This is the whole reason for the HTTP Cookie "Secure" flag: so that session IDs set over HTTPS aren't inadvertently handed out over HTTP.<p>If you log in at <a href="https://mail.google.com" rel="nofollow">https://mail.google.com</a>, your entire session is encrypted. If you log in via <a href="http://mail.google.com" rel="nofollow">http://mail.google.com</a>, your password is safe, but your session ID isn't.