In short: use passkeys for high security, social loginsfor convenience, magic links for low-stakes stuff. Eschew SMS. Login + password is still okay as long as the user runs a password manager with generated passwords.