks at 1.83% persist | Situational | | Checking the network name | Not applicable | SSID is not always bound to key derivation | Overstated as a defense | | Malware injection over HTTP | Chrome 154 HTTPS-by-default from October 2026 | Any single insecure navigation offers a foothold | Situational | *Source: FTC, Australian Federal Police, National Vulnerability Database and Wi-Fi Alliance, 2023 to 2026* Calling packet sniffing the live threat aims readers at a solved problem, and calling the category settled ignores the evil twin chain. ## What the Crime Data Says About Proportion Phishing and spoofing led the FBI’s 2025 internet crime complaint counts at **191,561**, ahead of extortion at **89,129** and investment fraud at **72,984**. Personal data breach followed at **67,456** complaints, and non-payment or non-delivery at **56,478**. By reported loss, personal data breach led at **$1,314,923,988**, ahead of confidence and romance fraud at **$929,287,469**. Crime type by 2025 complaints 2025 COMPLAINTS · 2025 complaints · Source: FBI Internet Crime Complaint Center, 2025 Internet Crime Report 2025 COMPLAINTS · SQ MAGAZINE ANALYSIS Crime type by 2025 complaints 2025 complaints FBI Internet · 2025 Phishing and spoofing 191,561 Extortion 89,129 Investment fraud 72,984 Personal data breach 67,456 Non-payment or non-delivery 56,478 Tech and customer support 47,794 0 40K 80K 120K 160K 200K SOURCE FBI Internet Crime Complaint Center, 2025 Internet Crime Report Cyber-enabled fraud is responsible for almost **85%** of all losses reported to IC3 in 2025. No category in that table covers Wi-Fi interception, and no government or standards body publishes an incidence rate for evil twin attacks. Phishing and spoofing also carried **$215,843,126** in reported losses that year. Credentials lost on a hostile hotspot land in that column, the pattern behind our [voice phishing complaint data](https://sqmagazine.co.uk/voice-phishing-statistics/) and the wider [cybersecurity threat data](https://sqmagazine.co.uk/cybersecurity-statistics/) we publish. ## What Actually Helps Reduce the Risk NSA guidance written for National Security System, Department of Defense and Defense Industrial Base teleworkers recommends avoiding public Wi-Fi. It points instead to a personal or corporate mobile hotspot with strong authentication and encryption. If users must connect, NSA points to a personal or corporate-provided VPN to encrypt the traffic. The order matters: the first step removes the untrusted network, the second wraps traffic crossing it. The NSA Cybersecurity Information Sheet describes how to identify potentially vulnerable public connections, secure common wireless technologies, and better protect devices and data. It covers laptops, tablets, mobile, wearable and other devices that can connect to public wireless technologies. Wi-Fi Enhanced Open provides unauthenticated data encryption to users, an improvement over traditional open networks with no protections at all. Interoperability extends to legacy networks, even those using a captive portal. RFC 8110, published in **March 2017**, specifies that extension to IEEE Std 802.11 as opportunistic and unauthenticated encryption for the wireless media. Wi-Fi Enhanced Open also leaves network providers with no public passphrases to maintain, share or manage. Unauthenticated is the whole story, so the mechanism blunts the passive listener and leaves the impersonator untouched. That guidance is written for government and defence readers. Consumer-facing equivalents cover the same ground in plainer terms, and the [VPNOverview cybersecurity experts](https://vpnoverview.com/) publish walkthroughs aimed at non-specialist readers. AFP Commander Renee Colley addressed the community when the sentence was handed down. > The AFP’s message to the community is to please be vigilant when connecting to any kind of free WiFi network, especially at public places such as airports. A network that requests your personal details, such as an email or social media account, should be avoided. ## Do you need a VPN on public Wi-Fi? NSA guidance says that if users must connect to public Wi-Fi, they should take necessary precautions. Precautions include using a personal or corporate-provided virtual private network to encrypt the traffic. A VPN moves the trust boundary from the hotspot operator to the VPN operator, which helps reduce exposure but not credential loss. Advice published by the Federal Trade Commission leans instead on the encryption already present in most websites. Confirmation comes from a lock symbol or https in the address bar. Both positions hold, because a tunnel and a log-in page fail in different ways. ## How can you tell if a Wi-Fi network is fake? AFP guidance says to be vigilant when connecting to any kind of free WiFi network, especially at public places such as airports. A network that requests your personal details, such as an email or social media account, should be avoided. The network in the Perth case took people to a webpage where they were prompted to log on using an email or social media account. Once people entered their details, it did not actually lead to a free WiFi connection. Name-checking has a documented limit, because CVE-2023-52424 records that the SSID is not always used to derive the pairwise master key or session keys. Matching the expected name helps, and it cannot confirm the network’s identity. ## Is it safe to use mobile banking on public Wi-Fi? According to the Federal Trade Commission, because most websites now use encryption, connecting through a public Wi-Fi network is usually safe. Telling whether a mobile app uses encryption can be hard, though the majority do. Scammers still create fake websites and encrypt them, so a scam site can carry a padlock and remain unsafe. Phishing and spoofing generated **191,561** complaints in the FBI’s 2025 tables, the highest count of any listed crime type. ## Conclusion HTTPS support at **96%** of the top 1,000 websites globally has narrowed the eavesdropping exposure most public Wi-Fi warnings were written about. Guidance from the Federal Trade Commission now calls connecting through a public Wi-Fi network usually safe. In the Perth case the credentials were captured because victims typed them into a fake portal, not because encryption was intercepted in transit. The seven year and four month sentence covered both offence streams. What replaced packet sniffing is smaller and sharper: a network that impersonates one you trust, and a page that asks for a log-in. Travelers and cafe workers gain more from grading public WiFi security risks separately than from treating the whole category as settled.