Hacker News Reader

Because the main login is HTTPS-secure (I would hope - for a bank), but the change-password feature is not.

Oh, you mean the account recovery page, not one that requires the old password to change to a new one. I see.