# Recent Trends of Authentication Methods in Extended Reality: A Survey
## 4 Authentication Methods in XR
### Knowledge-Based Authentication  
Knowledge-based authentication is among the dominant types of user authentication in XR. It is based on a knowledge factor--something the user knows and recalls, such as textual passwords, graphical passwords, personal identification numbers (PIN codes), patterns, etc. Knowledge-based authentication can be classified into three categories: recall-based, cue-based, and recognition-based authentication. Many researchers proposed knowledge-based methods for XR, adopting already existing techniques. After studying 30 knowledge-based approaches naming PINs and textual and graphical passwords, we generally conclude that seminal authentication methods in this category, such as PINS and patterns, offer secure solutions for authentication in XR. However, the main disadvantage of such methods is physical observation by attackers (shoulder surfing). In contrast, subsequent methods proposed shoulder-surfing-resistant methods that were based on the concept of immersiveness, which offers a safe space between the users and the system. This space is a hidden channel from real-world attackers, which makes it perfect for password cues that only users can observe. In addition, several proposed knowledge-based methods that implement traditional techniques retained all deployment benefits. They can be considered platform-agnostic and appealing to developers. This is crucial to developers adapting existing applications to an XR context, except for certain 3D-based passwords built differently than traditional PINs. Furthermore, techniques based on eye gaze, speech recognition, and head and hand gestures as input modalities are high-power-consuming but seem effortless and usable, which is not the case for other techniques where usability is greatly affected by the inconvenient nature of entering passwords on virtual keyboards or PIN pads. Thus, some methods are either considered visually accessible or hearing accessible because they work for one input modality but not the other. Finally, the unfamiliarity and complicated concepts of these new XR authentication techniques make them difficult to learn [34]. Several knowledge-based systems in XR systems have been explored. We categorized the password schemes into four groups: Alphanumeric, graphical, haptic pattern, and semantic. Alphanumeric passwords can include elements like digits, characters, and symbols. In [66], [PERSON] et al. studied the use and effect of cue-based authentication input modalities on security and usability in VR environments. They explored the impact of laserpointer, trackpad, and motion controller input modes on authentication time using a two-way ANOVA test. Their results showed that the trackpad modality outperforms the motion controller option; however, they are both slower than the laserpointer baseline modality, which matches traditional PIN-input methods, meaning that cue-based modalities improve security at the expense of usability. Their study also showed that the trackpad and motion controller methods are resilient to shoulder-surfing by design because they rely on visual cues delivered to the user through the headset, unlike the laserpointer modality, which is vulnerable to observations by bystanders. They recommended the use of cue-based modalities only when there is a high risk of observation attack due to their long authentication times; otherwise, using laserpointers would be a better option in terms of usability-security balance. In [67, 68], [PERSON] et al. presented RubikAuth, an authentication method for VR using a manipulable 5-faced 3D cube (the back face is omitted due to unreachability; the other faces have 1 color each and 9 digits per face, translating to 45\({}^{\text{n}}\) password possibilities). To authenticate themselves, users wear a Head-mounted Display (HMD) and hold a Hand-held Controllers (HHC) to manipulate the 3D cube. They use eye gaze, head pose, or tapping with the right-hand controller to select n digits for their password and use the left controller for confirmation.