This is actually a decent article but he spends far too long going on about HTTPs. Yes it is insecure but it isn't why they had a massive password compromise.
Quite right, and I did refer to that, the point was that if you can't get simple things like these right (among others referred to), is it any surprise that a major breach occurs?
Ditto with XSS.