Gmail uses Perfect Forward Secrecy, so what? If the NSA really does have direct access to Google's servers, then PFS will not provide you any extra protection from them. Sure, PFS will make it harder for others to snoop. But the current context for the general population is PRISM and the NSA.
I'm not saying that PFS (ugh, what a name, perfect, really?) isn't valuable, I'm just pointing out that no one should think this is going to make it any harder for the NSA to read/access your gmail account.
The NSA is getting all of the attention, but this applies to all of the world's intelligence services.
Even if you absolutely believe and support what the NSA is doing, you probably have good reason to want any number of governments, foreign competitors, and individuals from knowing what you are doing or (at the least) your financial status.
> you probably have good reason to want any number of governments,
> foreign competitors, and individuals from knowing what you are
> doing or (at the least) your financial status.
...and you should therefore ignore PFS in https, and use something that encrypts your data so that only the recipient can read it, and not someone in the middle like google, microsoft or facebook.
Sure, but if Googles stores all session keys, as is likely (key phrase: meta-data), then the session data store is a rich and likely target for all the world's intelligence services, and one that is not invulnerable. After all, Google is a big organisation with a large turnover of staff.
I would say that storing session keys is vanishingly unlikely and eliminates the benefit of PFS. Google probably spends millions of dollars a year in PFS additional handshake costs. Google then storing the session keys would be a little like the Dutch building an expensive dike and then knocking a big hole in it.
If you want to store data like "user X searched for Porsche 911 GTS 0-60 statistics, so let's show him some 991 Cabriolet ads the next time we can," you don't need to store the session keys.
I'm not saying that PFS (ugh, what a name, perfect, really?) isn't valuable, I'm just pointing out that no one should think this is going to make it any harder for the NSA to read/access your gmail account.