[{"data":1,"prerenderedAt":230},["ShallowReactive",2],{"blog:public-wifi-risks":3},{"zh-CN":4,"en":123},{"blocks":5,"faq":107},[6,9,11,13,15,19,21,23,26,28,32,34,37,39,42,44,47,49,52,54,61,63,66,89,91,94,96,98,100,103,105],{"type":7,"html":8},"p","「公共 Wi-Fi 会被偷看」这句话，现在只对了一半。HTTPS 这几年基本普及到了每一个正常网站和 App,坐在同一个咖啡馆、蹭同一个机场 Wi-Fi 的人，就算真的用嗅探工具截到你的流量，拿到手的也是一堆加密后的乱码，读不出你在看什么、填了什么。",{"type":7,"html":10},"这不是说公共网络现在没有风险，而是风险换了位置。以前担心的是「内容被看到」,现在真正站得住的问题，是「这个网络本身是不是它看起来的那个」,以及域名解析这一层有没有被动手脚。这两类问题都不靠 HTTPS 挡，而且比内容泄露更难察觉——页面照样打开，图标照样是绿的。",{"type":7,"html":12},"真正还在起作用的那几类风险，靠的也不是什么高深的技术手段，大多是利用了人的习惯——看到登录框就填、看到熟悉的名字就连、看到证书警告嫌麻烦就点掉。技术这边能做的事有限，剩下的一半始终要靠人自己多看一眼。",{"type":7,"html":14},"下面把公共 Wi-Fi 上还真实存在的风险，和已经被 HTTPS 基本解决的风险分开说清楚，再讲清楚哪些场景风险更高、该怎么应对，以及 VPN 又管不到哪一段。",{"type":16,"id":17,"html":18},"h2","bp-context","HTTPS 普及之后，哪些担心可以放下了",{"type":7,"html":20},"十年前那种「公共 Wi-Fi 上随便就能截到密码」的场景，前提是网站本身不加密，内容用明文在网络里跑一圈。现在主流浏览器会主动标出没有 HTTPS 的网站，搜索引擎的排名也会照顾加密站点，结果是你平时会用到的网站和 App,内容这一段基本都已经加密。",{"type":7,"html":22},"也就是说，单纯「监听流量」这条路，对一个正常使用 HTTPS 的网站已经基本走不通了。同一网络里的人能看到你连了哪个地址、传了多少数据，但看不到里面具体的内容。这部分风险，可以从担心清单里划掉。",{"type":16,"id":24,"html":25},"bp-real-risks","还站得住的几种真实风险",{"type":7,"html":27},"划掉内容泄露之后，剩下的风险不是变少了，而是变得更精准了。",{"type":29,"id":30,"html":31},"h3","sub-1","假热点冒充真实网络",{"type":7,"html":33},"伪造一个和店里同名、信号还更强的 Wi-Fi,是成本最低的攻击方式。连上以后，所有流量先经过对方的设备再转发出去——这一步不需要破解任何密码，只需要你选错一个名字相近的网络。有些假热点甚至不拦截任何东西，只是安静地转发，目的只是让你的设备信任它，方便后面在 DNS 或者登录页这两步动手。",{"type":29,"id":35,"html":36},"sub-2","强制登录页当场要密码",{"type":7,"html":38},"机场、酒店常见的「先登录门户页才能上网」设计本身没问题，但它教会了所有人一个习惯：看到网页弹出登录框就顺手填。假的门户页利用的正是这个习惯，伪装成运营商的登录页，直接问你要账号密码——这个信息不需要监听，是你自己填进去的。而且这类页面通常做得很像真的,logo、配色都会照抄一遍，单靠「看起来正不正规」很难分辨。",{"type":29,"id":40,"html":41},"dns","DNS 解析被动手脚",{"type":7,"html":43},"内容加密了，域名解析这一步很多时候还是明文完成的。做了手脚的网关可以在这一步把你的域名请求指向它安排好的地址，而不是真正的目标网站。这也是为什么「内容加密」不等于「整段路径都安全」,\u003Ca href=\"\u002Fblog\u002Fdns-leak-check-guide\u002F\">DNS 泄漏\u003C\u002Fa>讲的正是这一层的问题。",{"type":29,"id":45,"html":46},"sub-4","证书警告被顺手点掉",{"type":7,"html":48},"浏览器弹出「此连接的证书不受信任」,大多数人的反应是点「继续访问」,因为着急上网。这个警告本来是用来提示中间可能有人插了一层设备的，一旦养成无脑点掉的习惯，警告能起到的作用就基本归零了。",{"type":16,"id":50,"html":51},"bp-scenarios","哪些场景风险更高一些",{"type":7,"html":53},"不是所有公共网络的风险都一样高。人流量大、设备来来去去、管理相对松散的场地，风险会明显更高一些：",{"type":55,"items":56},"list",[57,58,59,60],"机场候机区——人多，热点密集，假热点混在真热点里很难第一时间分辨","大型会展、临时活动场地——网络往往是临时架设的，员工自己也说不清准确名称","连锁酒店的公共区域——大堂和客房用的经常是两套不同的网络，门户页样式却很相似","陌生城市的连锁咖啡馆——名字全国统一，伪造起来最省事",{"type":7,"html":62},"反过来，自己公司、学校这类长期使用、有固定管理员的网络，风险会低很多，值得放心处理一部分之前不敢做的操作。判断的关键不是「这个地方看起来高档不高档」,而是「这套网络有没有一个说得清楚、能负责的管理者」——五星级酒店的公共 Wi-Fi 不见得比小餐馆的更安全，后者往往只有一个路由器，反而更容易看清楚问题出在哪。",{"type":16,"id":64,"html":65},"bp-steps","连接前后，这几步值得做",{"type":67,"items":68},"steps",[69,73,77,81,85],{"title":70,"body":71},"名称对不上就先别连",[72],"跟店员核实准确的网络名称，尤其是看到两个几乎一样的名字同时出现的时候。信号更强、不需要密码的那个，反而更值得怀疑。",{"title":74,"body":75},"登录门户页只做登录这一件事",[76],"如果门户页问的信息超出「确认上网」的范围，比如要邮箱密码、银行卡信息，直接关掉换一个网络——正常的门户页不会问到这些。",{"title":78,"body":79},"证书警告不要顺手点过去",[80],"看到证书不受信任的提示，先换一个网络试试看，同一个网站在别的网络下是不是也弹同样的警告。只在一个特定网络下出现的证书问题，基本可以确定是这个网络的问题，不是网站的问题。",{"title":82,"body":83},"把 DNS 一起交给隧道处理",[84],"只加密内容、DNS 还走本地解析的方案只解决了一半问题。选一个连接时会接管 DNS 的工具，让域名解析和内容走同一条加密路径，不给中间的网关留下动手脚的空间。",{"title":86,"body":87},"敏感操作留到确认过的网络再做",[88],"登录网银、修改密码这类操作，能等的话就等确认信任的网络再做，不必在刚连上、还没验证过的公共网络里立刻处理。如果中途断线又重新弹出登录框，先看看是不是断线保护那种情况，而不是直接在弹窗里填信息。",{"type":90},"downloads",{"type":16,"id":92,"html":93},"bp-limits","公共 Wi-Fi 上,VPN 防不住什么",{"type":7,"html":95},"VPN 能做的是把流量和域名解析一起放进加密隧道，让同一网络里的人看不到内容，也很难靠冒充网关篡改域名。这解决的是「网络路径」这一层的问题。",{"type":7,"html":97},"它解决不了的是你自己做出的选择。假的登录门户页问你要密码，你填了，这个信息是自己交出去的，和流量有没有加密没有关系；设备本身如果已经中了木马,VPN 也不会替你清理；证书警告要不要点掉，决定权也一直在你自己手上，工具只能把警告显示出来，不能替你做判断。",{"type":7,"html":99},"换个说法可能更好理解:VPN 保护的是「数据在路上会不会被看到、被改」,不保护「你在某个页面上主动做了什么」。公共网络的风险，一部分确实在网络层面，另一部分始终是这类「这一步该不该做」的判断，后者没有工具能完全替你做。",{"type":16,"id":101,"html":102},"bp-final","总结",{"type":7,"html":104},"HTTPS 已经解决了公共 Wi-Fi 上最老的问题——内容被偷看。真正还站得住的，是假热点、登录门户页里的钓鱼、DNS 层的手脚，还有被顺手点掉的证书警告，这四类都不靠内容加密挡住，靠的是网络路径本身干不干净，以及你在关键页面上停不停下来多看一眼。",{"type":7,"html":106},"日常做法不复杂：核实网络名称，登录页只用来登录，证书警告别顺手点过去，敏感操作留到确认过的网络。\u003Ca href=\"\u002Ffeatures\u002F\">快橙\u003C\u002Fa>连接时会把 DNS 一起接管，配合\u003Ca href=\"\u002Fsecurity\u002F\">安全说明\u003C\u002Fa>里写的加密方式，能把网络路径这一层的风险降到很低——但门户页里该不该填密码，证书警告要不要点掉，还是要靠你自己判断。注册后每天都有免费时长，想先试试看，\u003Ca href=\"\u002Forder\u002F\">了解详情\u003C\u002Fa>。",[108,111,114,117,120],{"q":109,"a":110},"手机提示「此连接不安全」,还能继续用吗？","提示的意思是这个网站没有用 HTTPS,内容有可能被同一网络里的人看到。刷新闻、看视频问题不大；要登录账号或者填密码，就别在这个提示下继续。",{"q":112,"a":113},"和店里名字一样的 Wi-Fi,为什么还可能是假的？","伪造热点最常见的做法就是复制一个几乎一样的名字，有时只多一个空格或者少一个字母。信号更强、不用密码的那个，反而更值得怀疑，连之前先跟店员核实一下准确名称。",{"q":115,"a":116},"公共 Wi-Fi 设了密码，是不是就安全一些？","密码只挡住了随便蹭网的路人，挡不住已经在同一个网络里的人。安不安全，和有没有密码关系不大，和这段连接有没有额外加密关系更大。",{"q":118,"a":119},"用手机流量是不是比公共 Wi-Fi 安全？","运营商的移动网络确实比来源不明的公共 Wi-Fi 更值得信任，但它解决的是「这个网络本身可不可信」,不解决账号密码那部分的风险，这两件事是分开的。",{"q":121,"a":122},"快橙在公共 Wi-Fi 下能防住什么？","能把流量和域名解析一起放进加密隧道，同一网络里的人看不到你访问的内容，也很难靠冒充网关篡改域名。但如果是你自己在假的登录页里填了密码，这一层保护帮不上忙。",{"blocks":124,"faq":214},[125,127,129,131,133,135,137,139,141,143,146,148,151,153,156,158,161,163,165,167,173,175,177,199,200,202,204,206,208,210,212],{"type":7,"html":126},""Public Wi-Fi gets snooped on" is only half true these days. HTTPS has spread to essentially every normal site and app over the past few years, so someone sharing a café or airport hotspot who actually sniffs your traffic gets back a pile of encrypted noise — not what you looked at or typed.",{"type":7,"html":128},"That does not mean public networks are risk-free now; the risk simply moved. The old worry was content being read. What still holds up is whether the network is actually what it claims to be, and whether DNS resolution — the step HTTPS does not touch — has been tampered with. Both are harder to notice than content leaks, because everything still looks normal: the page loads, the icon is still green.",{"type":7,"html":130},"The things that still work on attackers rarely rely on anything technically clever — mostly they lean on habits: filling in whatever login box pops up, connecting to a familiar-looking name, clicking past a certificate warning because it's in the way. There is only so much a tool can do; the rest still comes down to a second look.",{"type":7,"html":132},"Here is what is actually still risky on public Wi-Fi versus what HTTPS has already handled, which situations carry more risk, what to do about it, and where a VPN stops being able to help.",{"type":16,"id":17,"html":134},"What you can stop worrying about, post-HTTPS",{"type":7,"html":136},"The old "anyone can grab your password on public Wi-Fi" scenario assumed the site itself sent things in the clear. Browsers now flag non-HTTPS sites directly, and search rankings favor encrypted sites too, so almost everything you actually use today is already encrypted end to end.",{"type":7,"html":138},"Plain traffic sniffing, in other words, is mostly a dead end against a normal HTTPS site. Someone on the same network can see which address you connected to and how much data moved, but not what was inside it. Cross that one off the list.",{"type":16,"id":24,"html":140},"The risks that still hold up",{"type":7,"html":142},"Once content leakage is off the list, what's left isn't smaller — it's more targeted.",{"type":29,"id":144,"html":145},"a-fake-hotspot-impersonating-the-real-one","A fake hotspot impersonating the real one",{"type":7,"html":147},"Cloning a network's name — sometimes with a stronger signal, too — is the cheapest attack there is. Once you connect, your traffic passes through the attacker's device before going anywhere else, and none of it required cracking a password, just picking the wrong network with a similar name. Some fake hotspots do not intercept anything at all; they just quietly forward traffic, purely to earn your device's trust before tampering with DNS or a login page later.",{"type":29,"id":149,"html":150},"a-captive-portal-that-asks-for-a-password-on-the-spot","A captive portal that asks for a password on the spot",{"type":7,"html":152},"The "log into a portal before you get online" pattern at airports and hotels is fine on its own, but it trained everyone into a habit: fill in whatever login box appears. A fake portal exploits exactly that habit, copying a carrier's login page and asking directly for an account and password — no sniffing required, since you typed it in yourself. These pages are often close copies, logo and colors included, so "does it look legitimate" is not a reliable test.",{"type":29,"id":154,"html":155},"dns-resolution-getting-tampered-with","DNS resolution getting tampered with",{"type":7,"html":157},"Content can be encrypted while DNS resolution still happens in the clear. A compromised gateway can point your domain lookup at an address it chose instead of the real destination — which is exactly why "the content is encrypted" does not mean "the whole path is safe." \u003Ca href=\"\u002Fen\u002Fblog\u002Fdns-leak-check-guide\u002F\">DNS leaks\u003C\u002Fa> covers this same layer in more depth.",{"type":29,"id":159,"html":160},"a-certificate-warning-clicked-away-without-reading-it","A certificate warning clicked away without reading it",{"type":7,"html":162},"A browser's "this certificate is not trusted" warning gets clicked through by most people in a hurry to get online. That warning exists specifically to flag a possible device sitting in the middle — once clicking past it becomes reflexive, it stops doing anything useful at all.",{"type":16,"id":50,"html":164},"Which situations carry more risk",{"type":7,"html":166},"Not every public network carries the same risk. Places with heavy foot traffic, constantly changing devices, and looser oversight are the ones to be more careful about:",{"type":55,"items":168},[169,170,171,172],"Airport waiting areas — dense with hotspots, and a fake one hides easily among the real ones","Large conferences and temporary event venues — the network is often set up on the fly, and even staff may not know its exact name","Hotel common areas — the lobby and the rooms often run on two different networks with near-identical-looking portal pages","A chain café in an unfamiliar city — the same name everywhere makes cloning trivial",{"type":7,"html":174},"By contrast, a network you use long-term with a known administrator — your office, your school — carries much less risk, and is a reasonable place to handle things you'd otherwise put off.",{"type":16,"id":64,"html":176},"What's worth doing, before and after connecting",{"type":67,"items":178},[179,183,187,191,195],{"title":180,"body":181},"Skip it if the name doesn't match",[182],"Confirm the exact network name with staff, especially when two nearly identical names show up at once. The one with the stronger signal that skips the password is the one to be suspicious of, not reassured by.",{"title":184,"body":185},"Use the portal page only to get online",[186],"If a portal asks for more than what's needed to confirm you're online — an email password, card details — close it and pick a different network. A normal portal never needs those.",{"title":188,"body":189},"Don't wave through certificate warnings",[190],"If a certificate warning shows up, try the same site on a different network. A warning that only appears on one specific network is a problem with that network, not the site.",{"title":192,"body":193},"Let the tunnel handle DNS too",[194],"Encrypting content while DNS still resolves locally only solves half the problem. Pick a tool that takes over DNS the moment it connects, so lookups and content travel the same encrypted path and no gateway in between gets a chance to interfere.",{"title":196,"body":197},"Save sensitive tasks for a network you already trust",[198],"Banking logins and password changes can usually wait until you're on a network you already trust, rather than being handled the moment you join an unverified public one. If the connection drops and a login box reappears out of nowhere, check whether it's just kill switch behavior before typing anything into it.",{"type":90},{"type":16,"id":92,"html":201},"What a VPN does not protect against here",{"type":7,"html":203},"A VPN puts your traffic and DNS lookups into one encrypted tunnel, so others on the same network cannot read the content or easily redirect it by spoofing the gateway. That covers the network-path layer of the problem.",{"type":7,"html":205},"What it cannot cover is a choice you make yourself. If a fake portal asks for a password and you type it in, that information left your hands on purpose, regardless of encryption; if the device itself is already infected, a VPN will not clean that up either; whether to click past a certificate warning is still entirely your call — a tool can only surface the warning, not decide for you.",{"type":7,"html":207},"Put another way: a VPN protects whether data gets seen or altered in transit, not what you actively choose to do on a given page. Part of the risk on public networks really is at the network layer; the other part is always this kind of judgment call, and no tool makes that one for you.",{"type":16,"id":101,"html":209},"In summary",{"type":7,"html":211},"HTTPS solved public Wi-Fi's oldest problem — content being read. What still holds up is fake hotspots, phishing through captive portals, DNS tampering, and certificate warnings clicked away without a second thought. None of those four are stopped by content encryption alone; they come down to whether the path itself is clean, and whether you pause on the pages that matter.",{"type":7,"html":213},"The everyday version is simple: confirm the network name, use portals only to get online, don't wave through certificate warnings, and save sensitive tasks for a trusted network. \u003Ca href=\"\u002Fen\u002Ffeatures\u002F\">FastOrange\u003C\u002Fa> takes over DNS the moment it connects, and paired with the encryption described on the \u003Ca href=\"\u002Fen\u002Fsecurity\u002F\">security page\u003C\u002Fa>, that keeps the network-path risk low — but whether to type a password into a portal, or click past a warning, is still your call. Every account gets free daily trial time after signup, so \u003Ca href=\"\u002Fen\u002Forder\u002F\">see the details\u003C\u002Fa> if you want to try it first.",[215,218,221,224,227],{"q":216,"a":217},"My phone says "this connection is not private." Can I still use it?","That warning means the site is not using HTTPS, so its content could be read by someone else on the network. Fine for browsing news; do not push through it to log in or type a password.",{"q":219,"a":220},"Why could a Wi-Fi network still be fake if its name matches the shop's?","Cloning a name is the cheapest trick there is — sometimes off by one letter or an extra space. A stronger signal that needs no password is the suspicious one; confirm the exact name with staff before connecting.",{"q":222,"a":223},"If a public Wi-Fi network has a password, is it safer?","A password only keeps out random strangers walking by, not people already on the same network. Safety depends far more on whether your connection is separately encrypted than on whether the network itself needs a password.",{"q":225,"a":226},"Is mobile data safer than public Wi-Fi?","A carrier network is generally more trustworthy than an unknown public one, but that only answers whether the network itself can be trusted. It says nothing about account and password risks, which are a separate problem entirely.",{"q":228,"a":229},"What does FastOrange actually protect against on public Wi-Fi?","It puts your traffic and DNS lookups into one encrypted tunnel, so others on the network cannot read what you visit or redirect it by spoofing the gateway. If you type a password into a fake portal yourself, this layer cannot help with that.",1793918312075]