In my home I have a router protected with WPA2-PSK (WPA2 Personal), using the passphrase.

When I try to log in to a page over the Internet (this page does not use HTTPS to log me in), all my data is sent in clear text (since I can see the password I typed in Wireshark).

Why is that? I mean, my WiFi is protected, so all the communication should be encrypted, right?


  I mean, my WiFi is protected, so all the communication should be encrypted, right?


It is, but not at the place you're reading it. Encryption happens at a certain point in the "pipeline", and decryption then must also happen at a certain point in the "pipeline" (otherwise the data are useless). You are observing the data after they have been decrypted, which would not be possible if you were using HTTPS (which instead provides end-to-end encryption, which starts at the server and ends at the browser).

If you attempted to use Wireshark to capture the contents of an HTTPS transaction, it'd be like this:

+--------+ (encrypted) +----------+ (encrypted) +--------+
| Server | ----------->| Internet |------------>| Router |
+--------+             +----------+             +--------+
                                                     |
                                                     | (encrypted)
                                  +------------------+---+
                                  | Your PC          |   |
                                  | +-----------+ (e)|   |
                                  | | Browser   |<---+   |
                                  | +-----------+    |   |
                                  | +-----------+ (e)|   |
                                  | | Wireshark |<---/   |
                                  | +-----------+        |
                                  +----------------------+


Here, your browser knows how to decrypt the data, because it "owns" the HTTPS transaction in the first place; your Wireshark instance (which, per the very purpose of end-to-end encryption, is treated just like any other snooper in this scenario) does not.

But your wireless encryption starts at the router and ends at the PC's network card, so the result for you is more like this:

+--------+ (plaintext) +----------+ (plaintext) +--------+
| Server | ----------->| Internet |------------>| Router |
+--------+             +----------+             +--------+
                                                     |
                                                     | (encrypted)
                                  +------------------+---+
                                  | Your PC          |   |
                                  | +-----------+ (p)|   |
                                  | | Browser   |<---+   |
                                  | +-----------+    |   |
                                  | +-----------+ (p)|   |
                                  | | Wireshark |<---/   |
                                  | +-----------+        |
                                  +----------------------+


Here, anything on your PC can read the data, because they were decrypted by your network card. Otherwise, what application would decrypt the data? Nothing would work.

There is almost no relationship between HTTPS and WPA2-PSK; they do completely different jobs.
