The other alternative is to support TOTP and let people use whatever authenticator they want.
Without specifically commenting on the relative merits of all the auth options being mentioned in the thread, I do feel it worth pointing out that "if you accept id+password" you definitely should not be storing them. And neither should someone else on your behalf.
Using one-way cryptographic hashes of passwords is well documented and nobody should have the "hoard of stored treasure, other people’s passwords" even with id+password as the auth mechanism.
There are more ways to do that wrong than right.
Of course, that is irrelevant to my point: even if you do store them all properly, you are still going to get attacked.
Don’t give people such terrible advice unless you also tell them how to protect themselves.
I offered a technically correct warning for a single case, and also specifically said I wasn't commenting on whether that auth method should be used or not.
I'm not required to offer a security tutorial, but yes it's true that storing anything, even hashes, is a security risk. So if it helps any other readers they can somewhat mitigate dictionary attacks by using salts and possibly peppers.