I don't there's anything deliberately evil about it, it just happens to be effectively credentials harvesting - your auth cookie ends up on someone else's serve

I don't there's anything deliberately evil about it, it just happens to be effectively credentials harvesting - your auth cookie ends up on someone else's server. If they get compromised, all those HN accounts get compromised. Some people might be ok with that risk, if aware of it.