you're assuming that those IDs can't be forged. Pretty big assumprion.

When in history has existed an id or authentication method that couldn't be forged or broken?