Currently I only trust these 3 factors of authentication used in combination correctly: 1. Memory (enter the site-specific password via the password manager wh

Currently I only trust these 3 factors of authentication used in combination correctly: 1. Memory (enter the site-specific password via the password manager which is unlocked by a password is from your memory). 2. Device (device-internal-hardware backed certificate bound to this device). 3. Physical Presence (FIDO2 Key touch) Most importantly, it is extremely important how secure the reset auth flows is. And if any one of the three factors need to be reset, then the system should require the other two to be valid, plus it should require an in-person identity verification (if implemented correctly, video KYC should be acceptable). Plus there should be a reset-buddy designated by the user who should second/vouch the user's initiation of reset. Without all of these (2 factors of auth from the user plus system automated video kyc + reset-buddy vouching), even the admin shouldn't be able reset auth of any accounts. This is crucial. Plus there should be a pre-cooloff period after reset request is raised but before it is actually processed, and a post-cooloff periods for any additional factor reseting, and regaining full privileges. Independently, there should be fraud/risk systems for safeguarding any sensitive operations (like creating additional users, exfiltration of data etc).