Looking at traffic with tcpdump, it appears to me that nothing other than your initial authentication/login is encrypted. All the XMLHttpRequest data, both reads and writes, appears to be sent as gzip-compressed plain text. This is not secure at all.

Viewing MobileMe’s traffic in your network sniffer of choice (I prefer Charles and Wireshark) shows your data is actually unencrypted.

So I used HTTPScoop to sniff while I viewed a couple of emails. Not only is there no SSL authentication, but the requests and responses aren’t even encrypted at all. I could easily read the plaintext of the email messages right in HTTPScoop, which means anyone else on my LAN (or any admin at my ISP or workplace) could easily have read them too. Oops.