How the HTTPS-snooping, email addy and SSN-raiding HEIST JavaScript code works

http://www.theregister.co.uk/2016/08/05/javascript_heist_attack_https/