They moved into a fad. Be very careful and weary of any solution that is passwordless and will have you not use 2FA. Even a yubikey with a pin is significantly

They moved into a fad. Be very careful and weary of any solution that is passwordless and will have you not use 2FA. Even a yubikey with a pin is significantly inferior to a yubikey and a different auth mechanism (password,device cert+pin,etc...) Whatever better auth method they are selling, don't let it be reason to stop using passwords. I'll give you a classic example: sysadmins set up ssh publickey login, they are now immune to brute force attacks so they use it all over the place. One admin exposes the private key in a public git repo and gets the whole company compromised. They could have used both passwords and public keys and stopped that compromise. My point: 2 is always better than 1, even if it is a fancy new impenetrable and hyped up method of auth.