Passwordless authentication removes the need for a password and replaces it with something else. But can that be secure?