Is Passwordless Authentication Actually Secure?