“The Login Page Looked Completely Normal, Right Down to the Real-Time Updates”: Public Wi-Fi and the Middleman You Never See

For Adults 35–50 (Parents and Non-Parents Alike)

Working from a coffee shop, an airport gate, or a hotel lobby is a normal part of adult life now — and it’s also exactly the environment a man-in-the-middle attack is built for. The idea is simple even if the execution is sneaky: someone inserts themselves quietly between your device and whatever you’re connecting to, capable of seeing or even altering what passes between them, often through a fake Wi-Fi hotspot with a name that sounds completely legitimate.

What makes this trickier than it used to be is that the fake login screens involved can now update themselves automatically to match a real service’s actual current design — meaning even someone genuinely being careful, checking that things “look right,” can be fooled, because the thing they’re checking is being faked in real time to match.

One of the more effective, low-effort defenses against this entire category is multi-factor authentication done right — specifically the app-based or hardware-key kind rather than text-message codes, which are themselves increasingly targeted. This short PSA covers it clearly: Secure Our World: Multi-Factor Authentication (CISA)

The plain version: imagine handing a sealed envelope to a mail carrier who you assume is taking it straight to its destination — except someone’s intercepted the route, quietly opened it, read it, resealed it, and sent it on so nothing looks disturbed. You’d have no reason to suspect anything, because nothing about the outside of the envelope changed. That’s the entire point of this kind of attack — it’s designed to be invisible at every checkpoint you’d normally trust.

What genuinely reduces your exposure:

1.          Avoid logging into anything sensitive — banking, work systems, email — on public Wi-Fi when you can help it, and if you must, use a reputable VPN, which encrypts your connection so a middleman intercepting the traffic gets nothing usable.

2.          Prioritize app-based or hardware-key multi-factor authentication over text-message codes on your most important accounts — email first, since it’s often the reset key to everything else.

3.          Turn off auto-connect to open Wi-Fi networks on your phone and laptop, so your device isn’t quietly joining lookalike hotspots without your active decision each time.

4.          If a login page ever behaves slightly unexpectedly — an odd delay, a certificate warning, a layout that’s almost right — close it and navigate to the site directly instead of continuing. Trust the hesitation; it’s doing its job.

This isn’t a reason to avoid working from a café, or any other available guest Wi-Fi ever again. It’s a reason to treat public networks the way you’d treat a shared landline in an old movie — useful, common, and not the place for your most private conversation. As the old saying goes, "an ounce of prevention cures a pound of pain."

_________________________________________________________________

This post is part of a series inspired by and meant to complement AI Safety for the Everyday User (In 10 Easy Steps) by Terrence “TerrenceTech” Williams — a plain-language guide covering sixteen classic scams and the ten concrete habits that stop them. The full book goes deeper into the “why” behind each one and lays out a complete, step-by-step action plan.