But the whole premise is that the attacker is able to guess/see your password.