Booking.com ignores twofactor, lets everyone email-login without a password
https://news.ycombinator.com/item?id=40720674
#ycombinator