SPHinX - Secure Painting-based autHentication in eXtended reality and the metaverse

Authentication in immersive virtual reality, and more in general, into extended reality applications is a growing need. The crude adoption of 2D authentication schemes into virtual environments could raise security and usability issues. This paper proposes SPHinX, a novel three-dimensional (3D) authentication scheme based on unlocking patterns. Users can authenticate by painting (tracing) patterns on a 3D object. In this way, 3D interactions can be leveraged to make the authentication scheme less vulnerable to different types of attacks, e.g., shoulder surfing. A user study was carried out by involving 16 participants with the aim to compare a number of alternatives concerning the shape of the object to be painted, the use of single or multiple patterns, and multi-factor authentication