3.2Public Wi-Fi & VPN
The essentials in 30 seconds
- Public Wi-Fi = open: observable traffic and risk of a fake access point with a generic name.
- Systematic corporate VPN on unmanaged networks: it encrypts all traffic (HTTPS only protects one site).
- Traveller hierarchy: 1) 4G/5G tethering, 2) Wi-Fi + VPN, 3) never public Wi-Fi without VPN for work.
Running mini-case — Karim works from a café
Karim, an office employee in Algiers, must send a file from a café's Wi-Fi between two appointments. Instead of connecting directly, he enables his phone's 4G/5G tethering; when he really must use public Wi-Fi, he first enables the corporate VPN and checks the exact network name with the staff. Simple doctrine: never work on an unmanaged network without a tunnel.
This same case returns in the lesson, the diagram, the script and the 48h challenge.
1. Public Wi-Fi is open
A public Wi-Fi (café, station, airport) is by nature unencrypted between you and the access point: all non-HTTPS traffic there is observable. An attacker can also set up a fake access point (“evil twin”) with a generic name to route all your traffic through them.
Reflexes: disable automatic connection to open networks on all devices, distrust generic names and ask for the exact Wi-Fi name at reception.
2. VPN and the traveller hierarchy
The defense: the systematic corporate VPN on any unmanaged network — it encrypts all your traffic. HTTPS (padlock) protects the content of one site even on a dubious network; the VPN protects all traffic: the two complement each other, and VPN remains the standard for business data.
The hierarchy: 1) 4G/5G tethering for sensitive operations (often safer), 2) public Wi-Fi + VPN, 3) never public Wi-Fi without VPN for work. For work, only the corporate VPN — no free VPN.
🔎 Concrete example — The travelling worker protocol
Karim applies the hierarchy, even in a hurry.
Corporate VPN: know how to enable it (tested from home).
Disable auto-connect to open Wi-Fi.
Evil twin: ask staff for the EXACT Wi-Fi name.Reading: 4G/5G first, otherwise Wi-Fi + VPN, never without VPN.
Lesson: a generically named network is a possible trap.
Section vocabulary
- Public Wi-Fi
- Network shared with strangers (station, hotel, café): treat as observable by equipped onlookers.
Simple example: The café Wi-Fi where Karim must send his file.
What it is not: the corporate network managed by IT.
Reflex: never work on it without VPN.
- Fake access point (evil twin)
- Rogue hotspot with a generic name: all connected users' traffic passes through the attacker.
Simple example: A “Free_Café_WiFi” set up next to the real one.
What it is not: the real access point given by reception.
Reflex: ask for the exact name before connecting.
- HTTPS
- Encryption between the browser and the site (padlock): protects content even on a dubious network.
Simple example: Check the padlock before entering a password.
What it is not: protection for all traffic.
Reflex: check it on every sensitive site.
- VPN
- Encrypted tunnel protecting all traffic: mandatory on unmanaged networks, via the corporate one.
Simple example: Karim enables the corporate VPN before opening his files.
What it is not: a free VPN for business data.
Reflex: VPN on before any work app.
- Tethering (4G/5G)
- Phone used as a modem: often safer than public Wi-Fi, the right reflex on the move.
Simple example: Karim sends his file via his 4G/5G tethering.
What it is not: open Wi-Fi without VPN.
Reflex: tethering first for sensitive operations.
In practice — The travelling worker protocol
- Check your corporate VPN: do you know how to enable it? Test it from home (icon, connection, verification).
- Set your devices: disable automatic connection to open Wi-Fi (phone AND laptop).
- Adopt the traveller hierarchy: 1) 4G/5G tethering, 2) public Wi-Fi + VPN, 3) never public Wi-Fi without VPN for work.
- On the move, distrust generically named networks: ask reception for the EXACT Wi-Fi name (against the evil twin).
Ready-to-say script — check before connecting (20 s)
“Hello, what is the exact name of your Wi-Fi? I enable my corporate VPN before working — otherwise I use my phone's tethering.”
Say at reception; never connect to an approximate or generic name.
Copy-paste template — traveller checklist
CORPORATE VPN TESTED (yes/no): _______________
AUTO-CONNECT DISABLED (phone + PC): _______________
NETWORK CHOSEN (4G/5G > Wi-Fi+VPN > never without VPN): _______________
EXACT NAME CHECKED AT RECEPTION: _______________Micro-business / freelancer
Without a corporate VPN: 4G/5G tethering by default and HTTPS checked everywhere; plan a supervised VPN solution before sensitive trips.
SME Algeria
Karim tests his corporate VPN from home before the trip: on D-day, he can enable it without fumbling.
Office / employee
Apply the policy: mandatory VPN on unmanaged networks, often a written obligation, not an option.
Beginner
One reflex this week: disable auto-connect to open Wi-Fi on phone and laptop.
✓ Best practices
- Enable the corporate VPN on any unmanaged network.
- Prefer 4G/5G tethering for sensitive operations.
- Disable automatic connection to open Wi-Fi.
✗ Common pitfalls
- Working on public Wi-Fi without VPN.
- Connecting to a generically named network (evil twin).
- Using a free VPN for work (the corporate VPN is required).
Key takeaways
- On public Wi-Fi, assume someone may be watching: mandatory VPN for work.
- 4G/5G tethering beats public Wi-Fi in most cases.
- Disable automatic connection to open networks on all your devices.
- HTTPS protects the content of one site, VPN protects all traffic: the two complement each other.
48h challenge — apply tomorrow
Test your corporate VPN from home and disable auto-connect on both devices.
- I can recite the hierarchy (4G/5G > Wi-Fi+VPN > never without).
- I can enable my corporate VPN.
- I disabled auto-connect to open networks.
Frequently asked questions
Will a free VPN do the job?
For work: no — use only the corporate VPN. Personally, beware: a free VPN often lives off your data (reversing the problem). Reputable paid VPNs are a better personal option.
With HTTPS everywhere, is VPN still useful?
HTTPS reduced the risk of intercepted content, but public Wi-Fi still exposes metadata, captive traps and misconfigured devices. For business data, the full tunnel remains the standard — and often a policy obligation.
Karim must work from public Wi-Fi. What to do?