Working From Cafés: A Public Wi-Fi Security Policy

Sociologists call it the "third place": somewhere that isn't home and isn't the office. For a lot of Australian workers it's now part of the working week. An hour at a café between client visits. A coworking desk in town two days a week. The airport lounge, the library, the hotel lobby.

Most businesses don't have a policy for any of it. Staff just do whatever seems sensible, which ranges from "very careful" to "left the laptop open while ordering a second flat white". So let's write a policy, but first let's be honest about which risks are real in 2026, because a lot of the standard advice is a decade out of date.

The risk that's smaller than you've been told

The classic warning is that a hacker on café Wi-Fi can read everything you send. That was a serious problem when most websites used plain HTTP. Today the overwhelming majority of web traffic, and essentially all of Microsoft 365, banking and business software, is encrypted with TLS between your device and the service. Someone sniffing the café network sees that you're talking to Microsoft, not what you're saying.

So public Wi-Fi isn't the instant disaster it's often described as. But it isn't safe either, for reasons that have moved rather than disappeared.

The risks that are real

Fake networks and fake login pages

Anyone can set up a hotspot called "Cafe_Free_WiFi" or something matching the business next door. Once you're connected, the attacker controls the network, including the "please sign in" page that pops up. That page can ask for your email address and password, or tell you to "sign in with Microsoft" on a convincing copy. TLS can't protect a password you type into the attacker's page yourself.

Shoulder surfing and overheard calls

The most effective attack in a café requires no technology at all. A screen visible from the next table, a client's name and matter discussed loudly on a call, a password typed while someone watches. In a coworking space, the person at the next desk might work for a competitor.

The unattended laptop

You pop up to order, or duck to the bathroom, and leave the laptop open and unlocked. It takes about ten seconds to plug in a USB stick or walk off with the device. Lost and stolen devices are a steady source of data breaches every year.

Shared networks in coworking spaces

Coworking Wi-Fi is often one big network shared by dozens of businesses. Your laptop is on the same local network as everyone else's, including any that are infected. Device discovery and file sharing settings matter more here than at home.

The policy: practical guidelines for staff

Here's the core of what we suggest. Keep it to about a page so people actually read it.

1. Use your phone's hotspot first

Tethering to your work or personal phone over 4G or 5G is usually more secure than any public network, because you control it. For most office work it uses less data than people expect. Streaming video is the main exception.

2. If you must use public Wi-Fi, treat the login page with suspicion

Never enter your work password on a Wi-Fi sign-in page. A legitimate café network might ask for an email address or room number; it should never need your Microsoft 365 credentials. Confirm the network name with staff. And when Windows asks, choose Public network, which turns off device discovery so other people on the network can't see your laptop.

3. Use the company VPN or secure access tool

A VPN encrypts everything between your device and a trusted endpoint, which closes the remaining gaps such as DNS lookups and any older app that doesn't encrypt properly. If your business provides one, the policy should say when it must be on. Ideally it connects automatically so nobody has to remember.

4. MFA, always

Multi-factor authentication is your safety net when a password is stolen anyway. Phishing-resistant methods, such as Windows Hello for Business, passkeys or the Microsoft Authenticator with number matching, are best. See MFA your staff won't try to dodge.

5. Lock it or take it with you

Press Windows + L (or Control + Command + Q on a Mac) every time you step away, even for a moment. Better still, take the laptop with you. Set the screen to lock automatically after a few minutes of inactivity as a backstop.

6. Use a privacy screen and pick your seat

A privacy filter narrows the viewing angle so only the person directly in front can read the screen. Sit with your back to a wall where possible. It feels slightly spy-movie, but the alternative is your client list on display to the queue for the bathroom.

7. Watch what you say

No client names, matter details, account numbers or personal information on calls in public spaces. Step outside or book a phone booth. If you work in a regulated field, such as legal or accounting, confidentiality obligations follow you to the café.

8. Use your own charger

Public USB charging ports can, in theory, carry data as well as power. Real-world attacks are rare, but the fix costs nothing: bring your own charger and plug into a power point, or carry a small power bank.

9. Don't print on shared printers

Coworking printers are shared devices, and documents left in the tray are read by whoever comes next. If you must print, release the job when you're standing at the printer, and collect it immediately.

10. Report anything odd straight away

A strange login prompt, a lost device, a suspected shoulder surfer who seemed too interested. Report it immediately, no blame attached. The first hour matters most.

What the business should handle

A policy only goes so far. The business side of the deal is making the secure path the easy one:

• Laptops encrypted with BitLocker or FileVault, so a stolen device doesn't become a data breach.
• Endpoint protection and monitoring that works off-network, not just in the office.
• An always-on VPN or secure access service where it's warranted.
• Remote lock and wipe for lost devices.
• Conditional Access rules in Microsoft 365 that block sign-ins from unmanaged or non-compliant devices.

Our work laptop security checklist covers these in detail, and the same controls protect a laptop at home, in a café or in a hotel. Fold this guidance into your core IT policies and reinforce it with staff awareness training, so it becomes habit rather than a document someone signed once.

Frequently asked questions

Is it safe to work on public Wi-Fi?

Safer than it used to be, because most business services now encrypt traffic. The real risks are fake hotspots and sign-in pages that harvest passwords, shoulder surfing, and unattended devices. Use your phone's hotspot or a VPN, never enter work credentials on a Wi-Fi login page, and keep MFA on.

Do I need a VPN on public Wi-Fi?

It's strongly recommended for work. A VPN encrypts all traffic between your device and a trusted endpoint, closing gaps that individual app encryption can miss. Tethering to your phone is a good alternative when a VPN isn't available.

What should a remote work security policy include?

Rules on which networks to use, VPN and MFA requirements, screen locking and device care in public, confidentiality on calls, printing, reporting lost devices or suspicious activity, and what the business provides, such as encrypted laptops and remote wipe.

Is coworking space Wi-Fi secure?

Usually better than a café, but it's still a shared network with many other businesses on it. Set your laptop's network to Public, use a VPN, and don't rely on the space's network for anything sensitive without additional protection.

Local IT and cyber security support across NSW

Chewing IT runs managed IT and cyber security for small and mid-sized businesses from our Wyong and Hornsby offices, covering the Central Coast, Newcastle, Lake Macquarie and Hornsby.

Want your team safe wherever they work? Talk to us — we'll set up the laptops, VPN and policies so working from anywhere doesn't mean risking everything.