Ah, so because the login challenge is unique, the person would have to have access to the browser that received the original login challenge -- there's a second

Ah, so because the login challenge is unique, the person would have to have access to the browser that received the original login challenge -- there's a second second secret when you initiate login (that's part of the bit managed by ORY Hydra)