ERC20 Anyone can call approve if knows ABI on contract and my address?

Question

I think I misunderstand something. I'm using a Ganache for developing dApp. I built a default ERC-20 smart-contract. I've built it with truffle. And just for test I write some code in NodeJS:

        const res = await contract.methods
            .approve('0xbB5fed33E455bA3efB1a6622c388A9aDaD9D9EB5', this.web3.utils.toWei('10'))
            .send({
                from: '0xD73292923DA1Fc18b04fADC4a004bb7dffB5f7Ca'
            });
        const tr = await contract.methods
            .transferFrom(
                '0xD73292923DA1Fc18b04fADC4a004bb7dffB5f7Ca',
                '0x460923eA0B788cBF8921f1cd1a696D3de7Fd487a',
                this.web3.utils.toWei('10')
            )
            .send({ from: '0xbB5fed33E455bA3efB1a6622c388A9aDaD9D9EB5' });

And this code works perfectly. Is it means that anybody who knows my address and ABI of a contract can call the same code in Main Network (Ethereum). Because all this information (ABI and my address) is public. I think it's quite silly question, but I can't find an answer. What I'm missing?

Answer 1

You can execute .send({from: 'SomeAccount'}) only after unlocking SomeAccount on the node that you're communicating with via your Web3 instance.

On public nodes this is usually not even an option, and you can therefore execute a transaction only via web3.eth.sendSignedTransaction (and only after signing the transaction with your private key).

So in short, the code in your question means that you've unlocked those two accounts (using their private keys) when you started Ganache.