4 MIN READ
Public WiFi in 2026 is more encrypted than it has ever been, and the typical knowledge worker on a conference WiFi is still more exposed than they were in 2019. The content sits inside the tunnel. The destination, the timing, and the identity do not. The mismatch is where the privacy problem lives now.
WPA3 is the default on the coffee shop router, the hotel access point, the conference network. TLS 1.3 and HSTS are baked into every modern browser. The bytes being read and written cannot be lifted off the air by anyone with a packet capture. What the operator on the other end of the connection still sees, and what the network sees by design, sits one layer up. The DNS query, the IP the device reaches, the timing of the connection, and the SNI field in the TLS handshake all leak through the encryption, and that is enough to build a profile.
What the network actually sees
Even with WPA3 and HTTPS in place, the public access point still sees four things about every connection the device makes. The DNS query reveals the domain being reached, even when DoH is in use on the resolver but not on the access point. The IP address reveals the service, even when the DNS query is encrypted. The timing reveals the rhythm of the working day. The SNI field leaks the destination hostname during the TLS handshake, unless ECH is in play, and ECH is live on roughly 12 percent of the top thousand sites in mid 2026 according to Cloudflare radar. Stitched together, those four signals let the operator correlate the same device across visits, the same person across networks, and the same workflow across days. The CISA 2024 guidance, the NSA 2025 advisory, and the FCC 2026 consumer note all flag the same gap.
What the encryption does cover
The honest answer is more than most people think. WPA3 with SAE protects the handshake against offline dictionary attacks. TLS 1.3 encrypts the application data, which means the email body, the chat message, the document, the password, and the form submission all sit inside the tunnel. A packet capture on the same SSID sees a stream of opaque records to a stable IP, nothing readable. On a properly configured network with HSTS preloaded, even a downgrade attack is hard. The content being moved is private. That part is fine. The part that looks fine but is not, is the metadata around the content, and the metadata is what the operator and any third party on the segment has been harvesting all along.
What to actually do
Three moves, ranked by what they cost versus what they close. The VPN sits at the top, ideally with the WireGuard or OpenVPN profile running on the device at all times when the device is on an unknown SSID. The VPN puts the DNS, the IP, and the timing inside the tunnel to the provider, and the provider becomes the only party that can correlate the activity. Disabling auto connect to open networks at the OS level is the next move. Windows, macOS, iOS, and Android all ship with auto connect to known SSIDs enabled, which is fine for the home network and a privacy hole everywhere else. Keeping HTTPS only mode on in the browser, the HSTS preload list active, and the Encrypted Client Hello extension where the browser supports it, comes third. None of the three are novel. All of them are usually off. Turn them on.
The bottom line
Public WiFi privacy in 2026 is a metadata problem wearing an encryption costume. The VPN, the disabled auto connect, and the strict HTTPS configuration are the three switches that close what the radio still leaks. Whoever has all three on and treats the open SSID as hostile by default will be fine. Whoever trusts the lock icon and ignores the DNS is the one whose profile is being built.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
