An organization wants phishing-resistant authentication for administrators. Which supported method should it prioritize over reusable passwords and one-time-code-only approaches?

1. An email containing all recovery codes
2. FIDO2 passkeys or security keys under an appropriate authentication policy
3. One shared reusable password
4. A longer user display name