Are passwords the new security theatre?