Doubt it, that's like saying processing payment transactions via non-SSL was more secure than with SSL
Well, in this particular case, it's actually true that sites not using SSL were better off.
The entry point into shared memory in this case was directly tied to running an exploitable version of openssl. Any site running the versions effected, could easily be entered into and have their memory scanned.
That's right there in all the overviews of this exploit. That's what makes it so bad.
Bama is right when he suggests not running SSL at all, in this case, was better. Sure, the session they ran without SSL had no encryption, but, they also had no entry point allowing shared memory to be directly read.
There is good reason why the security experts are saying this one is the biggest exploit they've seen in a while... because it is. The old rules don't apply. If you had SSL enable on any of the exploitable versions, you have the risk that someone not only read your certificate, but, also scan memory containing any and all authentication credentials of anyone who signed on during the period they were scanning.
No SSL running means no entry point exploit to run those memory scans.
