If an attacker controls DNS (which is doable), he could just not issue the redirect and you'd happily tell your GMail password to his server. Also, redirecting

If an attacker controls DNS (which is doable), he could just not issue the redirect and you'd happily tell your GMail password to his server. Also, redirecting from e.g. http://gmail.com/login?user=me&pass=secret http://gmail.com/login?user=me&pass=secret to https://gmail.com/login?user=me&pass=secret https://gmail.com/login?user=me&pass=secret is not that useful, so this can also help with some forms.