How to secure anything
This is missing an extremely important upfront concept: you need to know what you're protecting and how valuable it is.<p>It does no good whatsoever to require every user of a grocery-list app to have a Yubikey to verify their identity. It might not even make sense to have users login at all.<p>The balance between usability and security must be consonant with the costs of implementation.