Withdrawing should require Google Authenticate, for those of us who have it enabled.  Just requiring the password is not secure enough.