How secure is calling bitcoind JSON-RPC? How secure is calling bitcoind through a JSON-RPC? For example, if I run it on one of my computers, and try calling it from another computer (provided neither of them are compromised), can someone intercept my communication and gain my RPC username and password?
Yes, they can. Unless you enable RPC-over-SSL, the username and password are send Base64 encoded as a header in the HTTP request, which is easily decoded.