What has changed, and what hasn't
A decade ago, someone on the same cafe network could read unencrypted traffic, including passwords for some websites. Today almost every site and app uses encrypted connections, so the classic eavesdropping risk is much lower. Microsoft 365, Google Workspace, Xero and online banking all encrypt everything between your device and their servers.
What hasn't changed is that public networks are shared with strangers and run by people you don't know. The risks now come mainly from fake networks, fake sign-in pages, devices exposing shared folders or services to the network, and people being tricked rather than eavesdropped on. It's also worth remembering that the person running the network can see which websites you visit, even when they can't see what you do on them. For most work that doesn't matter, but for sensitive client matters or commercial negotiations, some businesses prefer staff to avoid shared networks altogether.
Fake hotspots and evil twins
Anyone can set up a Wi-Fi network called 'Airport Free WiFi' or the name of the cafe you're sitting in. If your laptop connects to it, the attacker controls the connection. They can't easily break encrypted traffic, but they can show a fake 'log in to continue' page asking for your email and password, or redirect you to lookalike sites. Check the exact network name with staff at the venue, avoid networks with generic names, and be wary of a captive portal that asks for anything more than accepting terms or entering a room number. A Wi-Fi sign-in page should never ask for your work email password.
Keeping the laptop itself safe
On public networks, your device is the main line of defence. Make sure the operating system and browser are fully updated, the firewall is on, and endpoint protection is running. When Windows asks whether a network is public or private, choose public, which hides the laptop from other devices on the network. Turn off file and printer sharing on public networks and don't leave remote access tools listening for connections. Encrypt the laptop's drive with BitLocker or FileVault, so if it's lost or stolen in a cafe or airport, the data on it stays unreadable.
When a VPN helps and when it doesn't
A business VPN encrypts all traffic from the laptop back to your office or a security service, so nothing on the public network can see where you're going. It's useful when staff need to reach systems in the office, such as a file server or accounting database, or when you want all traffic filtered by the company's web security regardless of location.
Consumer VPN apps advertised for privacy are a different thing and don't automatically make work safer. For cloud services that already encrypt traffic, the extra benefit is smaller than the marketing suggests. Talk to your IT provider about whether a managed VPN or a modern zero-trust access service suits your setup.
Phone hotspots are usually the better option
Tethering a laptop to a work phone's mobile data creates a private network that only you control. With unlimited or generous data plans now common in New Zealand, it's often the simplest safe choice for staff who work on the move. It also avoids unreliable cafe connections dropping out halfway through a Teams call. Set a strong hotspot password and turn the hotspot off when you're done. For staff who travel often, check the mobile plan includes enough data, and consider international roaming arrangements before overseas trips.
Simple rules for staff on the road
Agree a few rules and write them down. Use a phone hotspot for banking, payroll or anything involving client personal information. Never enter a work password on a Wi-Fi sign-in page. Lock the screen every time you step away. Don't use public computers in hotels or libraries to access work email at all. Watch out for shoulder surfing on planes, trains and in cafes. A privacy screen filter on a laptop is inexpensive and stops people nearby reading what's on screen. Take calls involving sensitive client matters somewhere private.
What the business should set up centrally
Device management lets you enforce encryption, updates, firewalls and screen locks on every work laptop and phone, wherever it is. Multi-factor sign-in and conditional access rules mean a stolen password is far less useful, even if a fake hotspot captures one. Web filtering that works off the office network protects people at the cafe as well as at their desk. These are the same controls that protect remote and hybrid workers generally, so they're worth having whether or not staff use public Wi-Fi often.
In short
- Public Wi-Fi is safer than it was, but fake hotspots and sign-in pages remain.
- Never enter a work password on a Wi-Fi sign-in page.
- Set public networks to 'public' and keep devices updated and encrypted.
- A phone hotspot is the simple safe choice for sensitive work.
- Device management and multi-factor sign-in protect staff anywhere.