True, it is the wrong way. Ideally there would be a better system for this kind of thing. It is the reason why physical authenticators and two phase authentication are becoming more popular.