In my home I have a router protected with WPA2-PSK (WPA2 Personal), using the passphrase.
When I try to log in to a page over the Internet (this page does not use HTTPS to log me in), all my data is sent in clear text (since I can see the password I typed in Wireshark).
Why is that? I mean, my WiFi is protected, so all the communication should be encrypted, right?
I mean, my WiFi is protected, so all the communication should be encrypted, right?
It is, but not at the place you're reading it. Encryption happens at a certain point in the "pipeline", and decryption then must also happen at a certain point in the "pipeline" (otherwise the data are useless). You are observing the data after they have been decrypted, which would not be possible if you were using HTTPS (which instead provides end-to-end encryption, which starts at the server and ends at the browser).
If you attempted to use Wireshark to capture the contents of an HTTPS transaction, it'd be like this:
+--------+ (encrypted) +----------+ (encrypted) +--------+
| Server | ----------->| Internet |------------>| Router |
+--------+ +----------+ +--------+
|
| (encrypted)
+------------------+---+
| Your PC | |
| +-----------+ (e)| |
| | Browser |<---+ |
| +-----------+ | |
| +-----------+ (e)| |
| | Wireshark |<---/ |
| +-----------+ |
+----------------------+
Here, your browser knows how to decrypt the data, because it "owns" the HTTPS transaction in the first place; your Wireshark instance (which, per the very purpose of end-to-end encryption, is treated just like any other snooper in this scenario) does not.
But your wireless encryption starts at the router and ends at the PC's network card, so the result for you is more like this:
+--------+ (plaintext) +----------+ (plaintext) +--------+
| Server | ----------->| Internet |------------>| Router |
+--------+ +----------+ +--------+
|
| (encrypted)
+------------------+---+
| Your PC | |
| +-----------+ (p)| |
| | Browser |<---+ |
| +-----------+ | |
| +-----------+ (p)| |
| | Wireshark |<---/ |
| +-----------+ |
+----------------------+
Here, anything on your PC can read the data, because they were decrypted by your network card. Otherwise, what application would decrypt the data? Nothing would work.
There is almost no relationship between HTTPS and WPA2-PSK; they do completely different jobs.
Using a router with WPA2-PSK (or any other network encryption algorithm), does not mean all sites are forced to use https. It means that that the unencrypted traffic is not visible to those who are not connected to the network.
Consider HTTPS as a relationship between your browser and the website.
Consider WPA2-PSK as the relationship between your device and your access point.
When you run Wireshark on a computer, you're capturing the traffic that the computer can "see".
If you run Wireshark while browsing HTTP websites, the computer "sees" data in clear text, because the Wi-Fi encryption occurs at the router/access point level, which is known as "link layer".
If, on the other hand, you run Wireshark while browsing HTTPS websites, Wireshark "sees" encrypted data, even if you're not using Wi-Fi encryption, because HTTPS encryption (SSL/TLS) occurs at the browser level or, more precisely, at the "application layer".
Think this way.
An access point allows several devices to connect to the Internet. Without any kind of encryption, any device (whether inside or outside the wireless network) would be able to "see" traffic in clear text from and to any device connected to the network. Wi-Fi encryption prevents devices outside the network from seeing your traffic (that's what the passphrase is used for) and prevents devices inside the network from spying on each other (simplifying a bit, data are encrypted with different keys for each device). Therefore, if Alice and Bob are connected to the access point AP, not only Eve (who is outside the network) cannot see the traffic related to Alice and Bob, but Bob cannot see what Alice is doing, and viceversa.
However, the owner of the Wi-Fi network can easily see what Alice and Bob are doing.
The analogy
Think about encryption (for the moment) as a series of tubes, and about data as letters sent through those tubes.
The wireless network is a huge room where you can read, write, and transmit messages, since it also includes a post office (access point).
The post office allows your letters to be sent to somebody using another box, perhaps on the other part of the world. It does so by checking the address written on the letter and sending to it.
If Wi-Fi encryption is used, the room is locked and every user has a distinct tube, through which he can send and receive messages.
The Internet is everything which is outside of the huge room. Alice and Bob are inside the room, Eve is outside of it.
Disclaimer: for the sake of brevity, talk=write and read in this context
1) If the room wasn't locked, without tubes, and you were sending clear text postcards (no Wi-Fi encryption, no HTTPS), you would have a working post office (correctly sending and receiving letters), but a very insecure one. Alice could grab the letters sent by Bob, and viceversa. In addition, anyone could enter the post office and grab any letter. In other words, it would be a huge mess.
2) Wi-Fi encryption, no HTTPS corresponds to a locked room using one tube per person, so that Alice cannot grab the letters sent or received by Bob. Clearly, Eve who's not even in the room, can't see anything. However, those letters are clear text postcards, meaning that the content is not encrypted. This means that the post office can see everything you send and receive.
Now, you may not like this. Why should the post office be able to read your messages if they only need to dispatch them? You then agree with the people you're communicating with, and decide to write coded or encrypted postcards. For example, HI MIKE would become FJSDJHDNFSJ.
This way, the post office cannot understand what you and your friends are talking about.
3) A system involving encrypted cards and an unlocked room with no distinct tubes is similar to no Wi-Fi encryption, but HTTPS. So the post office doesn't know what you're writing and reading, and Eve (who is outside of the locked room, but can see your letters as they exit the room) can collect or copy your messages but cannot understand them. Everything is fine, right? Well, no. Bob, Eve, and other people (both inside and outside of the network) can still see who you're talking to.
4) If the system involves a locked room with distinct tubes and encrypted postcards, it's similar to Wi-Fi encryption + HTTPS, which is pretty nice. No one knows what you're talking about, and only the post office knows who you're talking to.
TL;DR. HTTP on password-protected Wi-Fi allows you and the access point owner to read your traffic, even if other people on the same network can't.
HTTPS on password-protected Wi-Fi means that only you can read your traffic, and only the access point owner knows which websites you're visiting.
As an aside, if you don't want the AP owner to know which websites you're visiting, you should use other solutions, including VPNs and Tor.
That your wifi is WPA2 protected just means that the signals sent over the air from your computer to the router are encrypted, nothing else. From there onwards (from the router to the next hop of your ISP and then eventually to the web server serving your request) the traffic is unencrypted.
https, however, provides end-to-end encryption. One end is your browser (on your side), the other end is the web server serving the request. End-to-end means that no entity between those 2 ends can see the plain text. Check an arbitrary https website and you'll see: Wireshark can't see anything because wireshark listens on the network interface and that only gets the data after the browser has already encrypted it. On the other hand, WPA2 is not end-to-end. The network device handles encryption (and Wireshark intercepts the data before the device does so). That is why you can see clear text data.
An important point to make here is that what you can do on your computer everyone else can do on every internet router that gets the data in between your wifi router and the web server. Therefore, consider WPA2 as a means to protect the privacy of the sent-over-the air part of your home network. If you want confidentiality of communication that goes over the internet, end-to-end encryption protocols (like https) are the method of choice.
There are a lot ideas rolling around here, with varying degrees of inaccuracy.
WPAx encrypts traffic over-the-air, between your device and your wireless access point (AP), and nowhere else (including the router).
Even if you have just one device that you call a "router" or a "modem" you actually (typically) have 4 devices. They are all just built into the same box for convenience and to make network configuration easier for home users. On my own network(s), literally all of these are physically separate devices.
You have:
WPAx only encrypts packets between your devices and the AP.
The AP decrypts the packets, transforms them into regular old Ethernet packets and forwards them to the switch. Anything else plugged into that switch could potentially read your packets in plain text.
Your router is also connected to the switch, and the modem is connected either to the router or to the switch.
The traffic path looks like this:
[device ----- AP] ---- switch ---- router ---- modem -> Internet
WPAx |
|
computer, printer?
WPAx is a wireless-only security protocol. It's part of the path between your devices and your access point. If you have a computer plugged into your switch with a cable, that computer could see your "wireless" traffic unencrypted, and likewise any packets that go out to the Internet through your router and modem are also unencrypted.
WPA2-PSK encryption is to protect wireless radio emission between PC wireless card and Wifi router. The payload (data) transferred between PC client (i.e. web browser) and remote server can be encrypted (SSL,etc.) or not - this is another layer. Without WPA2-PSK anybody in near range (~50 meters) can spy all your traffic. For simple comparison imagine that Wifi with WPA2-PSK is enthernet cable going inside your house where external people don't have access and without WPA2-PSK the same cable is going through public place (street, roof, etc.)
Although there is a thing called "Internet Protocol", there is no single protocol that makes up the Internet. Rather, the Internet is made up of many different protocols, several of which are used together at any one time to form what's called a stack.
The lowest layer in the stack is called the link layer, and it handles the question of how to get a signal between two machines that are directly connected somehow. Ethernet is an example of a link-layer protocol. So is Wi-Fi, and so is PPP (used most famously by modems, but DSL and cell phones also use it behind the scenes).
The next layer is called the Internet layer, and it handles the question of how to get a signal between two machines that aren't directly connected, using a series of machines which are. IP (the "Internet Protocol" I mentioned above) lives here. Note that the link layer doesn't have to know or care how the machines are connected: it is theoretically possible that your data might go through Wi-Fi, Ethernet, PPP, and more exotic kinds of links on the way to its destination, and it won't make any difference.
Above this is the transport layer, which takes the signal and turns it into meaningful data of some kind. TCP, which collects these signals and turns them into longer-lasting "connections" lives here. So does UDP, which is less concerned about connections and just blasts bits of data back and forth. as do a number of other things.
Last comes the application layer, where the data from the transport layer is interpreted for particular purposes. HTTP lives here, as do various messaging protocols, most game protocols, and most of the other things we tend to think of when we think of the Internet.
The reason all of the above this is important is that encrypting Web traffic only affects the layers at or below the layer where the encryption happens. WPA protects Wi-Fi, which is a link-layer protocol: The traffic is indeed encrypted, but only between the two machines that are directly connected, because that's how link-layer protocols work. Wireshark sees the cleartext because by the time the traffic ever gets to it, it has already been decrypted.
To make Wireshark unable to sniff the contents of a connection, you have to encrypt it in a higher layer than Wireshark works at, so that it hasn't been decrypted by the time Wireshark sees it. This is what SSL/TLS is for. It works in the application layer (though it acts like another transport layer, thus the name "Transport Layer Security"), so if you run Wireshark on it, it will see encrypted text. There actually are ways to get Wireshark around this, but they involve fundamentally altering the connection so that Wireshark can act as a man-in-the-middle. It's not something you can do unless you already know the encryption keys the connection will use.
