Firesheep sniffs the network looking for session id's and makes it very easy for an attacker to hijack this authenticated session. It should be noted that Firesheep is nothing new ; it just makes this attack very easy. Many websites like Facebook (EDIT: Actually Facebook has patched this vulnerability) and Stack Overflow violate OWASP A9 - Insufficient Transport Layer Protection. A user can protect themselves by using a plugin like HTTPS Everywhere, but stackoverflow.com doesn't even have a valid certificate. Thus it is trivial to MITM https://stackoverflow.com and users have no way of protecting themselves.
Does the Stack Overflow team not understand the threat of OWASP A9? Do they not care enough to spend the $20 on a certificate to give users the option to protect themselves? Google has not experienced a significant increase in resource consumption by switching to HTTPS. At least give people the option to secure themselves.
Gmail switched to using HTTPS for everything by default. Previously it had been introduced as an option, but now all of our users use HTTPS to secure their email between their browsers and Google, all the time. In order to do this we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10 KB of memory per connection and less than 2% of network overhead.