Why You Should Encrypt *All* of Your Google Activities [POC]
Google, like any other legitimate service provider, encrypts login traffic, but not your content. So the moment you’re signed in they switch to plain-text communications and send everything to you in the open.
The quick fix: Use https instead of http for every Google service.