Replication Study: Cross-Country Evaluation of the Recognition-Based Graphical Authentication Scheme in AR and VR Environments

Augmented Reality (AR) and Virtual Reality (VR) Head-Mounted Displays (HMDs) handle sensitive data, necessitating user authentication and posing risks of shoulder-surfing in shared spaces. This replication study evaluates the recognition-based graphical authentication scheme – Things in AR and VR, extending Düzgün et al. [1], which focused on AR in Germany. We conducted a conceptual replication with 32 U.S. participants using Microsoft HoloLens (AR) and Valve Index (VR). Our findings align with the original study, showing comparable System Usability Scale (SUS) scores and perceived usability across regions. However, our success rate (73%) was lower than the original (90%), while perceived security was higher (3.90 vs. 3.19). Comparing platforms, Valve Index outperformed HoloLens with a higher SUS score (75.16 vs. 70.47), faster authentication (23.06s vs. 49.85s), and a higher success rate (85% vs. 73%). Participants found Valve Index's controller-based interaction more intuitive than HoloLens' tap gesture. To enhance Things in AR, we recommend exploring alternative input methods (e.g., voice commands, gaze-based selection) to reduce physical strain and allowing users to choose password images to improve memorability.