You are absolutely correct. You can also type `who` for a list of users who are currently logged in. You can even `cat /etc/passwd` for uids and home directories. That's how UNIX security works (not via obscurity). If your password's not strong enough to resist a bruteforce, change it and/or get a VPS (which, incidentally, commonly get pwned by Chinese botnets if you insist on using a weak password and don't switch to pubkey-only auth).