Yes it most definitely is. When you share a hotspot with other people, everyone's data is "floating" around and can be seen by their peers on the hotspot. So if you are browsing a non ssl site (address begins with http://) then your data is plain text that can be stored and used for nefarious purposes later.
Usernames and passwords to email accounts are easy to snatch. Facebook info was up until recently when they made ssl mandatory, as all websites should do where potentially sensitive date is transferred.
Now if you are surfing an ssl enabled site (address begins in https://) then your data is encrypted. So even though nosy neighbor has snatched and stored your data zipping through the atmosphere, it will take him/her the lifetime of the universe to decrypt your data. By then you will have moved onto other things and Grandma's secret cookie recipe will not longer matter.