Actually remove the SSL , so those who doesn't believe can sniff their nose into those packets. because there's nothing to hide. end of all rumor and guesses.
We were running up to now without SSL and the feedback I got was, that if someone wants to try out some manual search range (which may or may not indicate "something he knows"), then over an unencrypted line this is a no go.
Actually, at the moment we run both. The new client 0.960 uses SSL, there is no change in the API whatsoever, older clients still use plain old unencrypted.
You get to the same site when you call e.g.
http://lbc.cryptoguru.org:5000/statsor
https://lbc.cryptoguru.org/statsThe 2nd is merely a nginx reverse proxy for the 1st.
Rico