How secure is calling bitcoind through a JSON-RPC? For example, if I run it on one of my computers, and try calling it from another computer (provided neither of them are compromised), can someone intercept my communication and gain my RPC username and password?
Yes, they can. Unless you enable RPC-over-SSL, the username and password are send Base64 encoded as a header in the HTTP request, which is easily decoded.
Here is how you get RPC SSL to work...
Now here is the secret...
Your server.key and server.cert must be placed inside your /bitcoin/testnet folder, or in my case /bitcoin/testnet3 folder.
In my case I have a server.pem file instead of server.cert. A chained security certificate file.