Question

I am trying to understand gmail’s authentication mechanism. I know it uses https for transporting the user credentials during login and then the rest of the communication happens over http. How is this achieved? Is some kind of key exchanged during the initial session over https and used in subsequent requests? if yes, Isn’t some kind of key agreement protocol (e.g. Diffie-Hellman) better for exchanging the shared key instead of https?

Answer 1

https uses asymmetric encryption to obtain a symmetric key. After cookies are set using https they are the source of authentication over http. Unless the user has set https to be always used