# as many rpcallowip= settings as you like to allow connections from
# other hosts (and you may use * as a wildcard character).
# NOTE: opening up the RPC port to hosts outside your local
# trusted network is NOT RECOMMENDED, because the rpcpassword
# is transmitted over the network unencrypted.
#rpcallowip=10.1.1.34
#rpcallowip=192.168.1.*
You have to enable SSL given the comment that "rpcpassword is transmitted over the network unencrypted.":
https://en.bitcoin.it/wiki/Enabling_SSL_on_original_client_daemon
I haven't done it but it make sense your RPC is going to be exposed to the internet at large.