I think this misses the point... do you need your own auth at all? Security is only as strong as the weakest link. If you have a "forgot password" that emails

I think this misses the point... do you need your own auth at all? Security is only as strong as the weakest link. If you have a "forgot password" that emails you a login or a "lost/changed phone" that removes the sms, don't bother even having the password or sms. Falling back to email means you've just pushed your auth behind the email's auth. Just use it directly by using oauth with google, o365, facebook or whatever makes sense for your target audience and be done with it. If you are b2b, use saml.