# Hotel and public Wi-Fi — the network you joined was built to watch you > Hotel, airport and café Wi-Fi is somebody else's network, run for somebody else's purposes. It knows your room number, your device, every name you look up, and it can show you a login page of its choosing. Encryption has closed most of the old coffee-shop attacks, so the real risk is no longer a stranger reading your mail. It is the network itself: what it logs, what it ties to your identity, and the one moment it can put a fake page in front of you. Markdown twin of https://xmr.club/opsec/21-hotel-public-wifi. CC-BY-4.0. Attribute "xmr.club". ## At a glance - Canonical: https://xmr.club/opsec/21-hotel-public-wifi - Series: #OPSEC52 — weekly threat-model-first OPSEC cards - Week: 21 - Pillar: Travel & border - Difficulty: beginner - Cost: $0–$10/mo - Language: en - Published: 2026-10-12 ## Body # OPSEC52 / Week 21 — Hotel and public Wi-Fi: the network you joined was built to watch you > Hotel, airport and café Wi-Fi is somebody else's network, run for somebody else's purposes. Encryption has closed most of the old coffee-shop attacks. The real risk is the network itself: what it logs, what it ties to your identity, and the one moment it can put a fake page in front of you. **Threat model:** the network operator and whoever rents or compromises it; captive portals that tie a session to your name or room; DNS and connection logs that outlive your stay; evil-twin access points; and other devices on the same network. ## What changed, and what didn't Ten years ago the classic advice was "someone at the next table can read your email". That is mostly over: nearly every site and app now encrypts its traffic, so a passive eavesdropper on a café network sees where you connect, not what you say. What has not changed is who owns the network. A hotel Wi-Fi login often asks for your **room number and surname** — which joins every connection that follows to your passport at the front desk. The operator (frequently an outsourced Wi-Fi company serving hundreds of hotels) sees the **names you look up** (DNS), **when and how long** you were online, and **your device's hardware address**. That is a tidy, timestamped log of you, held by a company you never chose, in a country whose rules you may not know. ## The three real risks **1. The captive portal.** The "accept terms" page is the one point where the network gets to show you a page of its own choosing. A malicious or compromised portal can ask you to "sign in with Google", "update the network driver" or install a "security certificate". None of those are ever needed to get online. The only acceptable portal interaction is: tick a box, type the room number, done. **2. The evil twin.** Anyone can broadcast a network called `Hotel_Guest` or `Airport Free WiFi`. Your phone may join it automatically because it remembers the name. The twin cannot read encrypted traffic, but it controls your DNS and can serve its own captive portal — see risk 1. **3. The log that outlives you.** Even an honest network keeps connection and DNS logs. If someone later asks "which guest in room 412 looked up this exchange at 02:10?", the answer may exist. ## How to apply it today - **Put everything inside a tunnel you chose.** A reputable VPN (Week 1) turns the hotel's view of you into one encrypted connection to one server. Connect it *right after* the captive portal, before opening anything else, and turn on the kill switch so nothing leaks while it reconnects. - **Or use your own connection.** A phone hotspot on a local or travel eSIM (bought without ID where possible — see Week 4) skips the hotel network entirely. For sensitive work this is often simpler than trusting a VPN on hostile Wi-Fi. - **Encrypt your DNS.** Turn on DNS over HTTPS in the browser or the system (Week 17). Without it, even a VPN-less session tells the network every site you visit by name. - **Give the portal as little as possible.** Use a surname-only login if the portal accepts it. Never sign in with a social account, never install anything, never accept a certificate or profile it offers. - **Randomize your hardware address.** Modern iOS and Android use a private MAC per network by default; check it is on, and on laptops turn on random hardware addresses. It stops your device being recognised from one hotel to the next. - **Forget the network when you leave**, and turn off auto-join for open networks. That removes the evil twin's easiest trick. - **Firewall on, sharing off.** On a shared network your laptop is reachable by every other guest. Turn off file sharing, AirDrop to "contacts only" or off, and keep the system firewall on. ## For crypto users specifically Do not run a full node, wallet sync or exchange session on hotel Wi-Fi without a tunnel: the DNS names alone (an exchange, a node endpoint, a block explorer) are a strong signal of what you hold. If you must transact while travelling, do it over your own hotspot plus a VPN or Tor, and never type a seed phrase on any device connected to a network you do not control. ## Common mistakes - **"It has a password, so it's safe."** A Wi-Fi password printed on the room card is shared with every guest. It protects the hotel from the street, not you from the hotel. - **Opening the laptop and letting everything sync first.** Mail, cloud drives and messengers reconnect the instant Wi-Fi comes up — before your VPN does. Bring the VPN up first, or use the kill switch. - **Trusting the portal because it looks professional.** Portals are easy to copy. The test is not how it looks but what it asks for. ## This week's move Before your next trip, set this up once and test it at home: 1. VPN installed, kill switch on, set to connect automatically on untrusted networks. 2. DNS over HTTPS on in your browser. 3. Private/random hardware address on for Wi-Fi on every device. 4. Auto-join for open networks off; firewall on; sharing off. On the road: join, pass the portal with the minimum, tunnel up, then everything else. --- *Curated by [Cyber Satoshi](https://x.com/xbtoshi). Part of OPSEC52 — 52 weeks, 52 privacy pillars, threat-model first. See also Week 1 (VPN exit discipline), Week 4 (phone compartmentalization), Week 17 (DNS leakage) and Week 20 (border device searches).* ## Related - HTML: https://xmr.club/opsec/21-hotel-public-wifi - Series index: https://xmr.club/opsec - Twin index: https://xmr.club/llm/opsec.txt