And in the real world, no one would use that service. You aren't wrong though, that would be the way to do it if you wanted it to be secure.