Habits from the machine you work on · habit 32 of 40

Using somebody else's network

Office wifi, campus wifi, hotel wifi and the network in the cafe downstairs are all offered on purpose. Joining them is the intended behaviour, not a loophole.

The habit

You join the network that works, and your device rejoins it afterwards without asking.

Why it is automatic

The training here is unusually thorough because it paid off every time. A network appears in the list, you join it, the page loads faster, the video stops buffering. Years of that produce a reflex that does not feel like a choice.

Devices then automate the reflex for you. Once a network is saved, phones and laptops rejoin silently whenever they are in range, because the alternative is a device that constantly asks permission to do the obvious thing. That setting is on by default on most versions people are running.

The offer is also explicit. Guest networks come with a printed card, a sticker on the till, a line in the welcome pack, a slide in the induction. Somebody paid for the bandwidth and wants it used. Treating that as suspicious would be strange, and mostly it would be wrong.

What it actually does here

The first thing a network operator holds is an association record. A device with a particular identifier joined at a particular time, stayed a particular length, and moved a particular amount of traffic. That record exists on ordinary equipment without anybody configuring anything unusual, because it is how the equipment is managed and troubleshot.

The second is the portal. Captive portals exist to make you identify yourself before the connection opens. They take the device identifier automatically and then ask for whatever the operator decided to ask for: a room number, a surname, an email address, a phone number that receives a code. That form turns an anonymous device into a named one, and the row it creates is kept.

The third is retention. Guest and corporate networks keep logs because they have to. Support work needs history, abuse complaints need answering, and contracts or local rules often set a minimum period. This is why a hotel can say which device was on the network on Tuesday evening.

The fourth is that a managed device on a managed network sees more than the fact of a connection, because the device has been told to trust a certificate its administrator installed. That combination is common on corporate laptops and is covered from the device side on a device somebody else administers.

The record is about the connection, not the page

Anyone who has absorbed one piece of security advice has usually absorbed the one about encryption, and it is correct: the contents of a protected connection are not readable from the middle. What it was never meant to cover is the shape of the connection: when it started, how long it lasted, how much went each way, and which network it crossed.

Somebody reading about mars market mirrors from a hotel lobby has not handed a page title to the hotel. They have added a row saying the device registered to a particular room was online between certain hours. Those are different facts with different lifetimes, and the second is the one people forget exists.

The portal form is the part that names you

Recent phone and laptop versions present a randomised hardware address to each new network, which breaks the simple trick of following one identifier from place to place. It is a genuine improvement and it is on by default on many devices now.

It does very little once a portal form has been completed, because the form ties the randomised identifier to a surname, a room or an email for as long as that record is kept. The anonymity was undone by the reader, at the operator's request, in order to get online. That is not a failure of the feature. It is the portal doing its job.

What to do instead

The aim is not to avoid other people's networks generally, but to keep this reading off networks whose operator has reason to keep a named row.

1. Prefer the connection you pay for, even when it is slower. It has one operator instead of two, and no portal form asking who you are.
2. Do not complete a captive portal for this. A surname, a room number or a code sent to a phone is the moment the session acquires an identity.
3. Turn off automatic rejoining for networks you used once, so a device stops announcing itself in a building you happened to visit.
4. Remove saved networks you no longer use, so the list stops being a travel history sitting in your own settings.
5. Rename the device. Laptops and phones ship with a name built from the account holder, and the network they join can see it.

How to notice you did it anyway

The evidence of this habit is mostly in your own settings, which makes it easy to check.

• The saved networks list on the phone and on the laptop. It is longer than anyone expects and it reads like an itinerary.
• Browser history for the portal domain, usually a memorable name belonging to the venue or its supplier.
• The confirmation email or text the portal sent, still in an inbox with a timestamp on it.
• The device name in the sharing or about pane, which is what the network saw when the device joined.
• Whether the device rejoined a network on the way past without being asked.

What readers ask about this habit