HTTPS support covers 96% of the top 1,000 websites globally, according to Internet Society Pulse. Google’s Chrome telemetry shows HTTPS navigations climbing from around 30-45% in 2015 to the 95-99% range around 2020. Older warnings about public WiFi security risks assumed traffic anyone nearby could read.
Guidance from the Federal Trade Commission now tells consumers that because of the widespread use of encryption, connecting through a public Wi-Fi network is usually safe. Perth District Court still sentenced a man to seven years and four months in November 2025. The term covered evil twin Wi-Fi offending and hacking into women’s online accounts to steal intimate material. His networks captured log-in credentials through a fake portal. No encryption was broken there, and what survives sits above the transport layer, where a device decides which network to trust.
Key Takeaways
- HTTPS support reaches 96% of the top 1,000 websites globally, though regional support ranges from 65% in Asia to 93% in Oceania.
- Chrome’s HTTPS navigation share climbed from around 30-45% in 2015 to the 95-99% range around 2020, then largely plateaued.
- Perth District Court sentenced an evil twin Wi-Fi operator to seven years and four months in November 2025, with parole eligibility after five years.
- CVE-2023-52424, the SSID Confusion issue in the IEEE 802.11 standard, carries a CISA-ADP base score of 7.4 HIGH.
- Across 2,021,637,607 unique Wi-Fi networks cataloged by WiGLE, 1.83% carry no encryption and 2.50% still run WEP.
- Phishing and spoofing topped the FBI’s 2025 internet crime complaint counts at 191,561, ahead of extortion at 89,129.
- The Internet Engineering Task Force published RFC 8110, specifying opportunistic and unauthenticated encryption for the wireless media, in March 2017.
Why Packet Sniffing Stopped Working
HTTPS support reaches 96% of the top 1,000 websites globally, per Internet Society Pulse measurements. TLS 1.3 support covers 88% of that same set. In the past, the Federal Trade Commission notes, most websites did not use encryption to scramble data and protect it from hackers snooping on the network.
Public Wi-Fi networks, or hotspots, sit in coffee shops, malls, airports, hotels and other places. In the early days of the internet they often were not secure. Regional HTTPS support now runs from 93% in Oceania and 90% in Europe down to 77% in Africa and 65% in Asia. Sub-regional support splits harder still, at 46% for Southern Asia against 79% for Eastern Asia and 95% for Northern America.
The Threat Did Not Vanish, It Moved Up the Stack
Attackers only need a single insecure navigation, Chrome’s security team notes, so HTTPS adoption does not close the foothold. Many plaintext HTTP connections are entirely invisible to users, because HTTP sites may immediately redirect to HTTPS sites.
The largest contributor to insecure HTTP is navigation to private sites such as local IP addresses, single-label hostnames and shortlinks. HTTP on private sites can only be abused by an attacker also on your local network. A hotspot puts the attacker on that local network by design.
Excluding private sites, Chrome measures HTTPS at nearly 97% on Linux, 98% on Windows and over 99% on both Android and Mac. Linux alone jumps from 84% HTTPS to nearly 97% once the analysis is limited to public sites.
In a Chrome 141 experiment, the number of warnings seen by any users was considerably lower than 3% of navigations. The median user saw fewer than one warning per week. Chrome 154 arrives in October 2026 with a changed default. The browser then asks for the user’s permission before the first access to any public site without HTTPS.
Does incognito mode help on public Wi-Fi?
Incognito mode clears local history on your device and changes nothing about what leaves it. Traffic still crosses the same network, where HTTP to private sites can only be abused by an attacker also on your local network. Encryption on the connection comes from the website instead, confirmed by a lock symbol or https in the address bar.
How a Real Evil Twin Attack Actually Worked
Australian Federal Police charged a 42-year-old West Australian man in May 2024 over fake free WiFi access points. Fake access points allegedly mimicked legitimate networks to capture personal data from unsuspecting victims. Investigators identified data relating to the use of the allegedly fraudulent WiFi pages at airports in Perth, Melbourne and Adelaide and on domestic flights.
The investigation opened in April 2024, after an airline reported concerns about a suspicious WiFi network its employees identified during a domestic flight. The man faced nine charges for alleged cybercrime offenses. Analysis of seized data and devices allegedly identified dozens of personal credentials belonging to other people, as well as fraudulent WiFi pages. Investigators also identified data relating to the use of the allegedly fraudulent WiFi pages at locations linked to the man’s previous employment.
Perth District Court sentenced him on November 28, 2025 to seven years and four months, with parole eligibility after five years.
Key finding: Australian Federal Police allege the man used a portable wireless access device to create evil twin free WiFi networks at multiple locations, luring users into believing they were legitimate services. When people tried to connect, a fake webpage required them to sign in using their email or social media logins, and those details were then allegedly saved to the man’s devices.
Nothing in that chain required breaking encryption. The credentials were typed, which is how credential phishing works anywhere else online.
Why Your Device Trusts the Wrong Network
The device in the Australian case, sometimes known as a WiFi Pineapple, passively listened for device probe requests. Probe requests triggered an instantly created matching network with the same name, tricking a device that it is a trusted network. The device would then connect automatically.
CVE-2023-52424, the SSID Confusion issue, describes how the IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network. The cause is that the SSID is not always used to derive the pairwise master key or session keys. Nor is there a protected exchange of an SSID during a 4-way handshake.
CISA-ADP scored the issue 7.4 HIGH, with the vector string CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. NVD had not provided its own assessment of the record at the time of capture. Check the network name is standard hotspot advice, and the record shows that name is not always bound to the session that follows. Our CVE severity distribution data tracks the same class of weakness.
NSA recommends disabling Wi-Fi, Bluetooth and NFC when not in use, at a minimum. Cyber actors can compromise devices over Bluetooth, public Wi-Fi and Near-Field Communications, which puts personal and organizational data, credentials and devices at risk.
The Open Network Problem Is Smaller Than the Headlines Suggest
Across 2,021,637,607 unique Wi-Fi networks cataloged by WiGLE, 1.83% carry no encryption at all and 2.50% still run WEP. WPA2 accounts for 74.50% of the catalog, WPA3 for 4.82%, WPA for 1.96%, and 14.43% are unidentified.
WiGLE’s catalog draws on observations uploaded by 729,067 registered users and records 20,180,440 networks, or 1.00%, still using a default SSID. The database holds 27,098,721,115 unique Wi-Fi locations and 2,000,438,948 networks with a location fix, and logged 264,124 new unique networks in a single day. That population mixes home and public networks, and no public dataset isolates hotspot encryption, so 1.83% describes every network rather than yours.
By the numbers: WiGLE’s crowd-sourced catalog of 2,021,637,607 networks records WPA2 at 74.50% and WPA3 at 4.82%. Another 14.43% are unidentified, 2.50% run WEP, 1.96% run WPA, and 1.83% carry no encryption at all. The catalog draws on uploads by 729,067 registered users.
The Wi-Fi Alliance makes WPA3 mandatory for Wi-Fi CERTIFIED devices and requires Protected Management Frames for all new certified devices. WPA3 networks also disallow outdated legacy protocols, the Alliance says. Protected Management Frames extend security protections to unicast management action frames, protecting against eavesdropping and forging. For multicast management action frames, the protection covers forging. WPA3 delivers increased cryptographic strength for highly sensitive data markets and maintains the resiliency of mission-critical networks, according to the Wi-Fi Alliance.
What HTTPS Still Leaks on a Hostile Network
Scammers create fake websites and encrypt them, the Federal Trade Commission warns. Data may be encrypted on its way to a scam site and still not be safe from the scammers operating that site. The padlock certifies the tunnel and says nothing about the destination.
Google’s analysis shows the largest remaining pocket of plaintext traffic is navigation to private sites such as local IP addresses, single-label hostnames and shortlinks. That traffic is typically less dangerous than its public-site counterpart, because there are fewer ways for an attacker to take advantage of it. The exposure requires an attacker already on your local network, such as your home wifi or a corporate network.
Worth noting: One caution from the Federal Trade Commission concerns the destination rather than the route. Scammers create fake websites and encrypt them, so if you visit a scammer’s website your data may be encrypted on its way to the site. It will not be safe from the scammers operating it.
Can someone see what you are doing on public Wi-Fi?
Because most websites use encryption, the Federal Trade Commission describes connecting through a public Wi-Fi network as usually safe. HTTP traffic to private sites stays open to an attacker who is also on the local network. Sensitive data in transit can include the log-in information for financial, email or social media accounts.
Grading Public WiFi Security Risks: Real, Situational, or Overstated
HTTPS now covers 96% of the top 1,000 websites globally. Credential capture through a fake portal, by contrast, was part of the offending behind a sentence of seven years and four months. That term also covered hacking into women’s online accounts to steal intimate material. Networks with no encryption at all still account for 1.83% of WiGLE’s catalog.
| Threat | What blunted it | Why it still works | Grade |
|---|---|---|---|
| Packet sniffing of logins | HTTPS on 96% of the top 1,000 sites | Residual plaintext to local addresses | Overstated |
| Evil twin fake hotspot | Nothing at the protocol layer | Devices auto-join a matching SSID | Real |
| Fake captive portal sign-in | Nothing | People type credentials into any sign-in page | Real |
| Session hijacking on open Wi-Fi | WPA3 plus Protected Management Frames | WEP at 2.50% and open networks at 1.83% persist | Situational |
| Checking the network name | Not applicable | SSID is not always bound to key derivation | Overstated as a defense |
| Malware injection over HTTP | Chrome 154 HTTPS-by-default from October 2026 | Any single insecure navigation offers a foothold | Situational |
Source: FTC, Australian Federal Police, National Vulnerability Database and Wi-Fi Alliance, 2023 to 2026
Calling packet sniffing the live threat aims readers at a solved problem, and calling the category settled ignores the evil twin chain.
What the Crime Data Says About Proportion
Phishing and spoofing led the FBI’s 2025 internet crime complaint counts at 191,561, ahead of extortion at 89,129 and investment fraud at 72,984. Personal data breach followed at 67,456 complaints, and non-payment or non-delivery at 56,478.
By reported loss, personal data breach led at $1,314,923,988, ahead of confidence and romance fraud at $929,287,469.
Cyber-enabled fraud is responsible for almost 85% of all losses reported to IC3 in 2025. No category in that table covers Wi-Fi interception, and no government or standards body publishes an incidence rate for evil twin attacks.
Phishing and spoofing also carried $215,843,126 in reported losses that year. Credentials lost on a hostile hotspot land in that column, the pattern behind our voice phishing complaint data and the wider cybersecurity threat data we publish.
What Actually Helps Reduce the Risk
NSA guidance written for National Security System, Department of Defense and Defense Industrial Base teleworkers recommends avoiding public Wi-Fi. It points instead to a personal or corporate mobile hotspot with strong authentication and encryption. If users must connect, NSA points to a personal or corporate-provided VPN to encrypt the traffic. The order matters: the first step removes the untrusted network, the second wraps traffic crossing it.
The NSA Cybersecurity Information Sheet describes how to identify potentially vulnerable public connections, secure common wireless technologies, and better protect devices and data. It covers laptops, tablets, mobile, wearable and other devices that can connect to public wireless technologies.
Wi-Fi Enhanced Open provides unauthenticated data encryption to users, an improvement over traditional open networks with no protections at all. Interoperability extends to legacy networks, even those using a captive portal. RFC 8110, published in March 2017, specifies that extension to IEEE Std 802.11 as opportunistic and unauthenticated encryption for the wireless media.
Wi-Fi Enhanced Open also leaves network providers with no public passphrases to maintain, share or manage. Unauthenticated is the whole story, so the mechanism blunts the passive listener and leaves the impersonator untouched.
That guidance is written for government and defence readers. Consumer-facing equivalents cover the same ground in plainer terms, and the VPNOverview cybersecurity experts publish walkthroughs aimed at non-specialist readers.
AFP Commander Renee Colley addressed the community when the sentence was handed down.
The AFP’s message to the community is to please be vigilant when connecting to any kind of free WiFi network, especially at public places such as airports. A network that requests your personal details, such as an email or social media account, should be avoided.
Do you need a VPN on public Wi-Fi?
NSA guidance says that if users must connect to public Wi-Fi, they should take necessary precautions. Precautions include using a personal or corporate-provided virtual private network to encrypt the traffic. A VPN moves the trust boundary from the hotspot operator to the VPN operator, which helps reduce exposure but not credential loss.
Advice published by the Federal Trade Commission leans instead on the encryption already present in most websites. Confirmation comes from a lock symbol or https in the address bar. Both positions hold, because a tunnel and a log-in page fail in different ways.
How can you tell if a Wi-Fi network is fake?
AFP guidance says to be vigilant when connecting to any kind of free WiFi network, especially at public places such as airports. A network that requests your personal details, such as an email or social media account, should be avoided.
The network in the Perth case took people to a webpage where they were prompted to log on using an email or social media account. Once people entered their details, it did not actually lead to a free WiFi connection.
Name-checking has a documented limit, because CVE-2023-52424 records that the SSID is not always used to derive the pairwise master key or session keys. Matching the expected name helps, and it cannot confirm the network’s identity.
Is it safe to use mobile banking on public Wi-Fi?
According to the Federal Trade Commission, because most websites now use encryption, connecting through a public Wi-Fi network is usually safe. Telling whether a mobile app uses encryption can be hard, though the majority do. Scammers still create fake websites and encrypt them, so a scam site can carry a padlock and remain unsafe.
Phishing and spoofing generated 191,561 complaints in the FBI’s 2025 tables, the highest count of any listed crime type.
Conclusion
HTTPS support at 96% of the top 1,000 websites globally has narrowed the eavesdropping exposure most public Wi-Fi warnings were written about. Guidance from the Federal Trade Commission now calls connecting through a public Wi-Fi network usually safe. In the Perth case the credentials were captured because victims typed them into a fake portal, not because encryption was intercepted in transit. The seven year and four month sentence covered both offence streams. What replaced packet sniffing is smaller and sharper: a network that impersonates one you trust, and a page that asks for a log-in.
Travelers and cafe workers gain more from grading public WiFi security risks separately than from treating the whole category as settled.
