This sounds very insecure, and even the most basic of security should block it, so I'm curious if it works.