Hacker News Reader

Or just encrypt in-house and use HTTP.

These guys receive requests from mobile devices. Afaik sending unencrypted HTTP requests is not allowed on some platforms (e.g. iOS).

First, they can offer both http and https endpoints. Second, you can send HTTP request if you set NSAllowsArbitraryLoads=true.

You can disable transport security for a certain domain using the plist key NSAppTransportSecurity. But you rarely should do this :)

I think you should think long and hard before you roll your own crypto.

You don't need to roll your own crypto in order to encrypt in-house.