If the 400,000 activations is a lie, perhaps this is a lie too? ;-)

Alternatively: perhaps this catastrophic discovery (that insecure wifi is insecure on Android as well as Windows) explains why the world will end this weekend.

Alternatively: if you use an insecure wifi, the described vulnerability potentially gives a hacker on the same wifi access to photos, contacts or calendars. Not email, not banking details or confidential documents or whatever.

It's not really an Android issue: anybody silly enough to use a insecure http/pop/whatever login on an insecure network can have their details sniffed. Which is why at some point we have to ask why Google thought it would be OK to use http logins for internet apps on a mobile device that can automatically connect to an insecure wifi. In any case, the fix was to change to https on Google's own servers.

Unfortunately we can expect more of this: just as hackers targeted Windows and occasionally found a serious security hole, they'll be targeting Android and eventually they'll find something big. And Google will release a vulnerability patch, just as MS has done for years.