I agree this is a concern, though more with phishing than social engineering. An attacker site pretends to have their own "Login with HN" implementation, but a

I agree this is a concern, though more with phishing than social engineering. An attacker site pretends to have their own "Login with HN" implementation, but asks users to put in a code generated from LoginWithHN.com itself. If the user adds the code, then the attacker can impersonate the victim on any service that supports LoginWithHN.com (because of the special second-time login handling) If the string was more explicit that it's for LoginWithHN.com, the victim is more likely to recognize that something phishy is going on.