Link. “Subtle flaw”. I can name several more, all obvious. Google’s two-factor authentication is still very buggy.