Presuming you're using session cookies, Persona is no less secure than any other reasonable authentication system when used without SSL.
It also has the nice property that what Persona transmits over the wire -- the proof of identity -- is only valid for 120 seconds. Sniffing it in real time would temporarily allow you to masquerade as another user on that specific site, but any sort of delay and you're locked out.
This is a huge improvement over, say, transmitting passwords, which could grant access to an account for months or years.
It also has the nice property that what Persona transmits over the wire -- the proof of identity -- is only valid for 120 seconds. Sniffing it in real time would temporarily allow you to masquerade as another user on that specific site, but any sort of delay and you're locked out.
This is a huge improvement over, say, transmitting passwords, which could grant access to an account for months or years.