NRXR-ID: Two-Factor Authentication (2FA) in VR Using Near-Range Extended Reality and Smartphones

Two-factor authentication (2FA) has become widely adopted as an efficient and secure way of validating someone’s identity online. Two-factor authentication is difficult in virtual reality (VR) because users are usually wearing a head-mounted display (HMD) which does not allow them to see their real-world surroundings. We present NRXR-ID, a technique to implement two-factor authentication while using extended reality systems and smartphones. The proposed method allows users to complete an authentication challenge using their smartphones without removing their HMD. We performed a user study in which we explored four types of challenges for users, including a novel checkers-style challenge. Users responded to these challenges under three different configurations, including a technique that uses a smartphone to support gaze-based selection without the use of a VR controller. A 4 × 3 within-subjects design allowed us to study all of the proposed variations. We collected performance metrics along with user experience questionnaires containing subjective impressions from thirty participants. Results suggest that the checkers-style visual matching challenge was the most preferred option, followed by the challenge involving entering a digital PIN submitted via the smartphone. Participants were fastest at solving the digital PIN challenge, with an average of 12.35 ± 5 s, followed by the Checkers challenge with 13.85 ± 5.29 s, then the CAPTCHA-style challenge with 14.36 ± 7.5 s, whereas the alphanumeric password took almost twice as long, averaging 32.71 ± 16.44 s. The checkers-style challenge performed consistently across all conditions with no significant differences (p = 0.185), making it robust to different implementation choices.