Hacker News Reader

Actually it is an iframe with https (using stripe)

But if the host traffic is compromised you can serve malicious payment gateways/forms.

If the host is compromised HTTPS isn't going to save you.

it will if it's the host /traffic/ that is compromised