Magic Underwear posted:

They can track it, sure. Anyone on the network can, by setting their wireless NIC to promiscuous. The owner of the AP could also be logging all traffic.

That doesn't give them the CONTENT that you're looking at, but at the very least, even on an SSL connection, somebody could see what IP addresses you were accessing (from TCP header) as well as domains/subdomains (from DNS requests). I believe that in an HTTPS connection the full address you are requesting would be encrypted. So for example I would be able to see that you were requesting data from forums.somethingawful.com but I would not know whether it was to read a thread, make a post, edit a post, or whatever (assuming the whole thing was https, which it isn't).