The clever part is that the server doesn't know if the user has the setting on or off, so it can't cheat the security without risking detection.