Direction-Based Authentication: Combining Symbolic Input and Contextual Cues for Virtual Reality Password Entry

This paper presents Direction-Based Authentication (DBA), a novel authentication method for virtual reality that combines symbolic input and contextual information to balance efficiency with memorability. In DBA, the password consists of four view directions selected by the user across four virtual environments. The user can either physically turn their head or use buttons to select directions, and remember the directions by either symbol or visual context. We conducted a within-subjects study (N=32) to evaluate the efficiency, memorability, and security compared to methods based on symbols or context only. The results demonstrated that password entry with DBA was more efficient than the contextual-only approach. While recall rate was not significantly higher than the symbolic-only method, participants' subjective ratings indicated that DBA better supported memorability. All three methods were highly resistant to observational attack, although the user-defined passwords appeared homogeneous in certain cases. Overall, the study shows that combining symbolic and contextual information is promising to balance efficiency with memorability for VR authentication, but potential usability and security issues can arise without careful consideration. Based on these findings, we discussed future directions for optimizing the usability and security of DBA and insights regarding participants' reliance on symbolic vs. visual information.