Even better, hardware authentication token + second factor is password. (something you have, something you know)

See https://github.com/bitid/bitid/

It would also probably be easier/(or at least not harder) for people than username and password. Just tell users to press the button and enter a password to sign in.