## 3 Results
### RQ3: What Are the Strengths and Weaknesses of the Selected Recognition-Based Methods? Several graphical password methods have been presented in order to address the challenges presented by SSAs and other security threats. Table 4 presents a detailed analysis of the strengths and weaknesses associated with the RBGP systems that have been documented in the literature. In our research, we specifically chose to focus on three primary forms of shoulder surfing attacks: direct observation attacks, multi-observation SSAs, and video-recorded SSAs. These types were selected based on their prevalence, feasibility, and the potential threat they pose in real-world scenarios. Here is a brief explanation of each: \begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**ID** & **Method** & **Author** & **Strengths** & **Weaknesses** \\ \hline S15 & [PERSON] et al. scheme & [PERSON] et al. [40] & Straightforward to operate. & Extremely susceptible to SSAs on account that the images that a user clicks on are the registered images. The user’s device may be in the possession of an adversary. \\ S16 & SelfiePass & [PERSON] and [PERSON] [41] & Use a secret token to thwart SSAs. & The user’s device may be in the possession of an adversary. \\ S17 & AlignPIN & [PERSON] et al. [42] & Thwart direct observation attacks. & Vulnerable to MOSSAs and VRSSAs. \\ S18 & EASY-AUTH & [PERSON] et al. [43] & Easy and convenient to use. & Susceptible to direct observation attacks on account that the images that a user clicks on are the images that are registered. \\ S19 & [PERSON] et al. scheme & [PERSON] et al. [44] & Employs eye gazing rather than direct clicking. & Vulnerable to MOSSAs and VRSSAs. \\ S20 & GRA-PIN & [PERSON] et al. [45] & Capable of mitigating direct observation SSAs. & Vulnerable to MOSSAs and VRSSAs because the images used in a challenge set are always the same. \\ S21 & [PERSON] et al. scheme & [PERSON] et al. scheme [46] & Potential to mitigate shoulder-surfing attacks. & Vulnerable to MOSSAs and VRSSAs. \\  & & It is difficult for potential adversaries to determine the registered points and the verification grid. & Vulnerable to MOSSAs because a user would always map the same set of registered points into a specific verification grid. \\ S23 & [PERSON] and [PERSON] scheme & [PERSON] and [PERSON] [48] & It is difficult for potential attackers to determine the key number required to login. & Vulnerable to MOSSAs because a user would always map the same set of registered points into a specific verification grid. \\ S24 & [PERSON] et al. scheme & [PERSON] et al. [49] & Uses an OTP for authentication. & Susceptible to SSTs because an attacker can record the entire authentication process and then examine the images that are collected in order to determine what number they correspond to. \\ S25 & [PERSON] and [PERSON] scheme & [PERSON] and Siurkus [50] & Potential to protect against brute force. & Autacks on accounts that users login with only the registered images. \\ S26 & [PERSON] et al. scheme & [PERSON] et al. [51] & It is difficult for the attackers to perfectly capture the clicked points. & Vulnerable to MOSSAs and VRSSAs. \\ S27 & [PERSON] et al. scheme & [PERSON] et al. [52] & Capable of mitigating direct observation attacks. & Susceptible to MOSSAs and VRSSAs. \\ S28 & RPP & Boston and Bostan [53] & Potential to protect against SSAs. & Vulnerable to MOSSAs and VRSSAs. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Cont. Direct Observation Attacks: This is the most straightforward form of SSA, where an attacker merely observes the authentication process of the user directly. Given its simplicity and immediate nature, this type of attack is considered to be among the most common in everyday scenarios, such as using devices in public places. Multi-Observation SSAs: Here, the attacker observes the authentication process multiple times, either in immediate succession or over extended periods.