Safe Public WiFi Usage

On a typical open or PSK guest network, stations associate to one AP (or a roaming set) and receive leases in the same subnet. Broadcasts (ARP, some mDNS/SSDP) can reach other stations. Historically, that made LAN attacks and sniffing easier. Modern APs often enable client isolation (AP/client isolation, "guest mode") so stations cannot talk to each other — but you must not assume it. Isolation is an operator setting, not a law of physics. What you are allowed to do as a learner: look at YOUR IP, YOUR gateway, YOUR DNS, YOUR HTTPS to example.com. What you are not allowed to do: nmap 192.168.x.0/24 "to see who is here," tcpdump the café adapter in promiscuous mode, deauth anyone, or clone the AP. Those are attacks or interception, even if you tell yourself it is homework. Shared L2 is a reason to harden YOUR shares and YOUR browser, not a lab full of targets.

An evil twin is an access point that advertises a name people will click: Airport_Free, Hotel-Guest, the café's name with one letter off, or the exact SSID if the attacker is close. Phones that auto-join known names are especially easy to lure. Once you associate, your traffic goes through their radio first. They can present a fake captive portal, downgrade you toward HTTP, or wait for a certificate warning you click through. HTTPS to the real name still encrypts to that name — unless you ignore warnings or type the wrong name. Defense is boring and effective: confirm the exact SSID with staff or the receipt/table tent; turn off auto-join for open networks; prefer your phone's cellular hotspot for banking; do not install "Wi-Fi booster" profiles or random certificates a portal offers. A profile that adds a trusted CA is how an attacker becomes HTTPS in your browser. You do not need to run attack tools to understand this. You need to refuse the look-alike network.

Hotels and cafés often intercept your first HTTP request and show a login/accept page (captive portal) until you click through. The real ones ask you to accept terms or enter a room number. Hostile ones ask for email, a password you use elsewhere, a credit card "for verification," or a software download. The mechanism is: until the AP authorizes your MAC, your DNS or HTTP is redirected to their portal host. After you authenticate, you get a normal default route — still on their LAN. Use the portal only to get connectivity, with a throwaway email if they demand one, never your bank password, never a client certificate you did not expect. If the browser screams about TLS on the portal, stop and ask staff. Some real portals use ugly HTTP; that is a reason to finish the click and then use only HTTPS (and a VPN) afterward — not a reason to type secrets into the portal. Bookmarking the real airline or bank URL still matters after you are "online."

TLS does not care whether the LAN is a café. If you reach https://bank.example and the certificate matches, on-path café observers should not read the password. If you reach http://anything, they might. If you reach https://bank-secure-login.example (wrong name, valid cert), they also cannot read it — but you just logged into a phish. HTTPS-Only from the last lesson plus checking the name is the baseline on public Wi-Fi. A VPN adds the extra hop so the café mostly sees vendor traffic, not your inner destinations. It still does not stop phishing, malware, or a bad password. It is not a reason to nmap anyone. For banking, payroll, or medical portals, prefer cellular data or a hotspot you own. You skip the shared L2, the evil twin SSID, and the portal entirely. If cellular is dead, VPN on a verified SSID plus HTTPS plus a dedicated banking profile is the fallback — still not "I hacked the hotspot so it is safe."

Do this at home or on a network you own, as rehearsal — or on public Wi-Fi as a guest doing only your own settings. You are not mapping the LAN. If you need to see YOUR address, ip/ifconfig/ipconfig on your machine is enough. Stop there.

ip -br addr
ip route | head

ifconfig | head

curl -I https://example.com
curl -sS --max-time 10 https://ifconfig.me

mkdir -p "$HOME/cyberlium-lab"
{
  echo "date: $(date -Iseconds 2>/dev/null || date)"
  echo "ssid_confirmed_with_staff_or_rehearsal: yes/no"
  echo "auto_join_open_disabled: yes/no"
  echo "sharing_locked_down: yes/no"
  echo "https_only_on: yes/no"
  echo "banking_plan: cellular / hotspot / vpn+https+profile"
  echo "did_I_nmap_or_capture_others: NO"
} > "$HOME/cyberlium-lab/public-wifi.txt"
chmod 600 "$HOME/cyberlium-lab/public-wifi.txt"

You can explain shared L2 without treating neighbors as lab targets, refuse look-alike SSIDs and greedy portals, keep HTTPS (and the name check) on public networks, prefer cellular for banking, and use a VPN as an extra hop — never as antivirus or a hunting license. Next — Lab — Privacy Score — curl and dig on YOUR connection, a browser padlock/cookie checklist, notes in privacy-score.txt, still zero scans of the café.