Is there a need to encrypt data when send over https? I was monitoring web traffic from my Android mobile using Man in the middle proxy. I installed certificate signed from my server in my mobile and I could see all applications sending sensitive information like passwords as clear text.

I understand that SSL protocol takes care of establishing secure communication, but that eliminates any need to encrypt data? I could read all passwords sent by any application just by installing my certificate in the mobile.
Is there a need to encrypt data when send over https?


Maybe, but it would not be practical for widespread consumer use.

In order for this extra encryption to be effective against man-in-the-middle attacks, the client and server would already have had to agreed upon a pre shared secret out of band.