If you requires them to write down or print, then there will be people just not do it and still lost their data all together. If you just infer it from user pa

If you requires them to write down or print, then there will be people just not do it and still lost their data all together. If you just infer it from user password. Someone is definitely going to use weak password and get cracked in seconds. If you requires a strict password rule to enforce strong password, someone is going to forget it and lock them out of their account. Because they only use this password here and there is literally no reason you use it the second time(most people only login from 1 device. Unless it is broken, you are not going to login the second time). Requires a physical device is also a no go. Because devices can break. Unless you have another backup, you are screwed. I am not sure there is a method that is secure(that don't lost message by accident) to most of the users. Lost messages and contacts is way more risky then your message may be seen by CIA to most users, I believe.