Took 3 years (see <a href="https://bitbucket.org/site/master/issues/5811/support-two-factor-authentication-bb-7016" rel="nofollow">https://bitbucket.org/site/master/issues/5811/support-two-fa...</a>), but finally there. Now it's time to find security bugs in this implementation.