# Recent Trends of Authentication Methods in Extended Reality: A Survey
## 4 Authentication Methods in XR
### Knowledge-Based Authentication
The authors compared pointing using eye gaze, head pose, and controller tapping and assessed RubikAuth's usability, memorability, and observation resistance against threat models. The observers in their user studies used (1) written annotations, (2) a 3D copy of the cube, and (3) recordings as means to mimic the password. They found that (a) for usability, a 4-symbol RubikAuth password using controller tapping is highly faster than head pose and eye gaze; (b) a memorability study indicated that passwords are as memorable as previous work; (c) observation resistance showed that passwords are highly resilient to observations: 98.52% of attacks were unsuccessful, and gaze input outperformed head pose and controller tapping. RubikAuth is promising against shoulder-surfing attacks due to the possibility of applying fake face switches and changing the cube angle without rotating it to trick observers. Gaze-based interaction for RubikAuth scored highly among participants based on usability and security. Most eavesdropping password entry schemes used in AR smart glasses require additional devices connected to them. In [69; 70], [PERSON] et al. addressed the non-practicability of entry schemes on Smart Glasses (SG) such as the Google Glass (GG). They designed and implemented gTapper, gRotator, and gTalker, three authentication schemes based on touch pad, gyroscope, and speech recognition input modalities, respectively. For interaction, users enter a 6-digit PIN by performing gestures on the touchpad, rotating the head, and speech by reading the hidden information on the GG display. They concluded that their schemes are resilient to password leakage and are very cost-effective because they require no extra hardware beyond what is available on GG. In [71], [PERSON] et al. extensively studied the use of smooth pursuits in VR. After an in-depth analysis to derive the different guidelines for pursuit selection design considering trajectory size, target size, and distance to target, they designed an Automated Teller Machine (ATM) sample application for authentication in VR and conducted usability interviews and questionnaires. Their authentication scheme considers a 4-digit PIN and eyes' smooth pursuits as an input modality, and it reached 79% accuracy. They concluded that larger trajectory sizes result in better accuracy and faster selections, but target size and distance have little to no effect on the overall performance. They highlighted their plan to investigate pursuits with other modalities and scenarios. In [72], [PERSON] et al. proposed AugAuth, a gesture-based AR authentication framework resistant to shoulder surfing attacks. AugAuth users securely authenticate themselves while bystanders are present by randomly entering a PIN on the device's display coupled with finger movements' detection using a MYO armband (MYO). For registration, users wearing a MYO perform 20 taps for each finger on the display to build a finger movements' profile, then set up a PIN that they use later for authentication. They collected EMG (Electromyography) signals from 8 volunteers and used Support Vector Machine (SVM) classifier for finger movement classification. AugAuth accuracy reached 86%. Similarly, in order to address the shoulder surfing issue in PIN-based authentication methods in AR, [PERSON] et al. [73] introduced two PIN-entry methods for GG by exploiting the hidden overlay screen in GG to display secret values. They proposed two masked-PIN schemes that make use of voice and touch. Users choose a 4-digit PIN for enrollment, and then to authenticate, they must put the randomized PIN given by the server in order by speech or touchpad. Once the PIN is correct, they may confirm. Their voice-based method is effective when users cannot use their hands, and the touch-based method is more useful in loud environments or where users are at risk of eavesdropping from bystanders. The authors implemented and evaluated the prototypes, and their results reached a very high accuracy rate with a very short entry time. [PERSON] et al.