Exercise: The Public Wi-Fi and VPN Decision Lab

Build the mental model

This lab is not about learning new Wi-Fi facts — it is about turning what you already learned in the Public Wi-Fi Risks, VPN Basics and Limits, and Fake Hotspots lessons into a repeatable decision process, instead of relying on a single blanket rule like "never use public Wi-Fi."

• Network Trust Level — how confident you are the network is genuinely what it claims: known / unknown / suspicious
• Activity Sensitivity — how much damage exposure of this activity would cause: low / medium / high
• Connection Security — whether the site itself is served over HTTPS

None of these factors should decide anything alone — they combine. A low-sensitivity activity on a known network and a high-sensitivity activity on a suspicious network call for completely different decisions, even though both are technically "public Wi-Fi."

Look at the five scenarios listed in the exercise section below and form your own recommendation for each before checking the worked answer key in the next section.

PUBLIC WI-FI DECISION FRAMEWORK
-------------------------------
  ACTIVITY          NETWORK TRUST         SENSITIVITY
  (what you do)      (known/unknown/       (low/medium/
                       suspicious)           high)
       |                    |                    |
       +--------------------+--------------------+
                            |
                            v
                  +-------------------+
                  |  combine all three |
                  |  factors together  |
                  +-------------------+
                            |
        +-------------------+-------------------+
        |             |             |            |
        v             v             v            v
    PROCEED       USE VPN      USE CELLULAR    AVOID
  (known net,   (sensitive    (high-stakes,   (suspicious
   low risk,     data, ok      unclear net    network --
   HTTPS)        network)      trust)         skip it)

Connect it to a real scenario

(1) Checking personal email on a coffee shop's own named Wi-Fi: known network, medium sensitivity, served over HTTPS — proceed normally is reasonable.

(2) Making a banking transaction at an airport: high sensitivity combined with unknown trust means switching to cellular data removes the trust question entirely, rather than just layering a VPN on top of an unverified network.

(3) Browsing news or social media at a hotel: known network, low sensitivity, HTTPS — proceed normally.

(5) Working on company systems from a co-working space: the network itself may be known, but the sensitivity of company data is high, so the company VPN is required — the network's trustworthiness doesn't change that requirement.

• Combine three factors before deciding: Network Trust Level, Activity Sensitivity, and Connection Security — never decide on just one
• A VPN only stops local-network snooping; for genuinely high-stakes activity on an unverified network, switching to cellular is often the stronger move
• Treat any open network with a generic or unverifiable name as suspicious trust regardless of the activity, and avoid it entirely

Try the working example

function recommendConnectionApproach(scenario) {
  const { isHTTPS, activitySensitivity, networkTrustLevel } = scenario;

  // A network we can't verify at all is the strongest signal --
  // skip it before even considering what we'd do on it.
  if (networkTrustLevel === "suspicious") {
    return "avoid";
  }

  if (activitySensitivity === "high") {
    // High-stakes activity: only proceed with a VPN on a known
    // network. On an unverified network, sidestep it via cellular.
    return networkTrustLevel === "known" ? "use-vpn" : "use-cellular";
  }

  if (activitySensitivity === "medium") {
    if (networkTrustLevel === "unknown") return "use-vpn";
    return isHTTPS ? "proceed" : "use-vpn";
  }

  // activitySensitivity === "low"
  if (networkTrustLevel === "known") return "proceed";
  return isHTTPS ? "proceed" : "use-vpn";
}

const scenarios = [
  {
    name: "Checking personal email at a coffee shop",
    isHTTPS: true,
    activitySensitivity: "medium",
    networkTrustLevel: "known",
  },
  {
    name: "Making an online banking transaction at an airport",
    isHTTPS: true,
    activitySensitivity: "high",
    networkTrustLevel: "unknown",
  },
  {
    name: "Browsing news and social media at a hotel",
    isHTTPS: true,
    activitySensitivity: "low",
    networkTrustLevel: "known",
  },
  {
    name: "Joining an open network named 'Free_Public_WiFi'",
    isHTTPS: true,
    activitySensitivity: "low",
    networkTrustLevel: "suspicious",
  },
  {
    name: "Remote work on company systems from a co-working space",
    isHTTPS: true,
    activitySensitivity: "high",
    networkTrustLevel: "known",
  },
];

for (const s of scenarios) {
  console.log(s.name + " -> " + recommendConnectionApproach(s));
}

Checking personal email at a coffee shop -> proceed
Making an online banking transaction at an airport -> use-cellular
Browsing news and social media at a hotel -> proceed
Joining an open network named 'Free_Public_WiFi' -> avoid
Remote work on company systems from a co-working space -> use-vpn

FTC Consumer Advice — Are Public Wi-Fi Networks Safe? What You Need To Know — Digital Privacy & Modern Security