## 3 Results
### RQ4: How Effective Are the Selected Recognition-Based Methods in Terms of Security and Usability? A good method must strike a good balance between usability and security, making it easier for users to have a better experience and finish the authentication process quickly and correctly. In this question, the usability and security of the selected RBMs were evaluated and analyzed. The results of the analysis of the selected scheme are presented in Table 5. \begin{table}
\begin{tabular}{l c c c c c c c} \hline \hline  & \multicolumn{3}{c}{**Shoulder Surfing**} & \multicolumn{3}{c}{**Password Space Estimation**} & \multicolumn{3}{c}{**Login Time Comparison**} \\ \cline{2-9}
**Method** & **DO 1** & **VR 2** & **MO 3** & **Password Length (n)** & **Password Space** & **Min Login (r) Rounds** & **Max Login** & **Mean** \\  & & & & & & **Time** & **Time** & **Login Time** \\ \hline Gokhale and Waghmare & & & & & & & & \\ scheme [26] & Resist & \(\times\) & \(\times\) & n & _25!/(25 \(-n\)!)_ & \(\times\) & \(\times\) & \(\times\) \\ [PERSON] et al. scheme [27] & Resist & \(\times\) & \(\times\) & 2 & _(25!/(25 \(-n\)!) \(x\) r_ & 3.0 & 28.0 & 9.67 \\
3 DGUA [28] & \(\times\) & \(\times\) & \(\times\) & 5 & _150/(150 \(-n\)!)_ & \(\times\) & \(\times\) & \(\times\) \\ PassMatrix [29] & Resist & \(\times\) & \(\times\) & 1 & _77\({}^{\pi}\) x r_ & \(\times\) & \(\times\) & 31.31 \\ [PERSON] et al. scheme [30] & Resist & \(\times\) & \(\times\) & 4 & _99\({}^{\pi}\) x r_ & \(\times\) & \(\times\) & \(\times\) \\ PGCUARS [31] & Resist & \(\times\) & \(\times\) & 5 & _70!/(70 \(-n\)!)_ & \(\times\) & \(\times\) & \(\times\) \\ [PERSON] et al. scheme [32] & Resist & \(\times\) & \(\times\) & 1 & _40!/(40 \(-n\)!)_ & 22.0 & 29.75 & 22.33 \\ LocPass [33] & Resist & Resist & Resist & n & _25\({}^{\pi}\)_ & 4.0 & 20.0 & 6.55 \\ PassPage [34] & \(\times\) & \(\times\) & \(\times\) & n & _k_/_k_ \(-n\)!) & 20.0 & \(\times\) & 27.12 \\ [PERSON] et al. scheme [35] & Resist & \(\times\) & \(\times\) & \(\times\) & n & _118!/(118 \(-n\)!)_ & 13.14 & 40.16 & 20.84 \\ MFAS [36] & \(\times\) & \(\times\) & \(\times\) & 3 & _9!/(9 \(-n\)!)_ & \(\times\) & \(\times\) & \(\times\) \\ HyPA [37] & \(\times\) & \(\times\) & \(\times\) & n & _9!/(9 \(-n\)!)_ & 2.7 & 3.5 & \(\times\) \\ PinWheel [38] & Resist & \(\times\) & \(\times\) & 2 & _36!/(36 \(-n\)!)_ & 8.0 & 17.0 & 14.0 \\ EYECB [39] & Resist & \(\times\) & \(\times\) & n & _25!/(25 \(-n\)!)_ & 34.7 & 110.0 & \(\times\) \\ [PERSON] et al. scheme [40] & \(\times\) & \(\times\) & \(\times\) & 8 & _32!/(32 \(-n\)!)_ & \(\times\) & \(\times\) & \(\times\) \\ SelfiePass [41] & \(\times\) & \(\times\) & \(\times\) & 2 & _k_/(_k_ \(-n\)!) & \(\times\) & \(\times\) & \(\times\) \\ AlignPIN [42] & Resist & \(\times\) & \(\times\) & 1 & _40!/(40 \(-n\)!)_ & 19.74 & 79.55 & 19.66 \\ EASY-AUTH [43] & \(\times\) & \(\times\) & \(\times\) & 3 & _9!/(9 \(-n\)!)_ & \(\times\) & \(\times\) & \(\times\) \\ [PERSON] et al. scheme [44] & Resist & \(\times\) & \(\times\) & 1 & _9!/(9 \(-n\)!)_ & \(\times\) & \(\times\) & \(\times\) \\ GRA-PIN [45] & Resist & \(\times\) & \(\times\) & n & _k_/(_k_ \(-n\)!) & \(\times\) & \(\times\) & \(\times\) \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Security and usability of the selected RBMs. Based on the findings shown in Table 5, it is evident that every one of the reviewed methods, except for references [28; 34; 36; 37; 40; 41; 43; 48; 50], is capable of resisting direct observation SSAs. All of the methods that were examined, with the exception of [33], were unable to withstand video-recorded and multiple-observation SSAs. The reason why other methods that were examined are susceptible to MOSSAs is because the objects that a user clicks on within each challenge set may inadvertently make it possible for the attackers to obtain information that is helpful in determining the pass-objects. In addition, Table 5 shows the comparative analysis of the selected schemes for password space estimation.