Secure authentication systems and methods

1. A method for user authentication performed by a system comprising a processor and a non-transitory computer-readable storage medium storing instructions that, when executed by the processor, cause the system to perform the method, the method comprising:

receiving a login request from a user attempting to access a resource;

retrieving a cookie indicating that the user has been previously authenticated;

sending to the user a request for a valid username/password pair;

receiving at least a predetermined number of invalid username/password pairs from the user;

receiving the valid username/password pair from the user; and

requesting one or more responses to a first Reverse Turing Test (RTT).

2. The method of claim 1 , further comprising:

receiving one or more responses to the first RTT; and

selectively granting the user access to the resource only if the one or more responses to the first RTT are valid.

3. The method of claim 1 , wherein the first RTT is independent of the valid username/password pair.

4. The method of claim 1 , wherein the first RTT is a non-deterministic or random function that depends on the valid username/password pair.

5. The method of claim 1 , wherein a time between performing the step of receiving a username/password pair and performing the step of requesting one or more responses to a first RTT is substantially the same regardless of whether the username/password pair is valid.

6. The method of claim 1 , wherein the first RTT comprises at least one of:

a deterministic function of the valid username/password pair;

a non-deterministic function of the valid username/password pair; and

a random function.

7. The method of claim 1 , wherein the first RTT comprises an audible sound.

8. The method of claim 1 , wherein the resource comprises at least one of:

a bank account;

an Internet auction;

a stock trading account; and

an email account.

9. The method of claim 1 , wherein the system comprises at least one of:

an Internet-enabled personal digital assistant (PDA);

a cellular telephone;

a personal computer;

a server-side computer;

a web browser;

a client-side computer; and

a television set-top box.

10. The method of claim 1 , wherein the valid username/password pair comprises personal information of the user.

11. The method of claim 1 , further comprising notifying the user if the user gives an invalid response to the first RTT.

12. The method of claim 11 , further comprising preventing the user from accessing the resource for a predetermined period of time after receiving an invalid response to the first RTT.

13. The method of claim 1 , further comprising determining that the response to the first RTT is invalid based on a determination whether the response is within a predetermined margin of error of a valid response.

14. The method of claim 1 , wherein the first RTT is a publicly known deterministic function of the valid username/password pair.

15. The method of claim 1 , wherein the first RTT comprises an image on which the user is instructed to locate certain characters.

16. The method of claim 15 , further comprising receiving one or more responses to the first RTT from the user, wherein the one or more responses to the first RTT are provided by the user using a touch screen included on a device associated with the user.

17. The method of claim 1 , further comprising increasing the difficulty of the first RTT based on the number of received invalid username/password pairs.

18. The method of claim 1 , wherein retrieving the cookie further comprises retrieving the cookie from a server.