Lets say I go to some hotel, the hotel has a WIFI network that requires as password and/or username to access. Can other hotelguests then see my wifi traffic if they are not logged in to the wifi, and can they see it when they are connected to the WIFI as a guest like me..but not as the network admininistrator (which CAN obviously see it)?
Yes, if they know what they're doing. See https://www.howtogeek.com/204335/warning-encrypted-wpa2-wi-fi-networks-are-still-vulnerable-to-snooping/ for an assessment of the vulnerabilities for WPA2-PSK (the most common form of encrypted WiFi). If the hotel wifi network uses WEP, that's even easier to crack, and if it doesn't use encryption at all (open Wifi), it's trivial.
The only way to protect yourself is to use a VPN service, so that all of your network traffic is encrypted at your end (regardless of whether you are browsing a news web site or doing Internet banking). This will protect you from someone snooping at the router as well.
Note that it doesn't stop anyone from kicking you off the wifi (via DEAUTH), but at least they won't get any of your data even if they capture the encryption key used between your device and their wifi hotspot.
Well, sort of.
Someone would wants to read your data has two options(that I can think of) to your your data. He could either try to sniff the data that goes over the air. This can be achieved by simply using a wifi interface and configuring it to run under monitor mode. You wouldn't notice a thing either, but the attacker would likely miss some packages.
The other option would be to conduct a man in the middle attack by using ARP spoofing. Basically tricking your computer to send data to his computer instead of the router, and then forwarding it to the router. He then does the same with data going in the other direction. (this by the way, also allows the attack to alter data going in either direction, allowing him to inject anything he likes)
However, Note that both these methods don't work against you if you use encryption. If you communicate with a website over https then your data should, usually be safe.
These attacks both only work if the attacker can access the network.
No. (assuming they're not using WEP) Under 802.11i security, even with everyone using the same PSK, the actual on-air encryption key is different for each station-AP pair. The "four-way handshake" uses a nonce from both the AP and the station (your laptop) to make a unique encryption key. There is a potential attack if this exchange (both messages) are observed.
Note that this only protects the data in the air. If someone can get to the wired network, then other attacks are possible.
Best to use a VPN and/or HTTPS connections to protect your data end-to-end.
The bottom line is you should always assume any public wifi network is high risk and your data is exposed to sniffing. There are people who will tell you as long as they are not using WEP your safe or that your OK if they use WPA2 etc, but this isn't enough.
One of the big problems with public wifi at hotels, coffee shops etc is that often, it isn't administered by someone who has strong technical and security knowledge. Systems can be mis-configured, may not have latest security patches, may be based on domestic rather than enterprise grade equipment, is unlikely to be monitored for threats etc. Bottom line, the wifi is a low profit 'add-on' service often run by people whose main objective is to have a sign saying 'free wifi' to draw business and who have little concern regarding the security of your data.
Then you have the other part of the problem - it is way too easy for bad guys to hack at the system. They can be anonymous, they can setup fake access points which easily fool users and they can take advantage of all the things mentioned in the first paragraph. I've actually sat in a motel, setup my laptop as an access point and just watched the number of poeple who try to connect - I reckon if I set up a fake capture portal that looked to be branded like the hotel I would probably get credit card details as well!
Note also that many of the capture portals used by hotels and the like are often very poorly designed. There are numerous posts on various security lists regarding vulnerabilities found in many commercial capture portal solutions.
So, assume your operating in a hostile environment. Only use services where you can be confident that your traffic is end-to-end encrypted or only use the service for low sensitivity data i.e. accessing public web pages etc. Check certificates before entering credentials etc.
If you travel a lot or are forced to use public or untrusted networks, consider setting up your own tunnel from your device to a server you trust and then use that server as a hopping off point to access other services. Tolls like ssh can do this - can be a pain to setup initially, but once you have it working, it works well.