SMS codes, authenticator apps, and hardware keys all beat a password alone, but they differ sharply in phishing resistance, convenience, and how badly recovery can fail.