  Passwords remain a widely-used authentication mechanism, despite their
well-known security and usability limitations. To improve on this situation,
next-generation authentication mechanisms, based on behavioral biometric
factors such as eye movement and brainwave have emerged. However, their
usability remains relatively under-explored. To fill this gap, we conducted an
empirical user study (n=32 participants) to evaluate three brain-based and
three eye-based authentication mechanisms, using both qualitative and
quantitative methods. Our findings show good overall usability according to the
System Usability Scale for both categories of mechanisms, with average SUS
scores in the range of 78.6-79.6 and the best mechanisms rated with an
"excellent" score. Participants particularly identified brainwave
authentication as more secure yet more privacy-invasive and effort-intensive
compared to eye movement authentication. However, the significant number of
neutral responses indicates participants' need for more detailed information
about the security and privacy implications of these authentication methods.
Building on the collected evidence, we identify three key areas for
improvement: privacy, authentication interface design, and verification time.
We offer recommendations for designers and developers to improve the usability
and security of next-generation authentication mechanisms.
