# Recent Trends of Authentication Methods in Extended Reality: A Survey
## 4 Authentication Methods in XR
### Knowledge-Based Authentication
For the PIN-based solutions, (1) users calculate the sum of the PIN digit and a random number displayed on the GG private display, then speak the result mod 10 for each digit and (2) users pronounce a letter associated with each PIN digit that is displayed on the GG private display. For the graphical-based solution, the users select grids of pictures that are assigned random labels by speaking out the label using head movements, blinks, or a touchpad. In addition, [PERSON] et al. [80] extensively studied the portability of popular SWIPE lock mobile device authentication systems to VR. They compared the speed and usability of the SWIPE authentication system in both mobile and VR environments through a 3-phase study: (1) a web experiment to gather and examine possible SWIPE password patterns; (2) a mobile device experiment; and (3) a VR experiment. The VR experiment entailed creating a VR replica of the mobile SWIPE authentication mechanism. The VR authentication system interaction was in terms of using an HHC, an HMD, a Leap Motion (LM) hand-tracking sensor, and an aGlass eye-tracking device (aGlass). Since shoulder-surfing is recognizedas a vulnerability on mobile devices, they also looked at how effective it was in a VR context. The study findings showed that, whereas mobile swipe authentication was the quickest and easiest to use, the HHC and LM versions were similarly quick and easy to use. According to the shoulder-surfing evaluation, attackers have a considerably lower success rate, and SWIPE in VR has a significantly high resistance to shoulder-surfing attacks. This makes this technique extremely safe to use in public settings where there may be a number of bystanders. In [81], [PERSON] et al. applied \"Things\", an authentication scheme proposed by [82] to protect against shoulder surfing attacks for the Microsoft Hololens (MH) headset. Their scheme is a gesture recognition-based graphical scheme where users select randomly displayed images on the private display of the HMD. They conducted usability studies to investigate usability and security aspects such as efficiency, satisfaction, and perceived security. They concluded that the scheme showed a high effectiveness due to easiness of memorizing graphical passwords; however, the long authentication duration needs to be improved by replacing gesture input with speech or eye gaze. In [83], [PERSON] et al. designed HoloPass, an MR gesture-based authentication prototype that requires users to mark patterns on a hologram image. Users register their passwords by drawing three patterns on the hologram image using gestures. Then, to authenticate, they must enter the same patterns by using elements on the image as a cue or reference. They designed an in-lab study to investigate the aspects of their MR prototype in terms of likeability, task execution, and guessing attacks and compared their results with the results of the desktop version to check if their prototype is platform-agnostic or not. The result of the study revealed a non-significant difference between both prototype versions in terms of password creation time and the number of password guesses needed to crack the password. The result also showed that users had a positive preference for the MR version of the prototype. [PERSON] et al. [84] proposed LookUnlock, a graphical authentication technique based on head-gaze tracking and spatial awareness. LookUnlock authorizes authentication on HMDs without requiring any extra devices by using spatially and virtually built passwords, namely, spatial passwords, virtual passwords, and hybrid passwords. Users select spatial targets in the environment by dragging the HMD's cursor over an object and pressing the enter key to set a spatial password. To unlock the procedure, users insert the spatial password by focusing their head gaze over the designated spatial targets. Binding spatial passwords to the environment adds a layer of security against observers.