Yes, HN is insecure because they don't use HTTPS. Especially when using a public WiFi network someone could hijack my session, and even intercept my password by passively sniffing packets.

There is a HTTPS wrapper around HN, but it has been pretty flakey lately (lots of timeouts): https://quickhn.appspot.com/news

I do agree that if you don't have user logins there is no real threat. The only possible 'attack' then would be an ISP injecting ads or injecting other content that you didn't write :)