AuthMask: Microsoft Authenticator hands tokens to an app with zero permissions | Hacker News Reader