Fake hotspots and snooping
Setting up a network called Cafe_Free_WiFi takes minutes, and everyone who joins it routes their traffic through the person who made it. Even on the genuine network, the operator can watch your lookups and read anything sent unencrypted.
If the network has no password, a stranger two tables away may be able to watch as well.
What the hotspot sees
Once connected, every app hands its data to the tunnel. The hotspot is left with scrambled packets flowing to a single address.
Name lookups are part of that stream and get answered by our own DNS, so nobody on the hotspot can piece together where you browsed.
Login page, then VPN
Station and cafe networks often park you on a portal page that wants a tick box or a room number. Do that first and connect VPNPass afterward, because the tunnel can't start until the portal releases you.
A VPN secures the line, and your accounts still need their own care: separate passwords for the important ones, two-step sign-in wherever offered, and a hard stop at any certificate warning you were not expecting.
Protection to leave on
Hotspots tend to cut out. Leave the kill switch on so apps pause until the tunnel is back instead of falling onto the open network.
On Plus or Pro, also leave malicious site blocking on. Known phishing pages dressed up as Wi-Fi sign-in screens get stopped there.
- Kill switch: on
- Malicious site blocking: on (Plus and Pro)
- Tunnel refuses to connect: try OpenVPN TCP