The increasing adoption of Extended Reality (XR) technologies brings immersive interfaces into critical domains like healthcare and manufacturing. However, deciding how to protect users in these environments remains an open challenge. Although prior research explores individual authentication mechanisms, existing selection methods ignore context-specific constraints, environmental factors, and user perceptions central to XR. To address this, we conducted a qualitative study with usable-security experts to uncover key design considerations that current approaches overlook. Next, we mapped well-known selection methodologies against these considerations and identified important mismatches. In response, we developed AURA-XR, a risk-based framework integrating stakeholder perceptions, environmental and scenario-specific constraints, and risk assessment into a decision model. We demonstrate that AURA-XR supports context-sensitive, multi-objective authentication decisions tailored to this emerging domain. By filling a methodological gap, AURA-XR advances adaptive, privacy-aware, human-centred security in immersive systems, opening new routes for robust, situationally informed authentication in XR.

Authentication in extended reality (XR) presents unique challenges due to embodied interaction, spatial immersion, and variable environmental conditions. As XR systems become more prevalent, secure and usable authentication mechanisms are critical. However, current research often overlooks the scenarios in which these mechanisms operate, limiting comparability, reproducibility, and real-world applicability. This paper addresses this gap by presenting a structured model of XR authentication scenarios. We conducted semi-structured interviews with experts in the Usable Security and Privacy domain to identify key scenario dimensions influencing the design and evaluation of XR authentication mechanisms. Through thematic analysis, we identified dimensions related to contextual parameters, environmental conditions, and XR-specific properties. The resulting scenario model was validated through literature mapping and demonstrated via a realistic use case. Our work provides a foundation for context-aware design and more rigorous evaluation of authentication mechanisms across diverse XR environments.

Graphical user authentication (GUA) is a common alternative to text-based user authentication, where people are required to draw graphical passwords on background images. Such schemes are theoretically considered remarkably secure because they offer a large password space. However, people tend to create their passwords on salient image areas introducing high password predictability. Aiming to help people use the password space more effectively, we propose a gameful password creation process. In this paper, we present GamePass, a gamified mechanism that integrates the GUA password creation process. We provide the first evidence that it is possible to nudge people towards better password choices by gamifying the process. GamePass randomly guides participants’ attention to areas other than the salient areas of authentication images, makes the password creation process more fun, and people are more engaged. Gamifying the password creation process enables users to interact better and make less predictable graphical password choices instead of being forced to use a strict password policy.

In multiplayer collaborative games, players need to coordinate their actions and synchronize their efforts effectively to succeed as a team; thus, individual differences can impact teamwork and gameplay. This article investigates the effects of cognitive styles on teams engaged in collaborative gaming activities. Fifty-four individuals took part in a mixed-methods user study; they were classified as field-dependent (FD) or independent (FI) based on a field-dependent–independent (FD-I) cognitive-style-elicitation instrument. Three groups of teams were formed, based on the cognitive style of each team member: FD-FD, FD-FI, and FI-FI. We examined collaborative gameplay in terms of team performance, cognitive load, communication, and player experience. The analysis revealed that FD-I cognitive style affected the performance and mental load of teams. We expect the findings to provide useful insights on understanding how cognitive styles influence collaborative gameplay.

For the past 20 years, researchers have investigated the use of eye tracking in security applications. We present a holistic view on gaze-based security applications. In particular, we canvassed the literature and classify the utility of gaze in security applications into a) authentication, b) privacy protection, and c) gaze monitoring during security critical tasks. This allows us to chart several research directions, most importantly 1) conducting field studies of implicit and explicit gaze-based authentication due to recent advances in eye tracking, 2) research on gaze-based privacy protection and gaze monitoring in security critical tasks which are under-investigated yet very promising areas, and 3) understanding the privacy implications of pervasive eye tracking. We discuss the most promising opportunities and most pressing challenges of eye tracking for security that will shape research in gaze-based security applications for the next decade.

Graphical password composition is an important part of graphical user authentication which affects the strength of the chosen password. Considering that graphical authentication is associated with visual search, perception, and information retrieval, in this paper we report on an eye-tracking study (N = 109) that aimed to investigate the effects of users’ cognitive styles toward the strength of the created passwords and shed light into whether and how the visual strategy of the users during graphical password composition is associated with the passwords’ strength. For doing so, we adopted Witkin’s Field Dependence-Independence theory, which underpins individual differences in visual information and cognitive processing, as graphical password composition tasks are associated with visual search. The analysis revealed that users with different cognitive processing characteristics followed different patterns of visual behavior during password composition which affected the strength of the created passwords. The findings underpin the need of considering human-cognitive characteristics as a design factor in graphical password schemes. The paper concludes by discussing implications for improving recognition-based graphical passwords through adaptation and personalization techniques based on individual cognitive characteristics.

Nowadays, technological advances introduce new visualization and user interaction possibilities. Focusing on the user authentication domain, graphical passwords are considered a better fit for interaction environments which lack a physical keyboard. Nonetheless, the current graphical user authentication schemes are deployed in conventional layouts, which introduce security vulnerabilities associated with the strength of the user selected passwords. Aiming to investigate the effectiveness of advanced visualization layouts in selecting stronger passwords, this paper reports a between-subject study, comparing two different design layouts a two-dimensional and a three dimensional. Results provide evidence that advanced visualization techniques provide a more suitable framework for deploying graphical user authentication schemes and underpin the need for considering such techniques for providing assistive and/or adaptive mechanisms to users aiming to assist them to create stronger graphical passwords.

Visual attention, search, processing and comprehension are important cognitive tasks during a graphical password composition activity. Aiming to shed light on whether individual differences on visual behavior affect the strength of the created passwords, we conducted an eye-tracking study (N=36), and adopted an accredited cognitive style theory to interpret the results. The analysis revealed that users with different cognitive styles followed different patterns of visual behavior which affected the strength of the created passwords. Motivated, by the results of the first study, we introduced adaptive characteristics to the user authentication mechanism, aiming to assist specific cognitive style user groups to create more secure passwords, and conducted a second study with a new sample (N=40) to test the adaptive characteristics. Results strengthen our assumptions that adaptive mechanisms based on users' differences in cognitive and visual behavior uncover a new perspective for improving the password's strength within graphical user authentication realms.

In this paper, we introduce a two-step method for estimating the strength of user-created graphical passwords based on the eye-gaze behaviour during password composition. First, the individuals' gaze patterns, represented by the unique fixations on each area of interest (AOI) and the total fixation duration per AOI, are calculated. Second, the gaze-based entropy of the individual is calculated. To investigate whether the proposed metric is a credible predictor of the password strength, we conducted two feasibility studies. Results revealed a strong positive correlation between the strength of the created passwords and the gaze-based entropy. Hence, we argue that the proposed gaze-based metric allows for unobtrusive prediction of the strength of the password a user is going to create and enables intervention to the password composition for helping users create stronger passwords.

Evidence suggests that individual cognitive differences affect users' memorability, visual behavior, and graphical passwords' security. Such knowledge denotes the added value of personalizing graphical password schemes towards the unique cognitive characteristics of the users. However, real-time and accurate cognition-based predictive user models are necessary to reach such a breakthrough. In this paper, we present the results of such an attempt, where an in-lab eye-tracking study was conducted with 36 participants who completed a recall-based graphical password composition task. We adopted a credible cognitive style theory, and investigated a variety of eye-tracking metrics to predict participants' cognitive styles. Results' analysis reveals that inferring individual cognitive differences in real-time during graphical password composition is feasible within a few seconds and that specific eye-tracking metrics correlate stronger with certain cognitive style groups. The findings further support the vision of incorporating real-time adaptive mechanisms in graphical password schemes for the benefit of service providers and end-users.

Recent research provides evidence that individual differences in human cognitive styles affect user performance and experience in diverse application domains. However, state-of-the-art elicitation methods of cognitive styles require researchers to apply explicit, in-lab, and time-consuming "paper-and-pencil" techniques, rendering real-time integration of cognitive styles? elicitation impractical in interactive system design. Aiming to elaborate an implicit elicitation method of cognitive styles, this paper reports two feasibility studies based on an eye-tracking multifactorial model. In both studies, participants performed visual activities of varying characteristics, and the eye-tracking analysis revealed quantitative differences on visual behavior among individuals with different cognitive styles. Based on these differences, a series of classification experiments were conducted, and the results revealed that gaze-based implicit elicitation of cognitive styles in real-time is feasible, which could be used by interactive systems to adapt to the users' cognitive needs and preferences, to better assist them, and improve their performance and experience.

This paper investigates the trade-off between security and usability in recognition-based graphical authentication mechanisms. Through a user study (N=103) based on a real usage scenario, it draws insights about the security strength and memorability of a chosen password with respect to the amount of images presented to users during sign-up. In particular, it reveals the users' predisposition in following predictable patterns when selecting graphical passwords, and its effect on practical security strength. It also demonstrates that a "sweet-spot" exists between security and usability in graphical authentication approaches on the basis of adjusting accordingly the image grid size presented to users when creating passwords. The results of the study can be leveraged by researchers and practitioners engaged in designing intelligent graphical authentication user interfaces for striking an appropriate balance between security and usability.

This paper reports the results of a study of software development organizations' approach towards usability, conducted on software development organizations in Greece, extending a survey conducted in Southern Italy in 2011. The results show that the organization performing usability evaluation is nearly the same in both countries as well as the key advantages and the problems in performing usability evaluation emphasized by Italian and Greek respondents. A difference in the understanding of usability evaluation concept between the two studies emerged.