i've also been a fan of low bar initial logins then ramping the user into higher forms of auth as they engage with a platform more.