IDEX is an Ethereum dapp. You connect to it with the Ethereum blockchain, therefor there is no need for SSL (https) when connecting. SSL actually causes dapps to not work. When you log in to IDEX you do so by connecting your RPC to the interface. There is no sign in at all.

All trades are signed with your private key. It is impossible for IDEX to move user funds without their permission. There is also no central wallet that hold all of the user's funds. The only way to be hacked is to have your keypair compromised. Hope this clears some things up.