The three things you've listed are how user security traditionally has been done -- but even something like using a password to grant access was not inevitable.