App permissions, public Wi-Fi and shared devices

Apps and websites constantly ask to use your camera, microphone and location, and cafés offer free Wi-Fi to everyone. Saying yes without thinking quietly hands over access. This lesson teaches you to ask a simple question each time (does this really need it?), gives you the settings pages where you can look and change your mind, and clears up what public Wi-Fi and VPNs really do.

What permissions are

An app permission is your approval for an app or website to use a part of your device or your data, such as the camera, the microphone, your location, your contacts or your files. A torch app has no reason to know your location. A video call needs the camera and microphone but only while you are on the call. The rule is to give each app the minimum it needs to do the job you want, which is the least-privilege idea applied to apps.

Permissions are usually asked for in a pop-up with choices such as Allow, Allow only while using the app, Ask every time and Don't allow. Choose the narrowest option that works. You can change your mind later: refusing never breaks your computer, and you can allow it later if a feature really needs it.

Look at your own permissions

Permissions in the browser

Websites also ask, through the browser: to show your location, use the camera or send notifications. Notifications are often abused to show adverts or fake alerts, so refuse them unless you know why. To review them, click the small icon at the left of the address bar to see what the current site may do. In Firefox, open Settings then Privacy & Security and scroll to Permissions. In Chrome, open Settings, Privacy and security, then Site settings. You can also clear cookies and site data there, a topic from the earlier lesson on history and cookies.

Public Wi-Fi: the real risks

Public Wi-Fi in a café, a station or an airport is shared with strangers. Two things can go wrong. First, an attacker on the same network may be able to watch unprotected traffic. Second, and more common, the network itself may be fake: an evil twin is a hotspot named like the real one, such as “Cafe_Free_WiFi”, set up to capture what you do.

Today most websites use HTTPS, which encrypts the connection between your browser and the site, so someone on the same Wi-Fi cannot read what is inside it, even on a public network. This makes ordinary browsing much safer than it used to be. The remaining risks are fake networks, fake pages that you are tricked into trusting and old or misconfigured apps that do not use encryption.

VPNs: what they do and do not do

A VPN (virtual private network) creates an encrypted tunnel from your device to a VPN company's server, which then connects to the internet on your behalf. On public Wi-Fi it hides your traffic from the other people on that Wi-Fi. That is a real benefit. But a VPN has several myths around it. It does not make you anonymous: the VPN company can see what you do instead of the café. It does not stop malware, phishing or tracking by accounts you are signed in to. It does not make a bad website safe. And a free VPN with no clear business model may sell your data.

Shared devices

A family laptop, a tablet passed around or a work computer shared between colleagues needs a few rules. The best rule is one account per person. Each person's files, browser history, saved passwords and signed-in accounts stay separate, and a standard account stops others changing the system. On Ubuntu, an administrator can add users in Settings, then System, then Users. On Windows 11 use Settings, then Accounts, then Other users. Give each person a screen-lock password, and lock the screen with Super and L, or the Windows key and L, when you leave.

If you must share an account, do not save passwords in the browser, sign out of every site when you finish, use a private window for personal tasks and do not leave documents with private details in shared folders. For children, use separate accounts with the parental controls built into the system or the services they use.