So if the underlying connection isn't encrypted (like https) it essentially became open to anyone of the same network?