Plenty of other ways to catch even the security aware. The obvious, since he knows this person, would be to tweet some 'news link' and have the code only work for Bill. You can be security aware and not be perfect 100% of the time.