Don't you have to successfully login before getting to this authentication step? So the people who know you would have to know your password first, in which cas

Don't you have to successfully login before getting to this authentication step? So the people who know you would have to know your password first, in which case you're already vulnerable.