Joseph Bonneau
American researcher who measured just how weak passwords really are, then showed why none of their replacements has won anyway.
As a PhD student at Cambridge under Ross Anderson, Bonneau got to analyse anonymised password data from around 70 million Yahoo accounts. The Science of Guessing (2012) found that against an attacker limited to a few guesses per account, trying the most common choices first, real-world passwords offer roughly ten bits of security — far below what the entropy formulas behind strength meters suggested.
The same year brought The Quest to Replace Passwords, with Cormac Herley, Paul van Oorschot and Frank Stajano, which scored 35 alternatives against 25 desirable properties. None beat passwords across the board, and nearly all were worse on deployability. He went on to be a technologist at the EFF, a co-author of the textbook Bitcoin and Cryptocurrency Technologies (2016) and a professor at NYU.