I haven't read the article, yet, but if you encounter this situation, the form is subject to man in the middle (MITM) attack on the way to your browser. Given

I haven't read the article, yet, but if you encounter this situation, the form is subject to man in the middle (MITM) attack on the way to your browser. Given access to that datastream, the destination can easily be changed. Do you check the destination for each such form before you submit? (Not to mention, the page can be compromised to sniff your activity even if you never actually submit.) It's bad UI because it breaks users of the habit -- that took some time and effort to establish -- of looking for a secure connection before entering sensitive information. It's bad security for -- amongst other things -- the reason described above.