  Heuristics for user experience state that users will transfer their
expectations from one product to another. A lack of consistency between
products can increase users' cognitive friction, leading to frustration and
rejection. This paper presents the first systematic study of the external,
functional consistency of two-factor authentication user journeys on top-ranked
websites. We find that these websites implement only a minimal number of design
aspects consistently (e.g., naming and location of settings) but exhibit mixed
design patterns for setup and usage of a second factor. Moreover, we find that
some of the more consistently realized aspects, such as descriptions of
two-factor authentication, have been described in the literature as problematic
and adverse to user experience. Our results advocate for more general UX
guidelines for 2FA implementers and raise new research questions about the 2FA
user journeys.
