A method for providing access control to a resource, comprising: receiving, by one or more processors, an authentication request from a user to access a resource that is protected by a shared secret established between the user and an authentication mechanism that controls access to the resource, the shared secret including a predefined sequence of states during each of which predefined authentication information is to be provided; receiving, by the one or more processors, specified information for each of the states; determining whether the specified information matches the predefined authentication information and has been correctly entered during each state and in the predefined sequence; in response to a determination that a match is incorrect, determining the number of incorrect attempts at entering the specified information that the user is allowed, based on the complexity of the predefined authentication information, characterized in that: the allowed number of incorrect attempts is proportional to the complexity of the predefined authentication information, and the complexity of the predefined authentication information is determined by a degree of similarity with previously-used predefined authentication information such that the complexity of the predefined authentication information is inversely proportional to the degree of similarity of the previously-used predefined authentication information. receiving, by one or more processors, an authentication request from a user to access a resource that is protected by a shared secret established between the user and an authentication mechanism that controls access to the resource, the shared secret including a predefined sequence of states during each of which predefined authentication information is to be provided; receiving, by the one or more processors, specified information for each of the states; determining whether the specified information matches the predefined authentication information and has been correctly entered during each state and in the predefined sequence; in response to a determination that a match is incorrect, determining the number of incorrect attempts at entering the specified information that the user is allowed, based on the complexity of the predefined authentication information, characterized in that: the allowed number of incorrect attempts is proportional to the complexity of the predefined authentication information, and the complexity of the predefined authentication information is determined by a degree of similarity with previously-used predefined authentication information such that the complexity of the predefined authentication information is inversely proportional to the degree of similarity of the previously-used predefined authentication information. the allowed number of incorrect attempts is proportional to the complexity of the predefined authentication information, and the complexity of the predefined authentication information is determined by a degree of similarity with previously-used predefined authentication information such that the complexity of the predefined authentication information is inversely proportional to the degree of similarity of the previously-used predefined authentication information.