This is a smart, safe implementation. On a side note: I wish HN offered 2FA.
I was a bit worried that what I was doing was against the spirit of HN (HN is very much not a social site in that way, and I think they strive not to be), but if they ever choose to add native 2FA I'll be over the moon.