Password-based Knowledge-based Authentication (KBA) is likely the most recognizable user interface in computing and the standard form of authentication for more than five decades. Despite it's prominence, it has many problems in the context of usable security. As we shift to a model of computing that utilizes augmented and virtual realities (AR/VR), this form of authentication has remained despite the nearly infinite possibilities these devices provide. We argue that the lack of a robust, standardized model that enables the consideration of unique AR/VR capabilities is partially to blame. We propose a theory-based model for describing and evaluating novel KBA schemes that connect both the mathematical and human complexities that are present. We then draw on theory to provide design principles to guide future advances.