Public Wi-Fi Risks: What Actually Happens on an Open Network

The core risk of an open (unencrypted) public Wi-Fi network is traffic interception: because the wireless link has no encryption, anyone in radio range can capture the frames you transmit and read whatever isn’t separately protected. That single weakness enables packet sniffing, credential theft, session hijacking, and on-path (man-in-the-middle) attacks. The standard mitigation is to establish a Virtual Private Network (VPN) tunnel before touching any sensitive resource, so your traffic is encrypted end-to-end regardless of what the hotspot does.

Why “open” is the operative word

Wi-Fi networks come in two broad flavors. A protected network — one using Wi-Fi Protected Access 2 (WPA2) or WPA3 — encrypts every frame between your device and the access point. An open network skips that step entirely: your device associates with the access point and starts transmitting in cleartext. The coffee shop’s captive portal page asking you to accept terms is not encryption; it’s just a web page. Once you’re past it, your wireless traffic is still traveling through the air unprotected.

That matters because Wi-Fi is a broadcast medium. Unlike a switched wired network, where traffic is directed to a specific port, radio signals reach every antenna within range — the defining trait of the wireless attack surface. An attacker with a laptop and a wireless card in monitor mode can passively record everything transmitted on the channel — no connection to the network required, and nothing for you to detect. This passive eavesdropping is the baseline threat; everything else builds on it.

The attack chain on an open hotspot

Packet sniffing. Free tools capture raw wireless frames. Any protocol that runs without its own encryption — plain HTTP, unencrypted email retrieval, legacy file transfers, some chat and IoT protocols — hands the attacker its full contents: URLs, cookies, form data, credentials.

Session hijacking. Even when a login page itself is protected, a site that later sends session cookies over an unencrypted connection lets an attacker copy the cookie and impersonate the logged-in user. Modern sites largely prevent this with HTTPS everywhere, but internal tools and older applications still slip.

Evil twin access points. An attacker stands up a rogue access point broadcasting the same network name (SSID, or Service Set Identifier) as the legitimate hotspot — “CoffeeShop_Free” — often with a stronger signal. Devices configured to auto-join known networks connect without the user doing anything. Now the attacker isn’t just listening; they are the network, and every packet flows through hardware they control.

On-path attacks. Once positioned between you and the internet — via an evil twin, or via Address Resolution Protocol (ARP) spoofing on the legitimate network — the attacker can read, modify, or inject traffic. Classic moves include downgrading connections, serving fake login pages, tampering with downloads, and redirecting Domain Name System (DNS) queries to attacker-controlled servers, a form of DNS poisoning and hijacking.

Peer-to-peer exposure. On a hotspot with no client isolation, your laptop sits on the same local network as every stranger in the room. Open file shares, unpatched services, and chatty discovery protocols become directly reachable attack surface.

What HTTPS covers — and what it doesn’t

A common objection: “everything is HTTPS now, so open Wi-Fi is fine.” Hypertext Transfer Protocol Secure (HTTPS) genuinely encrypts the content of each web session, and it blunts many of the attacks above. But it is per-connection protection, not network protection, and the gaps are exactly what the exam probes.

Protection	HTTPS alone	VPN tunnel
Web page contents encrypted	Yes, per site	Yes, everything
Non-web traffic (email clients, apps, legacy protocols)	Not covered	Encrypted inside tunnel
DNS queries hidden from local network	Usually visible	Hidden
Sites you visit hidden (metadata)	Domain still exposed via SNI/DNS	Hidden from hotspot
Protects against evil twin reading traffic	Content yes, metadata no	Yes
Fake captive portal / phishing page	No — user can still be fooled	No — still a user-awareness issue

The takeaway: HTTPS narrows the damage but leaves metadata, DNS, and non-browser traffic exposed. A VPN wraps all of it in one encrypted tunnel to a trusted endpoint, which is why corporate policy for remote and traveling workers is “VPN first, then work.” Certificate warnings are the other tripwire — an on-path attacker intercepting Transport Layer Security (TLS) usually triggers a browser certificate error, and awareness training teaches users to treat that as a stop sign, never a click-through.

What corporate policy expects from users

Security awareness programs — this topic sits in the Security Program Management and Oversight domain for a reason — translate the technical risks into a short list of user behaviors:

• Connect to the company VPN before accessing any corporate resource on an untrusted network. Not after checking email “real quick” — before.
• Prefer a personal mobile hotspot or tethered phone connection over open Wi-Fi when handling sensitive data; cellular data is encrypted at the link layer.
• Disable auto-join for open networks so your device can’t be lured by an evil twin broadcasting a remembered SSID.
• Verify the exact network name with staff; attackers rely on plausible lookalike SSIDs.
• Turn off file sharing and mark the network as public/untrusted in the operating system so the local firewall tightens up.
• Never bypass certificate warnings on a public network.

These expectations usually appear in an Acceptable Use Policy (AUP) or remote-work policy and are reinforced in training for hybrid workers — see Security Awareness for Remote and Hybrid Work for the broader program.

How the SY0-701 exam tests this

• A scenario describes an employee on free coffee-shop Wi-Fi and asks for the primary risk. Distractors include malware infection, weak passwords, or shoulder surfing; the credited answer centers on interception/eavesdropping of unencrypted traffic or an on-path attacker.
• A hybrid worker is about to open corporate email at a café, and the question asks what to do first per policy. The answer is establishing the VPN connection before accessing company resources — not “use incognito mode” or “check for HTTPS.”
• A user finds two similarly named hotspots and connects to the stronger one, then sees certificate warnings. The exam wants you to identify an evil twin and recognize the warning as evidence of interception, not something to accept.
• A question contrasts open Wi-Fi with WPA3 or cellular tethering and asks which behavior best reduces exposure — the discrimination being that link-layer encryption (or a VPN) is the fix, while captive portals and browser privacy modes are not.

The VPN-first policy answer is a gift once you recognize it — practice questions train that recognition.

Quick reference

• Open Wi-Fi = no link-layer encryption; all traffic is capturable by anyone in radio range.
• Primary risk: interception/eavesdropping, which enables credential theft, session hijacking, and on-path attacks.
• Evil twin = rogue access point cloning a legitimate SSID to become the on-path device.
• HTTPS protects individual sessions’ content, but not DNS, metadata, or non-web protocols.
• Policy answer for any “before accessing company resources on public Wi-Fi” question: connect the VPN first.
• Disable auto-join, verify SSIDs, treat certificate warnings as attacks in progress.
• A personal cellular hotspot is safer than any open Wi-Fi network.