On public Wi-Fi, QuickQ wants the captive portal finished before Connect. Kill Switch armed during that window hides the portal and looks like a dead client. Matching the cafe’s name does not make the AP theirs; a cert warning or a “install our booster certificate” page is a cellular moment. Hotspots are for browsing, not for banking or password changes.
Enterprise PAC and TLS inspection: office/hotel. Drop cadence: reconnect. The switch: Kill Switch. Builds: download. Threat picture: FCC public Wi-Fi tips.
Portals, isolation, twins
After association you can often reach only the splash. QuickQ handshakes to a pop time out. Trigger the portal with the system browser on a non-HSTS URL. Cookies expire after sleep. AP isolation means you cannot see the hotel printer; that is not a QuickQ defect.
Evil twin: stronger RSSI, no portal, or a portal that wants a root CA. Do not install it. QuickQ cannot bless a hotspot that demands a user certificate. Airplane mode, cellular only, compare egress once.
| Signal | Means | Move |
|---|---|---|
| Browser jumps to terms | Portal pending | Switch off, finish, connect |
| Must install a certificate | Untrusted | Cellular |
| Full bars, slow DHCP | AP overloaded | Another AP or LTE |
| Only UDP games suffer | Hotspot drops UDP | Compatible protocol |
The order that actually works
Switch off → portal → Connect → 1.1.1.1/help → switch on. Keep per-app lists boring; roam plus a long list misses rows—split. UDP dead, Compatible/TCP—protocol. Smart routing must Direct the portal hostname or the splash never loads—smart.
If you must log into QuickQ this hour, the hotspot may block the SMS API. Pull the code on cellular, then return to Wi-Fi for the tunnel—SMS. Do not type the password into a twin.
Travel routers and TV sticks are not a cafe plan
A travel router running its own VPN plus QuickQ on the phone is two tunnels. Keep one. Long-lived TV/router designs: TV/router. Do not flash firmware at gate B12.
Three hours of portal loops: stop, use the carrier
The same SSID kicking you is usually a session cap on the venue controller, not your pop. Five portal retries: LTE for the one task that matters. First-run: connect. iOS extension: permissions. Guides: hub. FAQ: FAQ.
Note which cafe SSID actually completes the portal. Prefer that over the loudest bars. Full-bar twins beat weak real APs at hurting you.