The Role of Environment and Modality in PIN Authentication for Extended Reality

As Extended Reality (XR) integrates into everyday life, authentication methods must balance usability and security. While PINs remain the most common method, their effectiveness across XR environments (VR vs. AR) and input modality remains understudied. We report on a study involving 72 participants that compares two modalities (gaze-only and gaze + controller) across two environments (VR and AR). In gaze-only, users select digits solely through eye gaze, whereas in gaze + controller, they confirm gaze-pointed digits with a controller trigger. Results show that perceptions varied by environment: AR afforded stronger perceptions of security through situational awareness, whereas VR supported focus and concentration. A tradeoff emerged between modalities: gaze-only was perceived as more secure, while gaze + controller was faster, easier, and preferred overall. These findings highlight that both modality and environment influence authentication in XR, underscoring the need for adaptive designs that cater to both usability demands and security perceptions.