Patent ID: 8640212

Claim:
A method comprising: sending, by a server computer system, a web page over a network to a client, the web page comprising a request for user input of an answer to a challenge, a graphical user interface for receiving a user identifier and a password, and a security script; receiving, by the server computer system, a client hash value from the client, the client hash value of computed by hashing the password to generate a first hash value, and hashing the first hash value combined with the user input of the answer to generate the client hash value; computing, by the server computer system, a server hash value using password data for the user that is stored in a data store coupled to the server and a server-side answer that is stored in the data store; determining, by the server computer system, whether the server hash value matches the client hash value; and granting, by the server computer system, data access to the user in view of a determination that the server hash value matches the client hash value and denying data access to the user in view of a determination that the server hash value does not match the client hash value.