Connecting to free Wi-Fi at a coffee shop to reply to messages, temporarily logging into your account at a hotel business center, or installing Potato right after getting a new phone—these scenarios are common, but each step can leave security risks. The Potato team has put together a practical checklist to help you avoid the most common pitfalls.
Public Wi-Fi: Don't let others on the same network see your login status
The risk of open Wi-Fi isn't that "someone can crack the encryption," but that you have no idea who is sitting under the same router. Attackers can create a fake hotspot with the same name or sniff unencrypted traffic on the same local network. Potato's chat content itself is protected by end-to-end encryption, but the login process and verification code SMS can still be intercepted.
Here's what to do:
- After connecting to public Wi-Fi, first open your phone browser and visit an HTTPS website to confirm the address bar has a lock icon, then open Potato. If the browser shows a certificate error, disconnect from this Wi-Fi immediately.
- Do not repeatedly tap "Resend verification code" on a public network. If you don't receive the SMS after 3 consecutive attempts, switch to mobile data. Attackers often use frequent requests to trigger SMS bombing or interception.
- If you must use the web version on a public computer, immediately select "Log out of all devices" in Potato settings when done, rather than just closing the browser tab.
A real scenario: Xiao Li connected to "Free_Airport_WiFi" at the airport and received a login alert from an unknown device after logging into Potato. He ignored it at the time, and two hours later his account was used to send loan messages to friends. If he had opened the alert and selected "Not me," the session would have been terminated immediately.
Shared computers: Easy to log in, hard to clean up
Internet cafes, hotel business centers, company meeting room computers—these machines may have keyloggers or screen recording software installed. Even without malware, browser-saved passwords and cookies can let the next user directly access your account.
When using a shared computer, follow this order:
- Prefer using the Potato mobile app to scan the QR code for login, avoiding entering your password and verification code on the computer.
- If you can only enter your phone number, immediately go to "Settings > Privacy & Security > Login Devices" after logging in and check if there are any devices online that you don't recognize.
- Before leaving, click "Log out" in the top-right menu of the web version, then manually clear browser history and cookies. Just closing the window is not the same as logging out.
- After returning home, check the login device list again on your phone. If you find any suspicious devices, click "Remove."
Do not check "Remember me" or "Auto-login next time" on a shared computer. This option leaves your session token locally, and the next user can open the browser and directly access Potato.
New devices: First confirm it's you logging in
Changing phones, buying a tablet, installing an emulator—these will trigger Potato's new device verification. Verification itself is protection, not a hassle. When you receive a verification code, first confirm that this SMS comes from the device you are currently operating, not someone else initiating a login elsewhere.
If you receive a Potato verification code that you did not initiate, do not forward it to anyone, and do not take screenshots in any chat. Ignore it directly and change your password on your original device. Someone may be trying to log in with your phone number, and the verification code is the last door.
After successfully logging in on a new device, spend 1 minute doing three things: enable two-step verification, check active sessions, and turn off "Allow others to find me via phone number" (if you don't need to be searchable by strangers). These three steps can block most automated account theft scripts.
Potato will not ask you for verification codes through private chats, nor will it ask you to share your screen remotely. If someone claiming to be "official customer service" asks you for a verification code, just block and report them.
Security habits don't need to be complicated. On public Wi-Fi, take an extra look at the certificate; on shared computers, remember to log out of all devices; after logging in on a new device, check the session list. If you haven't installed Potato yet, you can find the version suitable for your system on the official website download page; if you're already using it, why not open settings now and spend two minutes confirming your login device list.
