Forget passwords. A physical key is your best bet against phishing.