Until service providers ban them for being insecure — "if you can send your passkey to any other device, you can also send it to a phisher."