Airport, Hotel and Bali Café Wi-Fi: A Traveller's Guide to What Leaks

Travelling in Indonesia means joining a new network almost every day: the gate lounge at Soekarno-Hatta, a guesthouse in Ubud, a beach café in Canggu, a long-haul ferry terminal with one overworked access point. Each is somebody else's equipment, and you have no way to inspect any of it. That is normal, and it is manageable — but it is worth knowing exactly what you are handing over each time you tap Connect.

What Each Network Can See

Your device joins a local segment shared with every other guest. Traffic that is not encrypted end to end is readable by them and by whoever administers the router. Most of what you do is over HTTPS now, so the contents — your messages, your card details, the body of your email — are protected.

The remainder still leaks. The network sees the name of every site your device resolves, how large each exchange was and when it happened. On a trip that adds up quickly: which airline you rebooked with, which bank you moved money through, which hotel you are checking into next, which employer's systems you logged into from a beach. None of that requires breaking any encryption. It is simply what the shape of the traffic reveals.

There is also the sign-in page problem. Captive portals and lookalike hotspot names are easy to imitate, and a network calling itself the name of your hotel is not proof that it belongs to the hotel.

What a VPN Changes

It puts everything inside a single encrypted tunnel between your device and a server you choose. The guesthouse router — and anyone else on it, real or impostor — sees one encrypted connection to one address. The site names, the sizes and the timing stop being available.

The limits are worth stating, since travel advice tends to oversell this:

• It protects traffic in transit. It does not repair a phone that already has something nasty on it, and it will not stop you from typing your password into a convincing fake page.
• It does not make you anonymous. It moves the trust: the hotel's network drops out of the picture, and how your VPN provider behaves takes its place. A no-logs policy is the thing to check.
• It does not change what is permitted anywhere. Indonesia applies category-level content filtering through the publicly documented Internet Positif programme, and a privacy tool is not a permission slip. Travel with that clear.

Doft VPN

Doft VPN gives you every server location free, with no paywalled regions. It uses modern cryptography and is built to hold a connection on the sort of overloaded hotel and airport Wi-Fi you meet on the road, which is where most VPNs get annoying. It keeps no logs of your activity, and it connects in one tap on Android and iOS. Premium adds higher speeds and raises the data allowance; the privacy features are free.

Use it for the thing it genuinely does: making every unfamiliar network you pass through a stranger to your work and your bank.