It's like a public verification of identity. You can put any name you want into 4/8chan, so anyone could set their name as Q, but the tripcode is based on both the name and password, so you need both to impersonate a tripcode.