Public Networks in Indonesia: What the Café Wi-Fi Can See

Getting online in Indonesia is easy and, by most standards, cheap. Free Wi-Fi is offered almost everywhere — coffee shops in Kemang, mall food courts in Surabaya, co-working floors in Bandung, hotel lobbies and airport gates. The convenience is real. The part that gets less attention is the network itself, and what sitting on it means for the work you do there.

What an Open Network Actually Exposes

When you join a shared Wi-Fi network, your device joins the same local segment as every other device on it. Anything not encrypted end to end can be observed by those devices and by whoever runs the access point. Browsers and apps have improved this a great deal — most serious sites use HTTPS now, so the contents of what you send are protected.

What HTTPS does not hide is where you went. The name of every site you open is still visible to the network as your device looks it up, along with the size and timing of what you exchange with it. For scrolling through news over kopi susu, that may not bother you. For a freelancer opening a client's files from a café, or someone signing into internet banking from a mall, the pattern of who you deal with and what you are working on is often worth more than any single page.

What Encryption Changes

A VPN puts all of that traffic inside one encrypted tunnel between your device and a server you choose. The café router, the mall's access point and everyone else connected see a single encrypted connection to a single address, and nothing about what is inside. Site names, the shape of your session and the services you use stop being readable from the next table.

That is the whole of it, and it is genuinely useful. It is worth being precise about the limits, because VPNs are routinely sold as more than they are:

• It protects traffic in transit. It does nothing about a compromised phone, a phishing page you type your password into, or an app that hands your data away by design.
• It does not make you anonymous. It moves the trust rather than removing it: the network operator no longer sees your traffic, and how the VPN operator handles it becomes the thing that matters. That is why a no-logs policy is the claim to check, and why it should be checkable.
• It does not change what is permitted. A VPN is a privacy tool, not a legal one.

Filtering Is a Separate Matter

Indonesia runs a category-level content filtering programme, publicly documented under the name Internet Positif and applied by internet providers nationwide. It targets categories the ministry classifies as harmful, and it is a policy layer that sits above the network question this article is about. Encryption changes who can read your traffic on the local segment. It does not change what the rules permit, and we are not going to pretend otherwise.

Doft VPN

Doft VPN gives you every server location free, with no paywalled regions. It keeps no logs of your activity. It connects in one tap on Android and iOS, and premium adds higher speeds and raises the data allowance — but the privacy features are free, because a security tool that only protects people who pay is not much of a security tool.

Use it for what it is good for: making the network you happen to be sitting on stop being a party to your work.