# Recent Trends of Authentication Methods in Extended Reality: A Survey
## 4 Authentication Methods in XR
### Knowledge-Based Authentication
Their usability study regarding entry time, error rate, and memorability revealed that the interaction modality does not have a significant effect on memorability. However, multimodal mechanisms (eye gaze or head pose with tactile input) are notably quicker and less error-prone than unimodal ones (eye gaze or head pose with dwelling). Additionally, the results of their security study in terms of robustness against both real-world and offline observations showed that multimodal mechanisms (eye gaze or head pose with tactile input) are resilient against real-world observations, while only the multimodal mechanism (eye gaze with tactile input) is robust against offline observations. In [89], [PERSON] et al. presented RoomLock, an authentication mechanism that leverages the 3D virtual space. Users authenticate by selecting 3D objects from their virtual environment. The usability studies of RoomLock indicated that it is usable and memorable, and security studies showed that RoomLock is highly secure against shoulder surfing attacks. Results also showed that despite longer authentication times in the virtual environment in comparison with the real world, users' perceptions of the workload are the same in both environments, meaning RoomLock is transferable. They indicated that with slight changes to the interaction modality, they are certain about the applicability of RoomLock to MR and AR devices, as well as its robustness against shoulder surfing attacks in those environments due to their closeness to the real world. In [90], [PERSON] et al. defined both the physical and physiological advantages of 3D authentication and introduced 3 Dpass, a 3D authentication scheme. Users generate a password by navigating the virtual environment and performing a set of actions and interactions with the objects present in the scene. To authenticate, they must perform the same actions and navigations with a level of tolerance toward distances and angles. In a controlled laboratory setting with 20 participants, their longitudinal usability study to test the memorability and usability of 3 Dpass in comparison with a monitor version of an alphanumeric password showed that 3 Dpass scored higher in memorability and preference but lower for entry times and hotspots. In [91], [PERSON] et al. proposed a 3D-cube-based authentication system for virtual environments as a solution against shoulder surfing attacks. The user's hand gets detected by the LM and visually displayed in the virtual environment to facilitate interaction and navigation. Then, the user virtually touches a cube in a sequential way. Each time a cube is touched, it displays a number on it. The system registers the sequence of the cubes' numbers and generates a unique password. The authors suggested adding more interactive elements to their system's 3D environment to enhance interactivity, increase the theoretical password space, and thus increase security. In [92], [PERSON] et al. developed an AR recognition-based authentication scheme for mashing up a doodle password with the AR environment. Users draw a doodle password five times to create the password, and they recreate the same password for authentication. The system then matches the recreated password with the five registered passwords according to size, coordinates, and content. Users get granted access only if the coordinates and size of the passwords match. The authors evaluated their authentication scheme, considering usability, security, and usefulness measures. The results of their evaluation demonstrated the ease and effectiveness of the scheme and that doodle-based passwords are highly secure due to the wide variety of possibilities that make them hard to crack. Current PIN-based and password-based authentication techniques are considered unsuitable for wearable SG due to their limited input space. In [93], [PERSON] et al. designed GlassPass, a tapping gesture-based user authentication scheme, to address that problem.