Hacker News Reader

Without a capchta it is possible to iterate through all possible backup codes.

And a captcha... stops this? Even if it did, how about adding a captcha on the second try or just when entering the backup codes?