More from the article ...

... The rise of passkeys

MFA methods typically fall into three categories: Something you know (a password, code, or security question), something you have (like a token or a smartphone), or something you are (like fingerprints or facial scans). They include hardware tokens, authenticator apps, passcodes sent via SMS or email, push notifications to approve a login on a connected device, and biometrics using physical traits to verify a person's identity.

Historically, authentication used the "something you know" model, where two parties -- a user and a server, or two devices -- prove their identity by both knowing a secret like a password or code. The problem here is that someone can guess your secrets, or maybe you put it on a sticky note or in a plaintext file on your desktop.

Criminals can also phish these secrets via phony websites that prompt users to enter their username and password, and intercept one-time passwords (OTP) sent via SMS or email by redirecting the messages before they reach the intended recipient.

"So one of the things that we're seeing is the whole movement away from passwords to passkeys -- a certificate-based authentication wrapped in a usability shrink wrap," Forrester VP and analyst Andras Cser told The Register. ...