§ 01
Definition
An attacker can broadcast a network called 'Airport_Free_WiFi' or copy the exact name of a café's network. Devices that have joined that name before may connect automatically.
§ 02
How it works
Once you are connected, the attacker controls DNS and routing. They can show fake login pages, try to downgrade connections or simply log which sites you visit. HTTPS still protects page content, but metadata and any unencrypted traffic are exposed.
§ 03
Why it matters
A VPN encrypts everything from your device to the VPN server, so an evil twin operator sees only encrypted traffic to one address. Turning off auto-join for open networks and checking the network name with staff help too.