## 3 Results
### RQ2: What Pass-Objects Are Used for Authentication in These Methods? The object(s) that a user clicks on during authentication may inadvertently make it possible for the attackers to obtain information that is helpful to log into a secured system. Hence, we examine the types of objects used for authentication. As shown in Figure 6, 14 (50.0%) of the selected schemes allowed the use of registered objects as pass-objects; 2 (7.14%) schemes used decoy objects as pass-objects; 1 (3.57%) scheme used both registered and decoy objects as pass-objects; and 11 (39.29%) schemes used none of the registered and decoy objects as pass-objects. Figure 4: Distribution of publication type. Figure 5: Distribution of publisher channels. An overview of the pass-objects used in the selected schemes is presented in Table 3 below. \begin{table}
\begin{tabular}{l c c c c} \hline \hline \multicolumn{1}{c}{**Method**} & \multicolumn{4}{c}{**Pass-Objects**} \\ \cline{2-5}  & **Registered Object** & **Decoy Object** & **Registered and Decoy Objects** & **None** \\ \hline Gokhale and Waghmare scheme [26] & & & \(\surd\) & \\ [PERSON] et al. scheme [27] & & \(\surd\) & & \\
3 DGUA [28] & \(\surd\) & & & \\ PassMatrix [29] & \(\surd\) & & & \\ [PERSON] et al. scheme [30] & & \(\surd\) & & \\ PRGUARSS [31] & \(\surd\) & & & \\ [PERSON] et al. scheme [32] & & & & \(\surd\) \\ LocPass [33] & & & & \(\surd\) \\ PassPage [34] & \(\surd\) & & & \(\surd\) \\ [PERSON] et al. scheme [35] & & & & \(\surd\) \\ MFAS [36] & & & & \(\surd\) \\ HyPA [37] & & & & \(\surd\) \\ PinWheel [38] & \(\surd\) & & & \(\surd\) \\ EYEDi [39] & \(\surd\) & & & \\ [PERSON] et al. scheme [40] & \(\surd\) & & & \\ SelfEiPass [41] & \(\surd\) & & & \\ AlignPIN [42] & \(\surd\) & & & \\ EASY-AUTH [43] & \(\surd\) & & & \\ [PERSON] et al. scheme [44] & & & & \(\surd\) \\ GRA-PIN [45] & & & & \(\surd\) \\ [PERSON] et al. scheme [46] & & & & \(\surd\) \\ VGMSGP [47] & & \(\surd\) & & \(\surd\) \\ Sharma and Ali scheme [48] & & & & \(\surd\) \\ [PERSON] et al. scheme [49] & \(\surd\) & & & \\ Lapin and Siurkus scheme [50] & \(\surd\) & & & \\ [PERSON] et al. scheme [51] & \(\surd\) & & & \\ [PERSON] et al. scheme [52] & & & \(\surd\) \\ RPP [53] & & & & \\ \hline \hline \end{tabular} Note: \(\surd\) denotes yes.  
\end{table} 
Table 3: Overview of the pass-objects used in recognition-based systems. Figure 6: Distribution of selected schemes based on pass-object used. As indicated in Table 4, the authentication schemes proposed in [28; 29; 31; 34; 38; 39; 40; 41; 42; 43; 47; 49; 50; 51] require the users to login with only the registered objects as the pass-objects during the authentication process. The schemes developed by [PERSON] et al. [27] and [PERSON] et al. [30] are the two methods that permit the use of only decoy objects. The pass-object that [26] used could be either the decoy images or the registered images. As a result of this, the attackers are unable to determine whether the image that was clicked was the decoy image or the registered image. In the cases of [32; 33; 35; 36; 37; 44; 45; 46; 48; 52; 53], the registered icons and the decoy icons are not clicked. Consequently, it would be difficult for the attackers to make any intelligent analysis to distinguish which icons are the registered icons and which are the decoys.