# Recent Trends of Authentication Methods in Extended Reality: A Survey
## 4 Authentication Methods in XR
### Knowledge-Based Authentication
Unlike spatial passwords, virtual passwords' positions might be randomized because they are not aligned with any physical object. The process of setting and unlocking a password is identical to that for spatial passwords; however, virtual targets in the form of 3D models of objects are necessary. The virtual targets spawn at different locations within the 3D world each time a virtual password is entered. This adds an extra layer of security against bystanders but makes the task of finding the right virtual unlock target more challenging. Hybrid passwords permit users to merge spatial and virtual targets and only work in environments where passwords are defined because they depend on the position of previously defined spatial targets. The authors implemented a prototype and carried out a user study to evaluate LookUnlock. They demonstrated that this mechanism can be efficiently used by people and that the three password types are resistant to observation attacks. Out of 135 attempts, virtual passwords were resilient to guessing, whereas spatial passwords were the most susceptible. Compared to other graphical and textual authentication techniques, LookUnlock passwords may be prone to users' favoritism for some targets over others. In [85], [PERSON] et al. proposed VoxAuth, a graphical authentication mechanism for VR, with the aim of minimizing observation threats. During authentication, users' avatars wear sunglasses as an eye-gaze obscuration technique and to warn bystanders of the ongoing activity. Users pick their voxel-based pattern from a previously chosen image transformed into a 3D voxel image. The target voxels get selected using a multimodal input method that involves eye gaze pointing and HHC selection. The authors suggested future usability studies to investigate the learnability and memorability of the voxel pattern as well as testing a unimodal eye gaze input method for both pointing and selection instead of a multimodal input method. In [86], [PERSON] et al. designed Ninja Locker, a hand-gesture-enabled knowledge-based authentication system for VR. Ninja Locker uses the difference between the virtual environment view and the bystander perspective view to create confusion in detecting the gesture password. For registration, a user selects a hand gesture from a list of gestures as his password; the same gesture will be displayed, spawning in a different direction each time the user enters the virtual environment. To authenticate, the user uses one hand to copy the gesture displayed in the virtual view, and they use the remaining hand to make a confounding gesture. The confounding gesture adds a layer of security to the gesture password. In [87], [PERSON] et al. implemented SPHinX, a pattern-based authentication scheme for XR environments that enables users to authenticate by pattern tracing on a 3D object (pyramid or cube). Each object's face is divided into grid positions (9 for cubes and 6 for pyramids), and users can choose a continuous pattern or a group of sub-patterns that get concatenated at the end in a sole pattern. Their usability study with 16 volunteers indicated that the highest security level against shoulder surfing attacks was reached when patterns were composed from the four sides of the objects. In terms of login speed and error rates, the cube design scored better than the pyramid design. They pointed out their interest in studying the robustness of their scheme against other types of attacks and in experimenting with other 3D shapes. In order to demonstrate the potential of existing authentication mechanisms in terms of usability and security, [PERSON] et al. [88] carried on their work in [86] and investigated the effect of pointing and selection choices on usability and security for 3D passwords in VR. They presented GazeRoomLock, an authentication mechanism similar to RoomLock [86] that leverages other interaction modalities instead of only using HHC. GazeRoomLock utilizes eye gaze and head pose for pointing, dwell time, and HHC tactile input for selection.