passwordless
termsecurity
Authenticating with a key held by a device rather than with a shared secret the user types.
The property that matters is not convenience: because the credential is bound to the site's origin and never leaves the device, there is nothing for a user to type into a convincing copy of the login page. That defeats phishing structurally rather than by training. The open problems are recovery and enrolment - what happens when the device is lost, and how the first credential is established, which is where the remaining attacks now concentrate.
Also known as: passkey, webauthn