Hacker News Reader

I haven't tested this, but if it truly works, one just needs to include <script src="http://wordpress.com/remote-login.php?action=jsonp&jsonp...; in a page and harvest hashes of its visitors?

Yes. Just a simple JSONP API call.

Is there wordpress JSONP API documentation anywhere? A couple of Google searches didn't turn anything up.

I checked out the Wordpress source just now and no mention of remote-login. I don't know if wordpress.com itself has any API documentation.

It looks like they have an xmlrpc.php file - so you could try using that.