‘2FA is a loophole,’ says Serenity’s co-founder. Palm scans and offline keys could protect against rising phishing attacks