In short: use passkeys for high security, social loginsfor convenience, magic links for low-stakes stuff. Eschew SMS. Login + password is still okay as long as the user runs a password manager with generated passwords.
one-time codes are better than magic links imho.
think a minimal, clean work pc and email on the phone.
can also do both ofc.
can be phished and require more interruptive activity