# The Hidden Cost of Free Wi-Fi: What a Rogue Access Point Actually Captures
Airport lounges, hotel lobbies, coffee shops, exhibition halls. Free Wi-Fi is everywhere, and most of it is fine. But the networks that hurt people are not random. They are cheap to set up, they look legitimate, and they work because the victims are in a hurry. Understanding what an attacker can actually see on an open network tells you exactly when to care and when to relax.
This is not a list of vague warnings. It is a walk through what really happens to your traffic on a hostile network, what attackers can and cannot read in 2026, and the four habits that remove almost all of the risk.
## What a rogue access point is
An access point is just a radio with a network behind it. A rogue one is an attacker’s radio, usually a pocket-sized device or a laptop with hostapd, advertising a plausible network name. “Heathrow Wi-Fi Free”, “Marriott_Guest”, “CoffeeHouse 5G”. Your phone remembers network names it has joined before, and by default it will silently reconnect to any network with the same name, no prompt, no certificate check. That is the original sin this attack relies on.
Building one costs under a hundred dollars. The hardware fits in a jacket pocket. Captive portals are trivial to clone, because a login page asking for a room number and surname has no way to prove it belongs to the hotel.
## What the attacker actually sees
Here is the part most people get wrong, in both directions. Some of your data is wide open. Most of it is not.
**Completely visible: every site you visit that is not HTTPS.** The moment you connect, the network sees DNS queries, which reveal every domain you look up, and any plain HTTP page you load in full. In 2026 this is a smaller footprint than it used to be, since over 90 percent of page loads across the web now use HTTPS. But it is never zero. Some hotel portals, some old internal tools, some redirect chains and some apps still leak. Each plain HTTP request is readable, editable, and replayable by anyone on the network.
**Partially visible: your TLS traffic, and it leaks more than you think.** Even on HTTPS, the network sees the destination IP, the Server Name Indication field (which names the exact host, mail.opticflux.com style), and packet timing and sizes. Timing and size analysis can often fingerprint which sites you are browsing even when content is encrypted. A short burst to a specific news domain looks nothing like a long video stream to another.
**Fully protected from passive listening: content inside TLS.** Your passwords, messages and page contents inside a properly negotiated HTTPS session are not readable by a passive observer, full stop. Anyone claiming an attacker “sees everything” on open Wi-Fi is overstating it. The real attacks do not try to break TLS. They try to get around it.
## The three attacks that actually work
**Evil twin capture.** You join the attacker’s clone of the real network. Everything you send passes through their device. HTTPS still protects content, but now the attacker controls DNS, so they can point “yourbank.com” anywhere they like. Browsers fight back with certificate errors, and certificate warnings are the moment most people click through without reading. Every browser warning dialog ever studied shows a substantial fraction of users clicking “proceed”.
**SSL stripping, the old reliable.** Downgrade tools sit between you and the site, rewriting HTTPS links to HTTP before you notice. Modern browsers mark sites HSTS-preloaded as HTTPS-only and refuse, which has largely killed this attack for major sites. It still works against smaller sites, internal portals, and anything you access by typing a bare domain into a bar that guesses HTTP first.
**The captive portal credential harvest.** The simplest and still the most profitable. The fake network shows a professional login page and collects whatever you type: email plus password, or room number plus surname, or a “sign in with Google” page that is an exact visual clone of the real one. The password is the prize, because people reuse it. A random network sees nothing. A cloned portal sees exactly what you volunteer.
## Who gets hit, in practice
The realistic victim profile is not the person browsing news on HTTPS. It is the person who types credentials into a portal that lied, reuses that password at their bank, checks mail over a corporate VPN whose client silently failed to connect, or uses an app that quietly falls back to HTTP for images or analytics. Travelers are the prime target, because jet lag lowers vigilance and foreign network names all look equally plausible.
## The four habits that fix this
**1. Stop letting your phone auto-join open networks.** On iOS, Settings, Wi-Fi, tap the information icon on each remembered open network and disable Auto-Join. On Android, disable “Turn on Wi-Fi automatically” and forget networks you no longer use. This single setting defeats the silent evil-twin reconnect.
**2. Treat certificate warnings as hard stops.** A browser screaming about an invalid certificate for a site you are logging into is not a nuisance. It is the attack failing and asking you to make it succeed. Close the tab, drop the network, move on.
**3. Use a VPN on hostile networks, and verify it connected.** A VPN moves the trust decision from “is this network honest” to “is my VPN provider honest”, and collapses all DNS and SNI leakage into one encrypted tunnel. The verification step matters: VPN clients fail silently all the time. Confirm the tunnel is up before doing anything sensitive, because a VPN that failed to connect while you assumed it was protecting you is worse than no VPN, since it changes nothing except your confidence.
**4. Never type a real password into a captive portal.** Portals get room numbers, not credentials. If a portal demands an email login you do not recognise, ask the staff what the real network is called. If you must register for access, use an alias address that unlocks nothing for an attacker.
## When you can genuinely relax
Reading major news sites, streaming video from big platforms, scrolling social apps that pin their certificates, all over HTTPS on a random coffee shop network, is low risk in 2026. The passive eavesdropper of the 2000s is largely obsolete. The threat that survived is the active one: the network that lies to you about who it is, and harvests what you type. That threat is defeated by attention, not by fear.
Free Wi-Fi does not need to be avoided. It needs to be treated as what it is: a stranger’s network, where content is private but behaviour is visible, and where the only thing that can hurt you is information you volunteer.
