Protecting Kids When They Use Other People's Devices and Networks

Your home network is set up. Content filters are running. Parental controls are in place. Then summer break arrives, and your child spends a week at their grandparents’ house, connects to the hotel WiFi on a family vacation, and logs into their school account from their best friend’s family laptop. All that careful setup at home doesn’t travel with your child — and the security environment they land in may be very different from what you’ve built. This isn’t about paranoia. It’s about understanding the actual risks of different environments and giving your child the specific habits that protect them regardless of where they connect.

Key Takeaways

• Shared devices often have saved passwords, auto-fill data, and uncleared browser history that children can inadvertently access or accidentally expose.
• Hotel and public WiFi networks carry specific risks: network-level monitoring, man-in-the-middle vulnerabilities, and malicious hotspots with legitimate-sounding names.
• Grandparents’ and friends’ home networks may lack modern security practices — weak passwords, outdated routers, and no firmware updates are common.
• Children need a pre-departure checklist of behaviors for using devices and networks they don’t own.
• Basic VPN use is now within reach of middle schoolers and is the most effective single protection against public WiFi risks.

The Shared Device Problem

When your child sits down at Grandma’s Windows laptop to check their school email or play a quick game, several things are immediately different from their home setup:

Saved credentials. Most browsers auto-save usernames and passwords unless explicitly configured not to. If your child logs into their school account, email, or any social platform on someone else’s browser and saves their password when prompted, that credential is now stored on a device outside your control. Conversely, if your child clicks “yes” when prompted to save a password, your child can now potentially see saved passwords from the device’s other users.

Browser history and cookies. An uncleared browser stores visited URLs, search history, and active session cookies. If a grandparent stays logged into their online banking on Chrome, and your child opens a new tab to “just look something up,” the banking interface may be visible or accessible in the same browser session.

Monitoring software. Some family and household devices — particularly those used by children in the home — have parental monitoring software installed. If your child visits a friend’s house and uses the family computer, any activity on that device may be logged and visible to that family’s parents. This isn’t a danger per se, but it’s worth your child knowing their activity on any device they don’t own is potentially visible.

Pre-installed malware or adware. Older household computers frequently carry adware, browser extensions, and in some cases malware that was installed through unsafe downloads over years of use. Security software expired or never purchased; last antivirus scan: never. Keyloggers in particular are a concern — your child logging into their account on an infected computer could expose credentials even if they don’t save them to the browser.

What to Teach Before Your Child Uses Someone Else’s Device

Give your child a simple pre-session checklist:

1. Use a guest browser profile or private/incognito mode. This prevents saving history, cookies, and passwords to the host device. Teach your child to open a private window (Ctrl+Shift+N in Chrome, Ctrl+Shift+P in Firefox) before logging into anything.

2. Never click “Save password” on someone else’s device. Your credentials should not live on equipment you don’t control.

3. Log out of everything before closing. Private mode helps, but habituating the logout step closes any session-based exposure.

4. Don’t do sensitive things on shared devices. Email and school accounts: okay with private mode. Online shopping with saved payment information: not okay. Logging into family financial accounts: not appropriate.

5. Tell a trusted adult if the device behaves strangely. Pop-up floods, sudden redirects, or unexpected behavior are signs of infection. Children should know they won’t get in trouble for reporting that something looked wrong.

Hotel and Public WiFi: The Actual Risk Level

Parents often have one of two incorrect mental models of public WiFi: either it’s completely safe, or connecting to it guarantees you’ll be hacked. The accurate picture is more nuanced.

What public WiFi cannot do to a modern device by default: It cannot inject malware into a properly updated device. It cannot bypass HTTPS encryption on a modern browser. It cannot access files on your device without exploiting a specific vulnerability.

What public WiFi can do:

Network traffic monitoring. The hotel, coffee shop, or ISP running the network can see which domains you connect to, even if they can’t see the content of HTTPS connections. “Your child visited discord.com at 2 AM” is visible at the network level; the messages inside Discord are not.

Man-in-the-middle attacks. On an unencrypted or poorly secured network, a sophisticated attacker on the same network can intercept traffic between your device and a server, particularly on HTTP (non-S) connections. Most legitimate sites now use HTTPS, which provides encryption in transit.

Evil twin access points. An attacker creates a WiFi hotspot with the same or a similar name as the legitimate hotel WiFi — “Marriott_Guest” alongside the real “Marriott_Guests.” When a device connects to the fake network, all traffic passes through the attacker’s system. Children who don’t verify the network name with staff are vulnerable to this.

The single most effective protection: a VPN. A Virtual Private Network encrypts all traffic between the device and a server operated by the VPN provider, making it unreadable to anyone monitoring the local network — including evil twin operators. Consumer VPN services like Mullvad, ProtonVPN, and NordVPN work on phones, tablets, and laptops. Mullvad in particular offers strong privacy practices at around $5/month.

For families, enabling a VPN before connecting to hotel or public WiFi is a good habit to establish before a trip. Teach children: “Turn on VPN, then connect to WiFi. Always in that order.”

The Grandparents’ Network: Affectionate but Unsecured

Grandparents’ and extended family members’ home networks introduce a different set of risks than hotel WiFi — lower sophistication but higher exposure time.

Router firmware: Many home routers run on firmware that hasn’t been updated in years, containing known vulnerabilities that make the network susceptible to local exploitation. A 2022 ESET study found that 25% of home routers in the US were running firmware with known critical vulnerabilities.

Default or weak passwords: A significant portion of home routers still use default credentials or simple passwords, particularly among older adults who set up the router once and never changed it. This makes the network accessible from outside by anyone who knows the default credentials for that router model (these are publicly listed).

No DNS filtering: Home setups without DNS-level filtering (like Pi-hole or router-level content blocking) don’t filter content categories. Your child’s home network may block certain content categories; grandma’s likely doesn’t.

Practical steps before a visit:

• Offer to help update the router firmware as a brief tech-help moment. Most router admin pages are accessed at 192.168.1.1 or 192.168.0.1 — log in with the credentials on the router label and check for firmware updates.
• Suggest changing the WiFi password from the default if it hasn’t been done. This protects grandma too.
• Know that your child may access content at grandma’s house that the home setup blocks. That’s a conversation to have in advance, not something to be discovered after.

Friends’ Homes: Monitoring and Unfiltered Access

A friend’s home introduces social complexity alongside security concerns. Your child will likely spend hours on WiFi you know nothing about, potentially on devices their friends own.

The monitoring reality: Many parents who have children of similar ages use parental monitoring or network filtering software. Your child’s activity on a friend’s home network may be visible to that family’s network tools. “Your son visited YouTube at midnight” is the kind of thing a well-configured home router can log and report. Children should know that being at a friend’s house doesn’t mean being unmonitored.

The unfiltered access reality: Conversely, many homes have no content filtering whatsoever. A child who is accustomed to content restrictions at home will encounter an open internet at many friends’ houses. This is one reason why the family cybersecurity audit conversation includes values and not just technical controls — controls that only exist on your network don’t build the internal compass your child needs elsewhere.

Signs a device may be compromised:

• Excessive pop-up advertisements
• Browser redirects to unexpected sites
• Slow performance on a normally fast device
• New browser extensions or toolbars that no one installed
• Antivirus warnings that fire repeatedly
• Battery draining unusually fast (mobile devices)

If a friend’s computer shows these signs, discourage your child from logging into anything on that device.

Building the Family Protocol

Rather than a long set of rules, give your child a simple mental model: “Would I be comfortable if Mom/Dad could see exactly what I’m doing on this device and network?” If the answer is yes, proceed. If no, don’t.

Beyond that, build three specific habits before any trip or visit to another household:

Pre-departure: Make sure your child’s devices are updated, their VPN is installed and they know how to use it, and they have your contact information easily accessible if something feels wrong.

During: Connect to VPN before any unknown network. Use private browsing on shared devices. Log out of everything before leaving.

After return: If your child used a shared device, change their passwords for any accounts they accessed on it. This sounds excessive, but it takes three minutes and removes any credential exposure from saved passwords or keyloggers.

For a broader look at account security practices, our guide on two-factor authentication for family accounts covers the layered approach that makes a potential credential exposure from a shared device much less catastrophic.

What to Watch For Over the Next 3 Months

• Apple’s upcoming iOS 20 release is expected to include expanded iCloud Private Relay features — effectively a built-in VPN for Safari traffic — for devices on supported plans. This simplifies one layer of public WiFi protection for families in the Apple ecosystem.
• Several major hotel chains are upgrading their in-room WiFi infrastructure to WPA3 encryption standard, which provides stronger individual device isolation on shared networks. Ask about network security when checking in if it matters to you.
• The FTC’s ongoing investigation into router security practices may result in guidance that pushes ISPs to provide automatically updating firmware — watch ftc.gov for consumer advisory updates.

Frequently Asked Questions

Is hotel WiFi actually dangerous for kids, or is this overstated?

The risk is real but manageable with simple habits. The biggest practical risks are evil twin hotspots (verify the network name at the front desk) and unencrypted HTTP connections (check that sites show “https://” in the address bar). A VPN eliminates most network-level exposure. Without any protection, hotel WiFi is meaningfully riskier than home WiFi; with a VPN, the risk drops to near-home levels.

Should I set up a VPN on my child’s phone before a trip?

Yes, and it’s straightforward. Mullvad and ProtonVPN both have simple mobile apps. Enable the VPN, test that it connects, and show your child how to turn it on. Set the device to connect automatically on unknown networks if the app supports it. The whole setup takes 10 minutes.

What if grandma refuses to update her router or change her WiFi password?

You can’t force it, and you shouldn’t create family tension over it. Focus on what you can control: ensure your child uses their own device (rather than grandma’s), runs a VPN, and follows the private browsing habit. The grandparents’ network being somewhat insecure doesn’t mean disaster — it means layering in protections you carry with you.

How do I talk to my child about this without making them paranoid about technology?

Frame it the same way you’d frame road safety: “Most of the time nothing bad happens, and doing these three things means we’re prepared for the rare time something could.” Children handle practical preparation better than fear-based warnings. Normalize the VPN, normalize private browsing, and normalize logging out — make it a habit, not a scare.

---

About the author Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.

---

Sources

1. Federal Trade Commission. (2023). Protecting Kids Online: Tips for Families on the Go. consumer.ftc.gov
2. ESET. (2022). Home Router Security Report 2022. eset.com/blog
3. Cybersecurity and Infrastructure Security Agency. (2023). Using Public Wi-Fi. cisa.gov
4. National Cybersecurity Alliance. (2023). Traveling with Technology: Stay Safe on Public Networks. staysafeonline.org
5. Krebs, B. (2022). The Fake Wi-Fi Playbook: How Evil Twins Work and Why They Persist. krebsonsecurity.com
6. Electronic Frontier Foundation. (2023). HTTPS Everywhere: Why Encryption in Transit Matters. eff.org