Gmail uses a cookie to keep you logged in. The problem is that "every time you access anything on Gmail, even an image, your browser also sends your cookie to the website. This makes it possible for an attacker sniffing traffic on the network to insert an image served from http://mail.google.com and force your browser to send the cookie file, thus getting your session ID. Once this happens the attacker can log in to the account without the need of a password. People checking their e-mail from public wireless hotspots are obviously more likely to get attacked than the ones using secure wired networks," says Hacking Truths.
You can avoid the problem by using a secure SSL connection, eg by logging on via https://mail.google.com
You can turn SSL on permanently by going to Settings and the General tab. The bottom of the page offers:
Browser connection: Always use https Don't always use https
Select "Always use https".
The story says that Mike Perry, who told Google about the problem a year ago, is planning to release a tool that will help hackers exploit the insecurity.
