Answer from a Networking Engineer is yes , yes he can. Not in plan text though he would have to get access first.
by Default on most "carrier phones" no, he will need to root that phone and install bitshark or just install Kalilinux
Then your fucked.
as for Facebook, they use SSL and Tokens so your good unless he spoofs Mac and captures the token
Then just redirect the traffic. But i would say your Friends do not know this
This post was edited by xJukEx on Aug 7 2018 10:19pm