Patent ID: 7430758

Claim:
A method performed by a client comprising: storing a secret in a secure storage; receiving a password challenge from a server; and responsive to the password challenge, calling a secure password prompt routine to execute a procedure, wherein the procedure comprises: (1) accessing the secret in the secure storage; (2) generating an authentication graphic based on the secret; and (3) rendering a prompt at a display device, the prompt including a request for a user to input a password and the authentication graphic, which are visible to the user; wherein the secure password prompt routine renders the authentication graphic for all password challenges; receiving the password from the user; generating a digest with a cryptographically-safe function that includes indicia of the received password and the received password challenge, wherein the digest is a communication that securely protects the password from being intercepted; and sending the digest to the server, wherein the server verifies the digest by comparing it to a recalculated digest that includes an indicia of the password challenge and a stored authentic password.