I think what it means is that if you have an application that logs into gmail (either as a home page when you open your browser, google talk or other compatible

I think what it means is that if you have an application that logs into gmail (either as a home page when you open your browser, google talk or other compatible client, or an email client such as outlook) automatically (after you've connected to the network but before you're connected to the internet) the application will try again, disabling ssl to see if that works. After you've finally connected to the internet, your application will log in to Gmail and open a session in Gmail without ssl. Then someone who is monitoring the unencrypted data will be able to sidejack your session. I'm pretty sure this is how it works, but correct me if I'm wrong.