Do not sign in to your website, email or bank on a hotel or other shared computer. Use your own phone or laptop, and if you already used a shared one, change those passwords from a device you trust.

Ten minutes at the lobby computer

On a summer trip, an owner remembers a price that needs changing on the website and an email that cannot wait. The hotel's business centre has a free computer, a printer and a sign welcoming guests.

Ten minutes later the page is updated and the email sent. The owner closes the browser and goes to dinner, assuming that closing it signed everything out.

Nobody at the hotel can say who used that computer before, what they installed, or what it will keep for the guest who sits down next.

A computer nobody can vouch for

A shared computer in a lobby is used by dozens of strangers a week, and many such machines let any user install programs.

One of those programs can be a keystroke logger, which records every key pressed, passwords included, and quietly sends the record to someone else.

Many of these machines still run Windows XP, whose regular security updates ended on April 8. Hotel staff are rarely in a position to check any of this.

What a shared machine can keep

Even without anything harmful installed, an ordinary browser on a shared computer holds on to a good deal:

A private browsing window prevents most of these, but it does nothing about a program recording the keyboard.

What not to do on one

Do not sign in to the website's administration area, your email, online banking, the domain registrar or the hosting account on a computer you do not control.

Do not download client documents, leases or contracts to it, and do not tick any box offering to remember you.

A shared computer is fine for a map, a weather forecast or a public web page: anything that needs no password and leaves nothing personal behind.

After using one anyway

If you have already signed in somewhere on a shared computer, change those passwords as soon as you can. Do it from your own phone or computer, never from the same machine.

Check your email settings for forwarding rules or filters you did not create. Copying incoming mail elsewhere is a common way to keep watching an account.

Look at the website's list of users and its recent changes. Then tell your web developer, so they can check the server's logs for anything unusual.

A worked example

A commercial real estate broker with a small office in Prince George leases industrial units and retail space, and posts each new listing on the brokerage's website.

Last August, on a family trip, a landlord called about a unit coming free. The broker added the listing from a resort's business centre computer, then answered a few emails before dinner.

Weeks later a client mentioned an odd message from the broker's address. The email account had a forwarding rule nobody in the office had set, copying incoming mail to an outside address.

Nobody could prove where the password had been taken. The resort computer was the one place it had been typed on a machine the brokerage did not control.

The broker changed every password from the office, removed the rule, checked the website's users and turned on two-step verification for email.

For this summer's trip, the broker travels with a small laptop and a data plan for the phone. The office manager can now post listings in the meantime.

Passwords are now typed only on machines the brokerage controls, and an urgent listing no longer depends on where the broker happens to be.

Your own phone on mobile data

A phone you own, on your carrier's network, is a far safer place to sign in than a lobby computer. Mobile data also avoids the hotel's network altogether. Buy a travel data package before leaving.

Small website edits are awkward on a phone but possible, and email apps work as well on the road as at home.

Your own laptop on hotel Wi-Fi

Your own laptop removes the unknown software, but not the shared network. On hotel Wi-Fi, a login page that is not encrypted sends the password across the network as readable text.

Check that the website's login page and your email both use encrypted connections, shown by https at the start of the address. If the site's login does not, ask whoever looks after it to change that before you travel.

Getting ready before you leave

Update the laptop and the phone before the trip. Make sure email sends from outside the office, and that someone at home can make urgent changes to the website.

Turn on two-step verification wherever your email offers it, so a password alone, wherever it was typed, is not enough to get in.

Carry the phone numbers of your host and of whoever looks after the site, so a problem on the road reaches someone who can deal with it properly.

The counter-case

Sometimes there is no alternative: a phone has died, a laptop was left at home, and something genuinely cannot wait until you are back.

Then do the one essential thing, type as little as possible, sign out, and change that password from a trusted device the same day.

Often the safest update of all is a short message from your phone to whoever looks after the website. They can make the change from their own office.

Before you pack

  1. Update the phone and laptop you will carry.
  2. Buy a travel data plan for the phone.
  3. Check that logins use encrypted connections.
  4. Turn on two-step verification for email.
  5. Arrange a second person who can update the site.
  6. Keep shared computers for maps and forecasts.
  7. Change any password typed on a machine you do not control.

Step five removes the temptation. With someone at the office able to post the listing or fix the price, nothing on the trip needs a password typed on a stranger's computer.

Setting up your own laptop and phone so that mail goes out from any hotel or trade show is covered in email that sends from the office but not on the road.

Frequently asked questions

Why are hotel business centre computers risky?

Strangers use them all week and many can install programs, including ones that record every key typed. Nobody can tell you what is installed or when it was checked.

Is a private browsing window enough?

No. It stops the browser keeping history and saved passwords, but a program recording the keyboard still captures everything you type.

What should I never do on a shared computer?

Sign in to your website, email, bank, domain registrar or hosting account, tick a box to be remembered, or download documents you would not want the next guest to read.

I already used one. What now?

From your own device, change the passwords you typed, check your email for forwarding rules you did not create, and ask whoever runs your site to review its users.

Is my own laptop on hotel Wi-Fi safe?

Much safer than a shared computer, since the machine is yours. Make sure the website login and email use encrypted connections, so passwords never cross the network as plain text.

What is the safest way to update the site while away?

Often a short message from your phone to whoever looks after the website. Otherwise, use your own phone on mobile data or your own laptop.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Planning to update the site while travelling?

Before your next trip, ask us to check that your website login and email are ready for use on the road.

Start a Conversation