A method by an access service device configured for authenticating a client device, the method comprising: receiving a first access request identifying a protected resource from the client device, the first access request including an identifier; generating a first interface that includes a plurality of graphical objects for presentation at random locations on a display of the client device as defined by a first object map, the plurality of graphical objects including a decoy object and a set of user-defined objects associated with the identifier that define a graphical password, the graphical password further being defined by a specific order in which the set of user-defined objects are to be selected; receiving input data including an input event for each interaction with the first interface that the client device detects, the input event for each interaction identifying a position on the display at which a corresponding interaction was detected, and the input data including no information identifying the graphical objects of the first interface; determining that the input data satisfies the graphical password using the first object map by evaluating the position identified by the input event for each interaction with the first object map to identify a particular graphical object that was selected in a given interaction; and in response to determining that the input data satisfies the graphical password, granting access to the protected resource, wherein determining that the input data satisfies the graphical password using the first object map comprises: evaluating the position on the display of each input event using the first object map and time stamps associated with each input event; and determining, based on the evaluated position on the display of each input event and on the evaluated time stamps associated with each input event that each user-defined object defining the graphical password was selected in the specified order without selecting the decoy object. receiving a first access request identifying a protected resource from the client device, the first access request including an identifier; generating a first interface that includes a plurality of graphical objects for presentation at random locations on a display of the client device as defined by a first object map, the plurality of graphical objects including a decoy object and a set of user-defined objects associated with the identifier that define a graphical password, the graphical password further being defined by a specific order in which the set of user-defined objects are to be selected; receiving input data including an input event for each interaction with the first interface that the client device detects, the input event for each interaction identifying a position on the display at which a corresponding interaction was detected, and the input data including no information identifying the graphical objects of the first interface; determining that the input data satisfies the graphical password using the first object map by evaluating the position identified by the input event for each interaction with the first object map to identify a particular graphical object that was selected in a given interaction; and in response to determining that the input data satisfies the graphical password, granting access to the protected resource, wherein determining that the input data satisfies the graphical password using the first object map comprises: evaluating the position on the display of each input event using the first object map and time stamps associated with each input event; and determining, based on the evaluated position on the display of each input event and on the evaluated time stamps associated with each input event that each user-defined object defining the graphical password was selected in the specified order without selecting the decoy object. evaluating the position on the display of each input event using the first object map and time stamps associated with each input event; and determining, based on the evaluated position on the display of each input event and on the evaluated time stamps associated with each input event that each user-defined object defining the graphical password was selected in the specified order without selecting the decoy object.