Most cafe and airport networks now sit behind a padlock in the browser, and that padlock does real work. It hides the exact page you read, the words you type into a form, and the cookies your session carries. It does not hide everything, and the gap between what people assume and what actually leaks on an open network is where most avoidable exposure happens.
Traffic encryption stops at content. Metadata, timing, and the shape of a connection stay visible to anyone sharing the access point or running the router. A patient observer with free tools can still map who you are, what you use, and roughly what you are doing, without ever breaking a single cypher.
That gap matters in ordinary browsing and in adult leisure browsing alike. Someone checking scores between flights, or opening the adventures beyond wonderland game lobby to read payout rules before deciding anything, still reveals the destination hostname on the airport WiFi even when the page body stays encrypted. The rest of this article stays on the security side of that observation.
The Metadata That Slips Past TLS
TLS wraps the payload but not the envelope. Certain fields sit in cleartext because routers, resolvers, and middleboxes need them to move packets at all. On a shared network, these fields are the first thing a curious neighbour will notice.
These are the common leaks that a basic packet capture on an open SSID still surfaces today. The list is short, but it is enough to build a profile.
DNS Queries and SNI
When your device resolves a domain, that lookup is usually plaintext UDP on port 53 unless you have specifically enabled DNS over HTTPS or DNS over TLS. Even after resolution, the TLS handshake announces the destination hostname in the Server Name Indication field, again in the clear. So the observer learns every site you touch, in order, with timestamps, even though the pages themselves stay sealed.
IP Addresses and Certificate Details
The destination IP is visible by definition, and reverse lookups often reveal the hosting provider or CDN. The server certificate returned during the handshake carries the common name and subject alternative names, which sometimes disclose sibling services on the same infrastructure. None of this requires decrypting a single byte of the actual traffic.
Behaviour Patterns You Broadcast Without Noticing
Beyond individual fields, the RHYTHM of your traffic tells a story. Packet sizes, burst timing, and idle gaps are enough to distinguish a video call from a file upload from a chat app, even without any hostname clues. Researchers call this side of the problem traffic analysis, and it works on encrypted flows.
Device Fingerprints on the LAN
Your device also advertises itself to the local network. mDNS and NetBIOS broadcasts carry the hostname you set on the laptop, which is often your real first name. MAC address prefixes identify the manufacturer, and some phones still leak the SSIDs of previously joined networks through probe requests when randomisation is off.
Captive Portals and Injected Content
The login page for public WiFi is itself a channel. A hostile portal can prompt for an email or phone number, drop tracking cookies before you reach any real site, and in poorly configured cases inject scripts into plain HTTP responses. HTTPS blocks the injection on secured sites, but the portal moment before you are fully online is the softest window.
Practical Countermeasures That Actually Change the Picture
Awareness alone does not close the gap. A short checklist of concrete settings does more than any single tool, because each item removes one specific leak from the list above.
- Turn on encrypted DNS in the operating system, not only in the browser, so system services are covered too
- Use a reputable VPN on untrusted networks, and confirm it blocks traffic when the tunnel drops
- Rename the laptop and phone hostname to something generic, and enable MAC address randomisation for unknown networks
- Disable auto-join for open SSIDs so the device stops probing for past networks in public
- Treat captive portals as untrusted: open them in a private window, submit the minimum, close it afterwards.
Each item is small on its own. Together they push a casual observer from a clear profile of you to a mostly opaque blob of encrypted flows heading to well-known CDNs, which is the realistic goal on shared infrastructure.