I connected to an open WiFi at Kuala Lumpur Airport to read a news site from home (I know I was being absolutely careless).
I forgot to turn off sync on my Android phone, so all my apps "fired".
2 minutes later I get a warning email from Google that someone knows my password and tried to log in from the Netherlands.
I would like to know how it was possible - is Android Gmail app susceptible to MITM + sslstrip attacks? If no, how else could it have happened? Does a well-configured VPN protect against such attacks?