Encryption on Passwords provided through Post Requests

Question

I've been learning about networks and have been logging the post requests I make in firefox using LiveHttpHeaders. What is interesting is that when I log into sites, with or without https, the Post request which gets submitted includes my username and password in plain text! Isn't this dangerous in the case that a system administrator keeps logs of all network requests or if someone is listening on a wireless network? I've tried this on gmail as well as other sites. I would have thought that the people at google already thought of this problem, so am I forgetting something? Wouldn't it be wiser to encrypt on client side as well to overcome this possible security hole?

Here is the content block for a sample post request ( I have replaced my actual username and password with USER and PASS) for obvious reasons.

ltmpl=default&ltmplcache=2&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F%3F&service=mail&rm=false&dsh=8406886653173005655&ltmpl=default&hl=en&ltmpl=default&scc=1&ss=1&GALX=4EQjnPdWBb0&Email=USER&Passwd=PASS&rmShown=1&signIn=Sign+in&asts=

Answer 1

This is kind of off-topic, you might be better asking on a security mailing list or similar.

But i think your confusion is that the program you're using to track the information is decrypting the SSL session (assuming there is one). What your asking about ("client side encryption") is pretty much done by SSL. You might want to take a look into the subject.

Answer 2

When you submit information over an SSL-secured connection, only a party privy to the private key for the server with which you are communicating can read the data you submit.

So, although to you your username and password appear plain-text, this is because you are sniffing them before they are encrypted.

If you want to see what an SSL connection really looks like, put a packet dumper in between the client and server. Not running on either machine. Such a packet dumper will see a stream of encrypted, unreadable data.