[euroclydon]

I guess they put this off mainly because of the performance hit. I found the following quote regarding HTTP vs HTTPS performance on SO:

One point that has been brought up by several others is that SSL handshaking is the major cost of HTTPS. That is correct, which is why "typical session length" and "caching behavior of clients" are important.

Many, very short sessions means that handshaking time will overwhelm any other performance factors. Longer sessions will mean the handshaking cost will be incurred at the start of the session, but subsequent requests will have relatively low overhead.

SO Ref: http://stackoverflow.com/questions/149274/http-vs-https-perf...

I wonder which they view as more significant, gmail latency or increased server load?

[acdha]

I'd be surprised if the answer wasn't latency - this kind of server load would be easy to scale with their engineering resources and they're big on the competitive advantage of user-perceived performance.