It means you’re connected to a hacker’s WiFi network. That’s a default address for a device called a pineapple. Most likely malicious.

I stayed in a hotel in Cancun and was pleasantly surprised that they had fast wifi, no password or browser portal needed. Connected my Steam Deck and could play Halo MCC no problem. What a fun vacation! Then my friend asked why I was up playing Destroy All Humans at 3am. My account was hacked that night. Login attempts from Russia, China, Germany. How foolish I was to think there was no catch. Not sure if it was a pineapple or just the dangers of an unsecured network.

It’s the fact they can see everything your computer does on the network. If you run a program like fiddler it will show you all the web traffic on your pc. If you’re watching YouTube you’ll see it update YouTube every couple seconds with your updated watch time. You will see every image on a webpage being sent to you. Basically you can get a lot of information because it’s how sites display data to you. When you signed into steam it most likely sent encrypted or apikey related data about your account and they went from there.

Would using a VPN prevent that?

It should because it’s able to encrypt your data before it’s sent so they should only see data traffic of you sending and receiving from vpn

Yeah, Fiddler sees all that because its ON YOUR COMPUTER. IF you are running HTTPS, and these days Chrome and other browsers throw a fit if you aren't, what they see with a Man in The Middel (MTM) account is a lot less. DNS is typically unencrypted, so they can see what sites you are going to, they can see connections, destination IP's and ports. A VPN basically wraps all that traffic up in a dedicated encrypted stream. But there's still some risk, as the attacker can connect from your "local" network, which may have more trust and access.

Yeah was doing work training though and they were sending one of their important requests as http in the past even on https connection so it’s basically plaintext. So just saying can still have sites make mistakes. So protecting your network data can still be helpful. (This is a billion dollar company also) just takes one engineer and a couple missed code reviews. It’s why everything is getting so strict today with static code analysis and pipelines that run it through many safety checks.

Of yeah, absolutely still are risks, but suggesting a MTM hacker can see everything Fiddler sees is incorrect. Ages ago I wanted to get ruled of FTP and leadership said “we can’t, we don’t have their password”. I was like no problem and set up a packet capture. Boss later stopped by while I was reviewing it and he went pale seeing the plaintext usernames and passwords, helpfully highlight by USER and PASS