My passphrase is pretty long, brute forcing it would be impressive
Does it meet typical complexity requirements? While length is good, mixing in symbols, uppercase/lowercase, & numbers really adds strength. If it's long but, uses standard wording, it can be brute forced.

Isn't the HTTPS between my browser and the PayPal server?
The connection between what you see on your monitor & the path it takes to get there can be confusing when you use wireless.

Computer-->(WPA encrypted traffic)-->wireless router--> Internet

Basically, there's no HTTPS between your computer and your wireless router. The conversation between your wireless card & your wireless router doesn't use the internet. That's what WPA is for. It encrypts traffic between your computer & your wireless router.