It isn't a username or password, it's another factor, similar to how we identify people that we know.

It's not perfect, which is why we have policies for accessing things. It's almost certainly a better security mechanism than a password.