Hacker News Reader

It let me sign in without 2factor, which is definitely enabled across our org.

-edit

It does use 2fa, I retried signing out of the browser and app, and then it prompted. It was using the browser token.

If you were already logged in through your default browser it'll use that to authenticate you through oauth.

Ok, that makes sense if true. It asked for my password, so wasn’t clear.

I believe that org restriction applies only to third-party application. This app is a first-party app.

That can't be right? Is it?

If so, note to self; use first party app's token.