It seems that a major vulnerability has made Android.. uh.. vulnerable:

http://www.ubergizmo.com/2011/05/99-...can-leak-data/

According to one security team: it seems that login authentication 'tokens' are sent in plaintext over the wire rather than SSL.

Now, depending upon the contents of the tokens, this may not be insecure as the contents could potentially be signed themselves.

It doesn't sound good, but I'm interested to hear more.