Really, it depends on the problem you're trying to solve. I was humorously illustrating a wide spectrum of requirements in terms of both authentication certain

Really, it depends on the problem you're trying to solve. I was humorously illustrating a wide spectrum of requirements in terms of both authentication certainty and implementation friction. To determine what "good authentication" is, you must first determine if you're protecting a nuclear missile silo, a Chipotle bathroom, or something in between. A 9 digit shared secret is probably not a good authentication factor for launching a nuclear missile. It's also not great for handing out loans. But it's also probably overkill for accessing a Chipotle bathroom. And a slight nit: SSNs aren't public. They are, of course, frequently shared, and easily compromised. But they are literally private shared secrets.