Public Wi-Fi Safety and What Encryption Covers
Public Wi-Fi turns up in coffee shops, malls, airports and hotels, among other places. In the past, information sent over such a network was at risk, because most websites did not scramble it against hackers snooping on the network. The change the FTC describes is on the websites’ side.
The FTC says connecting through a public Wi-Fi network is usually safe, because most websites now use encryption to scramble data as it travels. A lock symbol or https in the address bar, to the left of the website address, is how that encryption shows up. The FTC also names protections that apply no matter how someone gets online.
Why Public Wi-Fi Risk Looks Different Now
When a device connects to a website, information travels from the device to the website. That information can include the log in information for financial, email, or social media accounts.
In the past, information sent over a public Wi-Fi network was at risk. Most websites did not use encryption to scramble the data and protect it from hackers snooping on the network.
Today most websites do use encryption. Because of that widespread use, the FTC says connecting through a public Wi-Fi network is usually safe.
The difference between then and now, in that description, sits on the websites themselves.
What the Lock Symbol Tells You, and What It Reports On
The lock symbol, or https in the address bar to the left of the website address, is how a person can see that the connection is encrypted. This works on a mobile browser too.
It can be hard to tell whether a mobile app uses encryption, but the majority do.
The lock reports on the trip the data takes. It does not report on who is waiting at the other end of that trip, and that distinction is easy to lose.
Scammers create fake websites and encrypt them. Data may be encrypted on its way to such a site and still not be safe from the scammers operating the site.
So a lock symbol on a scammer’s page is accurate about one thing and silent about another. The scrambling happened. The destination was still theirs.
Where Each Protection Stops
A strong password is one that is hard to guess, and keeping it secure is an important first line of defense against hackers.
First line is the operative phrase. Hackers have tactics that step around it. The FTC describes phishing attacks that trick people into giving up their login credentials, and scammers also buy credentials stolen in data breaches and use them on the account where the breach happened.
Then the same stolen pair gets tried elsewhere. That works when the same username and password were reused on another account.
Even without the password there is a path. If hackers have only the username, software can guess the password, when the site has no safeguard to detect that kind of attack.
Two-factor authentication answers a narrower question: whether the person logging in can produce a second kind of credential. The FTC sorts authentication factors into three categories.
Something you know, like a password or a PIN. Something you have, like a one-time verification passcode you get by text, by email, or from an authenticator app, or a security key. Something you are, like a fingerprint, a face, or a retina.
Accounts with two-factor authentication require a credential from two of the three categories to log in. A hacker who steals a password cannot log in to the account without the second authentication factor.
The FTC discusses all three protections; this table compares the particular risk each one addresses with a separate risk it does not resolve.
| Protection | What it addresses | What it does not reach |
|---|---|---|
| Encryption in transit (the lock symbol or https) | Someone on the network reading the data as it travels | A site the scammers run themselves, which they encrypt too |
| A strong password | Making a password hard for guessing software to find | Credentials given up through phishing, or bought after a breach |
| Two-factor authentication | A thief who has the password but not the second factor | Depends on the second factor — a text-message code reaches whoever has taken over the phone number |
Each protection addresses a specific risk, while the third column shows a different risk that remains. That third column is the substance of it: each row names a risk that its own protection does not resolve.
The last row has a mechanism behind it. A verification passcode by text message or email is the most common type of two-factor authentication, according to “Protect Your Personal Information From Hackers and Scammers.” It is typically six digits long but can be longer, is good for one login, and expires automatically.
For a passcode sent by text message, the drawback is the phone number. A SIM card swap attack lets someone take over the number and receive the code.
A passcode sent by email sits behind a different door. Whoever gets into the email account gets the code with it, and the FTC names a strong password and two-factor authentication on the email account itself.
There is a plainer route too. Scammers try to trick people into handing over the verification passcode itself, and the FTC draws the line at contact that did not begin with the account holder. The FTC’s line is drawn at who started the contact, not at how convincing the story is.
More and more sites and apps offer two-factor authentication. Some let a person choose which method to use; others give one option only.
An authenticator app is safer than a passcode arriving by text or email, because its passcode is not susceptible to a SIM card swap attack or to someone hacking an email account. The same page describes an authenticator app or a security key as a more secure type of two-factor authentication.
Other Risks and Protections the FTC Names
Encryption covers the data on its way to a site. The identity of whoever runs that site sits outside what encryption can say.
Scammers may pretend to represent a well-known company or the government, including in government impersonation scams.
Scammers send phishing emails or text messages carrying a link or an attachment that downloads malware. The FTC sets that against contacting the company through a phone number or website already known to be real.
Criminals look for weak points to exploit before software companies can fix them, and the FTC pairs that with updating as soon as a newer version comes out. Software updates often contain critical patches and protections against security threats.
The FTC names steps that apply no matter how someone gets online. Among them: strong passwords, two-factor authentication, and keeping security software, the operating system, and the internet browser up to date. It also names updating a phone’s operating system, turning on automatic updates, and recognizing scammers.
They are named as steps for any connection.
Encryption in transit is a real protection, and where a website uses it the scrambling is real. What it does not settle is who runs the site at the far end. That part was never what the lock symbol was reporting on.