But the author argues, and sets up the following scenario: >A cloned device might let an attacker have a duplicate key. But that's useless unless they also hav

But the author argues, and sets up the following scenario: >A cloned device might let an attacker have a duplicate key. But that's useless unless they also have your username and password. That even in case there is a cloned device, it's not an issue because you still have your password.