Agreed, which is why describing it as a 'key logger' seems to miss the point. Although admittedly I guess The Atlantic are not targeting the HN crowd. However

Agreed, which is why describing it as a 'key logger' seems to miss the point. Although admittedly I guess The Atlantic are not targeting the HN crowd. However, the problem would have been (mostly) avoided by serving the login form over HTTPS. As most people who have used a browser have some notion of HTTPS vs HTTP, couldn't the Atlantic have credited their users with some intelligence, and mentioned the significance of that in the exploit?