[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 1 · 1.3.c
AP Cybersecurity · Introduction to Security
Protecting Sensitive Data on Public Networks
Encryption does not remove the observer — it changes who the observer is.
key ideaEncryption does not remove the observer. It changes who the observer is.
Matching controls to threats
Three habits cover almost all of the personal risk on public Wi-Fi: check the network name exactly, know what is still exposed on an unencrypted network, and understand what a VPN actually moves. Each answers a different attack.
| Risk | How it plays out | Control | What it breaks |
|---|
| evil twin | a rogue AP copies the SSID | verify the name matches exactly | the automatic connection |
| unencrypted traffic on shared Wi-Fi | the network owner reads it | prefer encrypted protocols; avoid sensitive work | readable content |
| leaking DNS queries | which sites you visit is visible even over HTTPS | a VPN, or encrypted DNS | destination visibility |
| the network operator itself | a hostile or careless operator | a VPN | moves the trust to the VPN provider |
| trusting the VPN blindly | the provider can see everything | choose the provider deliberately | nothing — this is a trust decision |
Row 5 is the one people skip. A VPN does not make traffic private; it makes the VPN operator the party who can see it.
four habits
- An exact name match — not similar, not close. Attackers rely on nearly right.
- Most internet protocols are encrypted now, but DNS queries often are not.
- A VPN encrypts everything as far as the VPN operator, and no further.
- Decide by sensitivity: some tasks should simply wait for a trusted network.
Layering
Each layer shrinks the audience by one party. None of them reduces it to nobody — which is why choosing a VPN provider is a genuine security decision rather than a formality.| Observer | Sees on plain HTTP | Sees on HTTPS | Sees with a VPN |
|---|
| the Wi-Fi operator | everything | site name, DNS queries, traffic volume | an encrypted tunnel only |
| your ISP | everything | site name and timing | an encrypted tunnel only |
| the VPN provider | — | — | site names and unencrypted content |
| the destination site | everything you send it | everything you send it | everything you send it |
Reading down the last column: a VPN blinds the network and the ISP, and hands that same visibility to the provider. The destination site always sees what you send it.
Check the nameexact match, not similar
Know what leaksDNS and site names, even over HTTPS
A VPNmoves trust, does not remove it
Worked analysis
EX 1
Two networks, one letter apart
At a café a phone offers CafeGuest and Cafe_Guest. The posted sign says CafeGuest. What should the user do, and why does it matter?
1
Compare character by character
The underscore makes Cafe_Guest a different network.
2
Name the likely explanation
An evil twin standing next to the real one.
3
Say what connecting would allow
All traffic passes through equipment the adversary controls.
4
Give the action
Join only the exact name on the sign; if unsure, ask staff rather than guess.
5
Add the fallback
Use mobile data for anything sensitive. A café network is never worth a banking session.
EX 2
“It is all HTTPS, so I am fine”
A user argues that modern encryption makes public Wi-Fi safe. Evaluate the claim.
1
Grant what is true
HTTPS content is unreadable to the network operator.
2
Name what still leaks
DNS queries reveal which sites are visited; so do connection metadata and timing.
3
Judge the sensitivity
For some people, which sites you visit is itself the sensitive fact — a clinic, a lawyer, a job board.
4
Name the residual risk
Any unencrypted protocol still in use on the device leaks fully.
5
Give the balanced answer
Largely safe for content, not private for destinations. Use a VPN or encrypted DNS if that matters.
EX 3
What a VPN actually buys
A student installs a free VPN and says their browsing is now private. Assess this.
1
State what the VPN does
Encrypts all traffic between the device and the provider's servers.
2
State who is blinded
The Wi-Fi operator and the ISP now see only an encrypted tunnel.
3
State who gains visibility
The VPN provider sees the destinations, and any unencrypted content.
4
Question the business model
A free service is paid for somehow — often by monetizing exactly that visibility.
5
Give the correct framing
Trust was moved, not eliminated. Choose the provider as deliberately as you would choose a bank.
Check yourself
What is the first check before joining a wireless network?
Show answer
That the name matches the intended network exactly — character for character. A similar name is the entire evil-twin technique.
Most traffic is encrypted. What is still exposed on an unencrypted Wi-Fi network?
Show answer
DNS queries and connection metadata — which sites are visited and when — plus anything using a protocol that is not encrypted.
A VPN encrypts all your traffic. Who can still see it?
Show answer
The VPN provider, which decrypts traffic to forward it, and the destination site itself. A VPN relocates the trusted observer rather than removing them.
How should sensitivity affect the decision to use a public network?
Show answer
Match the network to the task: routine browsing is fine, while banking, health, or work with confidential data should wait for a trusted network or use mobile data.