  Nowadays, most online services offer different authentication methods that
users can set up for multi-factor authentication but also as a recovery method.
This configuration must be done thoroughly to prevent an adversary's access
while ensuring the legitimate user does not lose access to their account. This
is particularly important for fundamental everyday services, where either
failure would have severe consequences. Nevertheless, little research has been
done on the authentication of actual users regarding security and the risk of
being locked out of their accounts.
  To foster research in this direction, this paper presents a study on the
account settings of Google and Apple users. Considering the multi-factor
authentication configuration and recovery options, we analyzed the account
security and lock-out risks. Our results provide insights into the usage of
multi-factor authentication in practice, show significant security differences
between Google and Apple accounts, and reveal that many users would miss access
to their accounts when losing a single authentication device.
