Back to Blog
Security 7 min readApril 28, 2026

The $30 Attack That Steals Passwords on Public WiFi

You've probably connected to coffee shop WiFi without thinking twice. Most people do. What most people don't know is that someone sitting two tables away — with a $30 device from Amazon — can silently intercept everything you send and receive on that network.

What Is a Man-in-the-Middle Attack?

A man-in-the-middle (MITM) attack is exactly what it sounds like. An attacker positions themselves between you and the WiFi router, intercepting your traffic in real time. To your device, everything looks normal. To the attacker, every packet you send is visible.

Modern tools make this trivially easy. With a basic wireless adapter and free software, an attacker can set up a fake access point that mimics the coffee shop's network name. Your phone connects automatically — it remembers the network name, not the router itself.

What Attackers Can See

On unencrypted connections — anything without HTTPS — attackers see everything raw: usernames, passwords, form data, cookies. On HTTPS connections they can't read the content, but they can still see:

  • Every domain you visit — even on HTTPS
  • The timing and size of every request
  • Unencrypted DNS queries revealing your browsing
  • Session cookies on any site that doesn't enforce HTTPS strictly
  • Any app that uses unencrypted connections in the background

The $30 Part

The hardware required for a basic MITM attack costs less than a restaurant meal. A Raspberry Pi Zero or a cheap USB wireless adapter running Linux is enough. The software — tools like Bettercap, Wireshark, or Aircrack-ng — is free and open source.

Setup takes under five minutes for someone who knows what they're doing. The attacker doesn't need to be a professional hacker. Step-by-step tutorials exist publicly online. This is not a theoretical risk — it's a routine technique.

How a VPN Protects You

When you use a VPN, your device creates an encrypted tunnel before any data leaves it. Everything — DNS queries, HTTP requests, app traffic — travels through that tunnel. Even if an attacker intercepts your packets on the local network, all they see is encrypted noise. The destination, the content, the timing metadata: all hidden.

Public WiFi safety checklist

  • Always connect to your VPN before joining any public network
  • Verify the exact network name with staff before connecting
  • Avoid accessing banking or sensitive accounts on public WiFi without a VPN
  • Turn off auto-join for public networks in your device settings

Never worry about public WiFi again

SoloFlight encrypts everything before it leaves your device — on any network, anywhere in the world.