Accessing HN from your own devices, then you will probably stay logged in - so not much to "sniff".
Additional security would be all pain with very little gain in my opinion.
It is absolutely your responsibility, as the developer of your application, to make security of user accounts an absolute priority.
It doesn't matter what the purpose of your website is - if you're having users create accounts, you need to secure them as best as you can. It's not ok for you to classify users who have poor password practice as "Bozos".
These are your users - your customers - the people who give your application a purpose. Treat them with respect, or let them find someone who will.
Further to that, if someone gets 'hacked' using your service, you've already highlighted that the vulnerability was using your no value service.
Don't skimp on basic security. And show your potential users a little less contempt, too. They are not the 'bozos' here.
No one here is saying that users shouldn't have better password policies. They should.
What is being said is that having a devil-may-care attitude toward safe guarding your users account data is not ok.
If you use your bank password for anything other than your bank, you're clearly not taking security seriously.
If you think you shouldn't have to properly secure user account information, you're clearly not taking security seriously.
Both parties can be wrong, but that doesn't excuse either side.
> The only real danger is for bozos who use the same password for HN as they do for their citibank account
---
Excuse my pedantry, but I'd advise against saying "That isn't the point.", for it conflicts with a well known writing technique: http://en.wikipedia.org/wiki/Show,_don%27t_tell
If you insist on doing so, consider a more polite alternative. E.g. "it's seems you've missed the point", "perhaps you've misunderstood", "I feel that so-and-so was saying something else".
Does that make PG the bozo?