What Really Makes Open Networks Dangerous
An open network is a shared airwave. A password by itself does not make the neighbors blind: on a WPA2 network it is enough to know the shared password and intercept your handshake to decrypt the traffic, and a password written on a chalkboard is known to the whole room. Only WPA3 isolates clients from one another. On a network with no password at all there is usually no encryption at the network level whatsoever: the radio airwave is available to everyone within range of the access point, and any device with a suitable adapter can listen to the traffic passing through. A separate case is Enhanced Open (OWE): it encrypts an open network without a password, but it is still rare, and it is not worth relying on its presence. What an observer can see: which domains you connect to, when and how often, and the sizes and rhythm of the transmissions. That is enough to reconstruct a picture — which apps are on the device, which bank you use, which sites you open. A separate category of risk is the devices on the same network: printers, other people's laptops, file shares that your computer may take for a trusted environment. Add to this the habit devices have of remembering networks: a phone that once connected to a point with a particular name will find it by itself next time and connect silently, wherever you happen to be.
Fake Access Points and the Man-in-the-Middle Attack
The second scenario is more dangerous than passive eavesdropping. An attacker sets up an access point with a plausible name — something like the name of the café or the airport with a digit added — and waits for devices to connect by themselves. A phone often does so automatically if it has seen a network with a similar name before. From then on all the traffic goes through someone else's equipment, and the opportunity arises for a man-in-the-middle attack: attempts to downgrade the connection to an unencrypted one, the substitution of DNS responses, redirection to a copy of a familiar site, a pop-up offer to “update a certificate” or install an app. Modern browsers resist this and display warnings, but a warning works only if it is read. One further detail: faking a network name is technically trivial and requires no expensive equipment, so the name of an access point cannot be trusted in principle. It is worth remembering separately that the risk does not depend on the prestige of the venue: the network in an expensive hotel is built the same way as the one in a station café, and in both cases you are not the one running the equipment.
What Is Protected Without a VPN and What Is Not
Honesty matters here, because frightening people indiscriminately is pointless. Today almost the whole web runs over HTTPS: the contents of pages, passwords and form data on normal sites are encrypted, and they cannot simply be read out of the air. Messengers and email clients use encryption too. But a great deal remains uncovered. First of all the names of the sites you connect to: without encrypted DNS they are visible right there in the queries, and even with it the name usually stays in the open SNI field while the TLS connection is established — only the ECH extension hides it, and support for that is still far from universal. A public resolver on port 53 is of little help here: the network operator can intercept and substitute such queries, so choose DNS over HTTPS. Also uncovered are the very fact and timing of connections, the data of old applications that use an unencrypted protocol, and everything that happens on pages without HTTPS, including sign-in forms in outdated systems. Add to that vulnerability to active attacks: the substitution of DNS and attempts at redirection. The upshot is this: without a VPN you are protected against your content being read, but not against your behavior being observed and not against interference with your route. It is also useful to remember background activity: while you read the news, the device is synchronizing mail, calendar and cloud storage, and that activity is visible to an observer too, through domain names and the volume of transfers.
What a VPN Changes
A VPN connection closes exactly the layer that remains open. An encrypted tunnel is raised between the device and the server, and for everyone listening to the airwave what remains is a single stream of data to a single address — no domains, no separation by application, no intelligible structure. DNS queries travel inside the tunnel, so they can no longer be substituted on the local network. An attempt to redirect you to a fake site also loses its point: the route is built not in the café but on the exit server. At the same time the device's talkativeness on someone else's local network is shut off — the neighbors stop seeing which services you use. That said, a VPN is no substitute for common sense: it will not save you from entering a password on a phishing site and will not cure a device of malware. There is a practical detail as well: some public networks throttle particular services themselves — they restrict messengers or the quality of video. Through a tunnel the network cannot see what kind of traffic is travelling inside, so such restrictions as a rule stop applying. But the opposite happens too: the network does not let the tunnel itself through, and then changing the server or the protocol in the client helps.
Auto-Connect: Set It Up Once
The point is not to have to think about protection at the check-in desk. The general principle is the same on every platform, although the names of the settings differ. On Android, open the system network settings and switch on always-on VPN, and in the app settings allow autostart and lift the background-activity restrictions — otherwise the system will unload the client at the most inconvenient moment; on an iPhone there are no such settings at all. iOS has no system always-on VPN switch for third-party clients either, so on an iPhone auto-connect is set up in the client itself: look in its parameters for launch at start and connect on demand. On a computer it is enough to add the client to the startup list and switch on automatic connection to the last server. If the client can apply rules by network type, set a simple one: on the home network the tunnel need not be raised, on any unfamiliar one it should always be. Look for switches with these meanings rather than for particular labels: client interfaces change from version to version. It is worth testing the setup in advance, at home: switch the mode on, disconnect from the home network and make sure the connection comes up by itself. Working it out at the airport with a suitcase in your hand is a bad idea.
Captive Portals in Airports and Cafés
A separate difficulty with public access points is the sign-in page, where you have to accept the terms and enter a phone number or a code from a text message. Until it has been completed, the network lets no traffic out, and a tunnel switched on in advance simply will not come up: the client will keep trying endlessly to reach the server. The correct order is this: connect to the network, let the sign-in page open and complete it, and immediately afterwards switch the connection on and only then open your mail, your bank and your work services. If the page does not appear by itself, open any site over the unencrypted protocol — that usually forces the portal to show up. Always-on VPN on Android, and auto-connect in the client itself on an iPhone, is best switched off temporarily at this moment, otherwise the system will not let you through to the page itself. After signing in, the mode can be turned back on. A useful habit is not to enter anything superfluous on the portal page. A phone number is sometimes mandatory under the network's rules, but email, date of birth and consent to a mailing list are almost always optional.
A VPN While Travelling and Abroad
On a trip the number of public networks grows: hotel, airport, station, café, conference. A few rules save the nerves. Switch off automatic connection to open networks, otherwise the phone will pick the nearest point with a familiar name by itself. Keep protection switched on by default and turn it off only for the duration of the portal. Save the connection key in advance somewhere other than the messenger: since February 2026 Telegram has been working intermittently on Russian networks, while the same account and the same key are always available in the dashboard. Bear in mind that banking apps sometimes ask for confirmation when you sign in from another country — split tunnelling helps here, with one app going out to the network directly. And remember the devices: how many of them run on one RobinGood VPN account depends on the plan — check its description so that your phone, your laptop and a travelling companion's tablet all fit within the limit. And finally: on hotel and conference networks traffic is inspected more strictly than usual, so a backup protocol or the nearest available server from the list saves time. Switching takes a few seconds right inside the client and is done by hand.
Frequently asked questions
Is a VPN needed if all sites work over HTTPS anyway?
Yes, because HTTPS closes off content but not behavior. It is still visible from the air which sites you connect to: the domain name stays in the open SNI field even when DNS is encrypted. The timing and activity of connections are visible too, and DNS queries themselves can be substituted on the local network. A VPN removes that layer too, leaving an observer with nothing but an encrypted stream to a single address.
How can you tell that an access point is a fake?
Reliably — almost not at all: a network name is trivial to fake, and by outward signs a copy cannot be told apart from the real one. Protection therefore has to come not from recognition but from habit: do not connect automatically to open networks, switch the tunnel on immediately after signing in, and never ignore a browser's warning about a certificate.
Why will a VPN not connect in a café or an airport?
Most often the sign-in page is in the way: until you have accepted the network's terms, no traffic passes outward, including the client's attempts to reach the server. First connect to the network and complete the portal, then switch the connection on. Always-on VPN on Android, or auto-connect in the client on an iPhone, is best switched off temporarily for that period.
Can a VPN be left switched on permanently?
Yes, and on public networks that is a sensible default mode. Bear just one nuance in mind: VLESS and ShadowSocks work over TCP, so when you move from Wi-Fi to a mobile network the session is usually established afresh and the connection breaks for a few seconds. Battery consumption depends on the client, the network and how you use it. A separate exception is the moment of completing a sign-in page at a public access point.
Does a VPN protect against viruses and phishing?
No, these are different tasks. A VPN closes off the data channel but does not check the contents of sites and does not block malicious files. A password entered on a fake page will go to the attacker regardless of whether the tunnel is switched on.
Ready for a stable internet connection?