@bdurrett @mathowie I am like 99 percent sure the browser based 2FA verifies the expected domain. This is not the “manually type a code” kind. Try it in any @discourse instance (we also support auth apps)