I agree, the main issue here is that they're not using SSL during these steps, and the second is that they don't recommend changing your password from the generated default.