> So what kind of 2FA would be homeless-proof? I don't see a solution.

There are three factor categories, what you know, what you are, and what you have. A password is what you know. A phone is what you have. Biometrics are what you are - facial recognition, thumbprints, etc.

2FA in one manner or another is used by various services, because the security recommendation is to pillar identification by at least two of the three factors.

For your question, there are any two from the three factor categories that could be used.

However, there are also limited versions of a single category that are often used as a backup when 2fa is not available. In this case, google uses backup codes when "what you have" is not available. Backup codes are functionally equivalent to passwords, except that they are limited to a single-time use. Limiting use is often a method of using a single factor category, when another factor is not available.

Another method is to rely upon another authority, such as using a physical ID card that can be validated in order to let a person back in.

And so forth.