# Recent Trends of Authentication Methods in Extended Reality: A Survey
## 4 Authentication Methods in XR
### Knowledge-Based Authentication
[74] proposed the integration of well-established concepts (PIN, Android unlock patterns) into VR. Through both a pilot study and a lab study, they showed that the current real-world authentication methods are transferable into VR. Particularly, they showed that the usability of both PIN and swipe patterns in VR matched the usability in the physical world. Furthermore, they illustrated that the hidden channel offered by VR makes such authentication mechanisms harder to attack and hack. In [75], [PERSON] et al. proposed a new input approach aiming to overcome the lack of available touch surface in modern SG by using a thermal camera embedded in the front of the SG. Users enter a 4-digit-based PIN on a touchpad that faces the virtual pad while the thermal camera captures the residual heat from the fingertip on the touchpad. They used the Simple Blob Detector (SBD) algorithm to detect the blob pixels left by finger touch. They pointed out the technical issues of their approach, such as the SBD algorithm's effectiveness in detecting other touch gestures in non-laboratory situations. In their original work, [PERSON] et al. [76] implemented well-developed authentication methods such as pattern swiping and PINs within a VR environment while attempting to build a 3D password for VR. The authors conducted usability and security experiments to provide some insight into the strength of the three techniques against observation attacks. In the experiment, participants using the three authentication techniques were recorded, watched other participants' recordings, and then asked to guess the passwords. The results suggested that the 3D password system was considerably harder to guess and had a higher security level than 2D swipes and PINs, likely as a result of introducing a complex third dimension. Two-dimensional swipes and PIN systems were perceived as more usable. With the same purpose as previously mentioned PIN-based schemes, [PERSON] et al. [77] addressed the shoulder surfing and eavesdropping issues of PIN-based authentication schemes in AR. They implemented two PIN-based authentication schemes for GG and compared their effectiveness with the built-in option available on GG. The schemes employ voice and touch input modalities. For registration, a 4-digit PIN is assigned to the user by the server. For the voice-based scheme, the user is shown a plain pad with random colored digits, and the user speaks the digits that match the registered PIN. GG captures the spoken digits, matches the digit with the corresponding real PIN, and grants access. For the touch-based scheme, the user is assigned a randomly assigned PIN pad that changes with each instance, and the user must navigate to the correct digit by swiping and selecting the digit by tapping. The system grants access when the PIN matches the stored one. Through a usability study with 30 subjects, they concluded that users perceived the proposed schemes as faster and more secure than the built-in schemes. They also recommended the use of different authentication schemes on the same device because users tend to use them in different contexts. In [78], [PERSON] et al. presented Glass Unlock, a novel PIN-based framework that used GG to authenticate smartphones. By outsourcing the near-eye display, they introduced a randomized secret digit layout that shows on the near-eye display while the user enters the PIN on an empty layout on the smartphone screen. Through a usability study with 18 participants, their concept was tested with three input methods (10-key PIN, 6-key PIN, and swipe), and it proved robust against all visual attacks. The 6-key modality scored lowest in authentication time, and the swipe modality was favored by participants, and they recommend reducing it to 6 keys instead of 10 keys for lower input times. In [79], [PERSON] et al. discussed speech-based solutions to the eavesdropping issue in AR authentication schemes. They recommended both PIN-based, textual passwords, and graphical solutions.