Do this
Avoid public WiFi: Large-scale compromises via public WiFi are exceedingly rare today. Modern products use encryption technologies to protect your traffic even on open networks, and operating systems and browsers now warn users about untrusted connections. Personal VPN services offer little additional security or privacy benefit for most people and don’t stop the most common attacks.
Why it’s outdated
Public Wi-Fi was risky when most websites sent information unencrypted. Today nearly all web traffic is encrypted, so other people on the network can’t read what you send to your bank or your email. The FTC now says that because of the widespread use of encryption, “connecting through a public Wi-Fi network is usually safe.”
Sources
Common questions
Not really—not the way it used to be. Almost all websites and apps now use encrypted connections, so even on an open network your data travels securely. The bigger risks come from phishing, stolen passwords, or using outdated software. So use the Wi-Fi, and spend your effort on the basics that stop those: updates, multi-factor authentication, and a password manager.
Not as much as ads claim. VPNs hide your traffic from the local network and your IP address from the sites you visit, but the VPN company can then see any unencrypted traffic that your apps or operating system transmit. For most people, the encryption built into your apps already provides strong protection. VPNs make sense only for specific use cases, like bypassing local censorship or connecting securely to a work network. If privacy is your goal, the biggest gains come from elsewhere: see Do I need to do anything above the basics to protect my privacy?
DEF CON is probably the most-cited reason to worry about public WiFi, and it’s worth thinking through carefully.
First, the practical reality: modern phones and laptops are significantly harder to compromise than they were when the “never use public WiFi” advice calcified into conventional wisdom. A successful attack against a patched, up-to-date device requires exploiting vulnerabilities that researchers and criminals alike treat as valuable commodities. The economics don’t work in your favor as a target: if someone at DEF CON has a working zero-day against iOS or Android, burning it on a random attendee is a terrible return on investment. They’d be better off collecting a bug bounty and giving a talk about it at the next DEF CON.
Second, and more importantly: if you genuinely need to take special precautions to keep your devices safe while connecting to a network, that’s a sign that your device manufacturer or online service hasn’t done their job. The burden of staying secure shouldn’t fall on you. Demand better from the companies whose products you’re paying for. So no, you probably don’t need a VPN and a burner phone for DEF CON. But if that answer makes you uncomfortable, direct that discomfort at the right target.
Do this instead
Use the Wi-Fi. What protects you on any network is an up-to-date device, multi-factor authentication on important accounts, and a password manager that won’t fill in your password on a fake page.