How not to do two-factor auth | Hacker News Reader