Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It only takes a minute to sign up.
Sign up to join this community
In my haste and ignorance I inadvertently connected to an unsecure wireless network from my Android phone. It didn't ask my for any login credentials, or any other information - it just connected.
After about 30 seconds I realised my mistake and disconnected from the wireless access point. I didn't use the browser while connected.
So what type of data is sent by the Android phone on initial connection?
The only thing sent by Android itself is the captive portal check: a single connection to a Google web server, containing no personal or special data. Google Cloud Messaging also connects to a server using SSL, to receive push notifications that are waiting for your phone.
But any app on your phone can register to be notified when a Wi-Fi connection becomes available, so if an app was due to sync with a server, it might have done that in the background as soon as your phone connected. That could be any app that syncs with a server. Many apps send analytics or crash reports in the background even if that's unrelated to their main functionality. There's no way for you to tell afterwards which apps might have connected at this time, unless the app itself tells you when it last synced (or if it gave you a notification or you noticed new data arriving at that time).
Well-written apps (including all Google apps) use SSL to secure connections to the server, so that information can't be intercepted even on a hostile Wi-Fi network. Not all apps are this well written, though, and which servers you're connecting to are visible on the network regardless. Even if every app you use uses SSL correctly, just the fact they're syncing with the server tells an attacker that you use that app/service. This is a reason why you might want an always-on VPN even if you don't normally use open networks.
