Results: Additional Authenticaton Factors

These were the authenticaton factors that the online services demanded in our study:

Service	Requested authenticaton factors
Amazon	Verification code (email*, text message)
Facebook	Approve login on another computer Identify photos of friends Asking friends for help Verification code (text message)
GOG.com	Verification code (email)*
Google	Enter the city you usually sign in from Verification code (email, text message, app, phone call) Press confirmation button on second device (tablet, smartphone)
LinkedIn	Verification code (email)*

*: Authentication factor was offered in all tested parameter variations

Steam, Twitch and iCloud did not show any reaction in both studies. Possible reasons for this behavior could be:

RBA was not implemented.
RBA was not activated by the user behavior.
Other features than the five tested were rated as more important.
An internal warning was triggered informing operational staff about suspicious behavior.

Note that a feature named SteamGuard might had been enabled by using the desktop software Steam. However, this was not tested in our studies.