I live with someone in the same house so we both use the same wifi. He knows the wep password because he set it up in the first place. He's not a hacker but he can set the wifi system at home. He has some computer knowledge from college.
Can he actually see the websites I visited? The URLs? What else can he see?
You mean he can actually see these things without having to hack? So this kind of information is not only available to hackers?
He knows the wep password because he set it up in the first place.
Firstly, WEP? If you are using WEP, anyone who knows how to download some tools and owns a laptop will be able to see your network traffic. WEP is terrible.
Can he actually see the websites I visited? The URLs? What else can he see?
Basically, if the guy is on the same network as you, he can see everything you do. If the websites you are visiting is being served through HTTPS, he will not be able to see the exact data you are sending but he will still be able to tell where and when you visit the site.
Terry has already answered your question, but I'd like to provide more information.
The type of WiFi security is only a side issue. The main issue is that you are using a network that he controls. Presumably he controls the router, switches, and access points.
Therefore, even if the WiFi network used WPA2, your network traffic would still be vulnerable to intercept at the network level. One way of doing it would be to configure a transparent proxy with verbose logging enabled. Another way is to configure a span port on the router.
In summary, if you can't trust the person running the network, you can't be certain that your traffic is not being intercepted, regardless of the WiFi security protocol being used.
The short answer is yes. Anyone on the same network as you can usually view your traffic by carrying out a very basic Man in The Middle (MiTM) attack like ARP Cache Poisoning. I cover ARP Cache Poisoning in a lot of detail in one of my blogs about Session Hijacking, which is another form attack that you're susceptible to here.
Also, as pointed out by others, WEP is a terrible security protocol and I give a demonstration of how you can bypass WEP security in 3-4 minutes in another blog here.
In terms of what he can see, he can always see the sites you're visiting. If the site uses HTTPS then he can't see the data you're exchanging, but if it's HTTP then he could see everything.
You also become vulnerable to a lot of other attacks like SSL strpping, DNS spoofing, code injection and others. Your network is a trusted zone and should be restricted to only clients that you trust. Not only that but if he uses your Internet connection to conduct illegal activity you could find yourself in some hot water. I suggest you upgrade to a stronger security protocol like WPA2 and change the key to something only you know.
I've written another blog showing how WPA2 is near impossible to break if you use a proper PSK here. If your router has WPS I would also disable that for additional protection as it present a weak point in WPA2 security as detailed here.
