Passwordless Authentication Broke Security, Not Passwords

TL;DR Passwordless authentication (biometrics, passkeys, FIDO2) promised to eliminate phishing and credential theft. Instead, it moved the attack surface from passwords to the verification layer itself. Result: A single exploit on a biometric reader,...