A friend of mine has set up WiFi on my PC, knows the password for the WiFi and knows my WiFi id. How and to what extent can he spy on my PC? And can he see the sites I visit?
There are 2 main factors here:
- the person configured your wifi
- the person was using your computer
Both of these factors open up opportunities for spying.
If the person set up wifi using the lowest possible security (WEP), it is possible that they (or others) would be able to monitor all your traffic.
But if the person intended to do harm, they would have installed something on your computer to give themselves much greater access than simply your network traffic.
The greater danger and threat, by far, is the access to your computer, not the wifi settings.
How and to what extent can he spy on my PC?
The password to the Wi-Fi network means very little aside from the fact you are authenticated to the network. Even if he or you cracked into the network without having previously known the password, either one of you would be able to see eachother's traffic.
WEP/WPA/WPA2 occur on Layer 2, because the fact you have "authenticated" to the network, you can now decrypt all packets on the network, which can be seen by anybody who has authenticated to the network.
If he knows how to use Wireshark or nmap even a little bit, he will be able to see the traffic going to and from your machine or scan for information about it. He may not be able to get valuable information out of all of it, but he can use said information to determine a rough picture of:
- What services or programs your computer is using
- What machines your computer is trying to talk to
- Who you are and what you do on your computer (if he doesn't know you well or at all)
Knows my Wi-Fi ID
If you mean your MAC address, IP address, or even the hostname of your machine, then he can use this information to isolate his monitoring of network traffic to only see what you are doing on the network.
Can he see the sites I visit?
He will be able to technically see every site you visit. However, if you use HTTPS, he will not be able to (without great effort) sniff cookies, usernames, passwords, or other sensitive information from websites. If you use HTTP, he can see everything.
Hint: The S is very important! S = SSL.
For the love of God man, make sure you're not authenticating to anything with HTTP.
I say that not just to protect you from your "friend" who you worry is spying on you, but to protect you from the rest of the big, bad Internet who, by the way, is out to steal your doge, wear your face, and devour your soul.
See Also - How to Know a Website Is Secure