Public Wi‑Fi is risky. Here’s how a VPN helps

I was in an airport lounge with two networks named the same thing. Same SSID, same “free” promise, different signal strength. I picked the stronger one and immediately got a captive portal that looked like it was designed in 2009.

That’s the moment I stop trusting anything.

Public Wi‑Fi isn’t dangerous because it’s “public.” It’s dangerous because you don’t control the routers, the DNS, the people on the same layer‑2 network, or the incentives of whoever set it up.

The part nobody tells you: Wi‑Fi is a local network first

When you join café Wi‑Fi, you’re not just “on the internet.” You’re on a local network with strangers. Some of them are bored. Some are curious. A few are trying things.

If you’ve ever run Wireshark on an open network, you know the vibe: ARP chatter, multicast noise, random devices announcing themselves, and the occasional printer that refuses to die. Most of that is harmless. The problem is how easy it is to mix your traffic into someone else’s.

Here are the failures I keep seeing in the wild:

• Evil twin hotspots: someone spins up an access point called “Hotel Guest WiFi” and waits for phones to auto-join. Tools like Bettercap make this annoyingly simple.
• ARP spoofing / local MITM: if client isolation is off (it often is), an attacker can shove themselves between you and the gateway and start rewriting what you see.
• DNS spoofing: even without touching packets, messing with DNS replies can push you to the wrong site, or the right-looking site.
• Captive portal weirdness: portals break HTTPS in creative ways and train people to click through certificate warnings they should never accept.

Some networks are configured well. Many aren’t.

“But everything is HTTPS now,” right?

Mostly. Not always.

Modern apps do a decent job: TLS by default, HSTS on big sites, certificate pinning in some banking apps. That blocks the easy “read your passwords in clear text” horror story.

But HTTPS doesn’t magically make public Wi‑Fi safe. It just changes the attack surface.

A few practical problems:

First, metadata still leaks. Without a VPN, the Wi‑Fi operator (or anyone who can see upstream traffic) can still learn where you’re going via DNS queries and SNI in some cases. Encrypted Client Hello is spreading, but it’s not universal, and a lot of real-world traffic still gives away enough.

Second, you still trust the network for DNS unless you force encrypted DNS (DoH/DoT) or tunnel everything. Plenty of devices fall back to plain DNS when a network does something odd. Some captive portals outright hijack DNS so their login page shows up.

Third, downgrade and nuisance attacks are real. A decent MITM setup can’t break modern TLS easily, but it can block, reset, and harass connections until an app retries in a weaker mode, or until you switch to “whatever works.” People do that. Apps do that.

And then there’s the human factor: a fake “software update” pop-up on a hotel network is surprisingly effective. No encryption protocol fixes bad clicks.

What a VPN actually changes on public Wi‑Fi

A VPN doesn’t make you invisible. It doesn’t disinfect your laptop. It does one very specific, very useful thing: it creates an encrypted tunnel from your device to a server you chose, so the local network can’t casually inspect or tamper with what’s inside.

That matters on public Wi‑Fi because it shrinks the number of places your traffic can be messed with.

On an open hotspot, a VPN helps with:

• Packet sniffing: anyone watching the Wi‑Fi sees encrypted VPN traffic, not your app traffic.
• Local MITM attempts: even if someone ARP-spoofs you, they’re mostly stuck relaying opaque packets.
• DNS games: a good VPN client routes DNS through the tunnel, so the hotspot’s DNS lies don’t land.

The catch is what it doesn’t fix.

If you install a shady root certificate because a captive portal tells you to, a VPN won’t save you. If you log into a phishing site in Safari because the URL looked fine at a glance, same story. And if your device is already compromised, the VPN is just a nicer pipe for badness.

VPNs also don’t stop tracking done at the account level. If you sign into Instagram, Instagram still knows it’s you.

Picking settings that behave on flaky Wi‑Fi

Public networks aren’t stable. They drop UDP, they rate-limit, they roam badly, and they love to pause traffic when the phone screen goes off. You feel it as latency spikes, random reconnects, and battery drain.

Latency gets weird.

Protocol choice matters more than people admit. Here’s the short version of what you’ll run into:

• WireGuard (UDP): fast, low overhead, great on decent networks. If the hotspot blocks or mangles UDP, it can stall.
• OpenVPN (TCP, often on port 443): slower, but it survives a lot of hostile Wi‑Fi because it looks like regular TLS traffic.
• Obfuscated proxies/tunnels like VLESS+REALITY or Shadowsocks-2022: not “VPN” in the classic sense, but useful when networks aggressively block or fingerprint traffic. Clients like NekoBox, Hiddify, V2RayNG, and Shadowrocket make these workable day to day.

On mobile, there’s also battery. A tunnel that reconnects every time you move from one access point to another will chew power. iOS and Android both try to be clever about background networking, and your VPN client can end up fighting the OS.

I tend to set a simple rule: on trusted Wi‑Fi at home, I’m flexible. On public Wi‑Fi, I’d rather have a slightly slower tunnel that stays up than a fast one that flaps.

If you’re shopping, look for the boring fundamentals first. DuduVPN’s feature list is where I’d start, because the details (protocol options, DNS handling, kill switch behavior) matter more than splashy claims.

Small habits that beat big promises

A VPN is a strong baseline, but public Wi‑Fi still punishes sloppy setups.

Turn off auto-join for “free” networks. Seriously. Both iOS and Android will happily reconnect to a known SSID, and that’s exactly what evil twins rely on.

Use your phone’s hotspot when it’s reasonable. LTE/5G isn’t magically safe, but you control the link and you’re not sharing layer‑2 with a room full of strangers.

Keep an eye on certificate warnings. If you see a browser warning on hotel Wi‑Fi, the correct move is to stop and figure out why, not to tap through because you’re tired.

And don’t forget the boring OS stuff: updates, disk encryption, screen lock. A VPN won’t help if someone walks off with your unlocked laptop.

If you want a deeper answer to “what happens if the VPN drops,” check a provider’s support docs before you need them. DuduVPN’s FAQ is the sort of page I skim when I’m evaluating how a service behaves under stress.

The moment you’ll notice the VPN is missing

It’s usually not when you open your email. It’s when something breaks.

You’ll join “Free_WiFi,” Slack will half-connect, your DNS will start timing out, and one app will insist you’re offline while another one works. Sometimes that’s just a bad hotspot. Sometimes it’s traffic shaping. Sometimes it’s a captive portal that didn’t trigger correctly because your phone tried to be helpful.

A VPN can actually make this easier to diagnose. If everything works the moment the tunnel is up, you’ve learned something: the Wi‑Fi is messing with more than you thought.

The annoying part is captive portals. You often have to connect without the VPN, open a browser, satisfy the portal, then turn the VPN back on. On iOS, I usually toggle Wi‑Fi off and on to force the portal page if it’s being stubborn.

Where DuduVPN fits (and how I’d use it)

If you want a set-it-and-forget-it option for travel and cafés, I’d use DuduVPN with always-on enabled, then keep the Telegram bot handy for quick account and setup actions when you’re away from your main machine.

Pricing is the other reality check. If a VPN is so expensive you won’t keep it active, you’ll end up “just this once” on open Wi‑Fi without it. DuduVPN’s pricing page is straightforward enough to make that decision without digging through fine print.

One last thing: test before you need it

Don’t wait until you’re in a noisy airport to find out your VPN can’t connect on that network. The night before a trip, connect from home, then from your phone hotspot, and make sure you know how to switch protocols if a public Wi‑Fi starts blocking or dropping traffic.