Point-and-Click Gmail Hacking Shown at Black Hat
This is what I campaigning since the I knew about https://mail.google.com - use https always.