Passwordless is not one thing. A yubikey does not do biometric auth.
More than that "who you are" should not be used as a factor of auth but as a user id aka username. It identifies, it does not authenticate unless you can revoke it and guarantee it can't easily be reproduced.
More than that "who you are" should not be used as a factor of auth but as a user id aka username. It identifies, it does not authenticate unless you can revoke it and guarantee it can't easily be reproduced.