When it comes to security, there are the three main paradigms:
Something you have can be interpreted as either an RFID key-fob, the Google Authenticator, a RSA key, etc. Any physical object or thing that you need to posses to authenticate.
Something you know is most commonly interpreted as a password, but could also be a sequence of colors or shapes. Something that you have to memorize.
Something of you. This is bio-metrics: your voice print, your finger print, a scan of your retina, a 3D topological scan of your hand, how you walk, your DNA.
The current industry standard for authentication is moving towards a two-factor system as a baseline. This just means that you require two of the three authentication paradigms.
You using Google or Facebook authentication as one of your two-factor systems, fulfills the something you know part of the equation, as the user has to know their login information for Google or Facebook.
Sending a user a text message fulfills the something you have part of two-factor.
Implementing both of those into your authentication scheme will put you about a year or two ahead of a large part of the application industry. Your only real issue will be in how you secure the hashes you receive from Google/Facebook, on the user's account creation and the phone numbers associated with the users.
If your table with the Google/Facebook hashes or the user phone numbers gets compromised, then it is basically the same as your user giving away their passwords.