It‘s quite hard to provide a second factor if you can‘t have any belongings because you either lose them or they get stolen (eg. homeless people battling addiction). Personal devices and yubikeys are ruled out. Biometric features could be another factor, although hard to implement.

At a library, a staff member could create authenticator codes for people who often visit and are recognized by the staff. The visitor would then request to see the code if they need it. Of course this is a lot of effort for the library to identify people and the visitors must rely on their local library, they still can’t access their e-mail if they are on a device somewhere else.