Patent ID: 8281147

Claim:
A system that enables obscuring a password entered upon an untrusted client, comprising: a data store that includes a set of user images that are selected by a user; a randomized selection component that generates a sequence of images; and a shared-secret proxy residing on the untrusted client or a web server that communicates traffic between the untrusted client and a login server, the shared-secret proxy to: receive a request for a login to the login server from the untrusted client; provide the sequence of images to the untrusted client, the sequence of images including a plurality of images from the set of user images intermixed with one or more random images, each of the plurality of images prompting the user to sequentially enter a password character that is unduplicated in the plurality of images, and each random image prompting the user to enter a random character that is unrelated to a password that includes password characters; and receive a character string from the untrusted client for logging into the login server that includes password characters of the password obscured by at least one random character, wherein the shared-secret proxy further comprises a registration component that prepares a user account including a uniform resource locator (URL) and a user identifier pair that uniquely identifies the set of user images, the shared-secret proxy automatically retrieves the set of user images for integration into the sequence of images in response to an initiation of the login to the login server with a submission of the URL and the user identifier pair to the shared-secret proxy.