OPSEC52 / Week 21 — Hotel and public Wi-Fi: the network you joined was built to watch you

Hotel, airport and café Wi-Fi is somebody else’s network, run for somebody else’s purposes. Encryption has closed most of the old coffee-shop attacks. The real risk is the network itself: what it logs, what it ties to your identity, and the one moment it can put a fake page in front of you.

Threat model: the network operator and whoever rents or compromises it; captive portals that tie a session to your name or room; DNS and connection logs that outlive your stay; evil-twin access points; and other devices on the same network.

What changed, and what didn’t

Ten years ago the classic advice was “someone at the next table can read your email”. That is mostly over: nearly every site and app now encrypts its traffic, so a passive eavesdropper on a café network sees where you connect, not what you say.

What has not changed is who owns the network. A hotel Wi-Fi login often asks for your room number and surname — which joins every connection that follows to your passport at the front desk. The operator (frequently an outsourced Wi-Fi company serving hundreds of hotels) sees the names you look up (DNS), when and how long you were online, and your device’s hardware address. That is a tidy, timestamped log of you, held by a company you never chose, in a country whose rules you may not know.

The three real risks

1. The captive portal. The “accept terms” page is the one point where the network gets to show you a page of its own choosing. A malicious or compromised portal can ask you to “sign in with Google”, “update the network driver” or install a “security certificate”. None of those are ever needed to get online. The only acceptable portal interaction is: tick a box, type the room number, done.

2. The evil twin. Anyone can broadcast a network called Hotel_Guest or Airport Free WiFi. Your phone may join it automatically because it remembers the name. The twin cannot read encrypted traffic, but it controls your DNS and can serve its own captive portal — see risk 1.

3. The log that outlives you. Even an honest network keeps connection and DNS logs. If someone later asks “which guest in room 412 looked up this exchange at 02:10?”, the answer may exist.

How to apply it today

• Put everything inside a tunnel you chose. A reputable VPN (Week 1) turns the hotel’s view of you into one encrypted connection to one server. Connect it right after the captive portal, before opening anything else, and turn on the kill switch so nothing leaks while it reconnects.
• Or use your own connection. A phone hotspot on a local or travel eSIM (bought without ID where possible — see Week 4) skips the hotel network entirely. For sensitive work this is often simpler than trusting a VPN on hostile Wi-Fi.
• Encrypt your DNS. Turn on DNS over HTTPS in the browser or the system (Week 17). Without it, even a VPN-less session tells the network every site you visit by name.
• Give the portal as little as possible. Use a surname-only login if the portal accepts it. Never sign in with a social account, never install anything, never accept a certificate or profile it offers.
• Randomize your hardware address. Modern iOS and Android use a private MAC per network by default; check it is on, and on laptops turn on random hardware addresses. It stops your device being recognised from one hotel to the next.
• Forget the network when you leave, and turn off auto-join for open networks. That removes the evil twin’s easiest trick.
• Firewall on, sharing off. On a shared network your laptop is reachable by every other guest. Turn off file sharing, AirDrop to “contacts only” or off, and keep the system firewall on.

For crypto users specifically

Do not run a full node, wallet sync or exchange session on hotel Wi-Fi without a tunnel: the DNS names alone (an exchange, a node endpoint, a block explorer) are a strong signal of what you hold. If you must transact while travelling, do it over your own hotspot plus a VPN or Tor, and never type a seed phrase on any device connected to a network you do not control.

Common mistakes

• “It has a password, so it’s safe.” A Wi-Fi password printed on the room card is shared with every guest. It protects the hotel from the street, not you from the hotel.
• Opening the laptop and letting everything sync first. Mail, cloud drives and messengers reconnect the instant Wi-Fi comes up — before your VPN does. Bring the VPN up first, or use the kill switch.
• Trusting the portal because it looks professional. Portals are easy to copy. The test is not how it looks but what it asks for.

This week’s move

Before your next trip, set this up once and test it at home:

1. VPN installed, kill switch on, set to connect automatically on untrusted networks.
2. DNS over HTTPS on in your browser.
3. Private/random hardware address on for Wi-Fi on every device.
4. Auto-join for open networks off; firewall on; sharing off.

On the road: join, pass the portal with the minimum, tunnel up, then everything else.

Curated by Cyber Satoshi. Part of OPSEC52 — 52 weeks, 52 privacy pillars, threat-model first. See also Week 1 (VPN exit discipline), Week 4 (phone compartmentalization), Week 17 (DNS leakage) and Week 20 (border device searches).