Zero-trust authentication may replace passwords in AR/VR headsets

Security has become enough of a concern for phones, tablets, and computers that passwords or biometric scans have become mandatory for most devices, preventing unauthorized users from accessing their contents. But as AR and VR headsets evolve into standalone devices, typing or scanning might not be as simple for users, so a group of researchers is proposing an alternative: Zero-Trust Authentication, also known as ZeTA.

If you haven’t heard of ZeTA, you’re not alone. Unlike passwords, which rely upon users and devices to match a sequence of characters to unlock access, ZeTA privately shares a multi-factor “secret” with the user, later asking yes or no challenge questions to determine whether a user knows the secret. The secret could be “blue NOT green,” accepting yes to the challenge “sky?” and no to “grass?,” while “yellow OR wheel” could accept yes answers to “sunflower?” and “steering?” but no to “heart?” and “coal?” Depending on the number of challenges, ZeTA can scale from rudimentary security to typical PIN- or online guessing thresholds.