Secure authentication systems and methods

1. A method for user authentication performed by a system comprising a processor and a non-transitory computer-readable storage medium storing instructions that, when executed by the processor, cause the system to perform the method, the method comprising:

receiving a login request from a user attempting to access a resource;

determining whether the user possesses a cookie indicating that the user has been previously authenticated;

if the user possesses the cookie:

receiving a username/password pair associated with the user,

determining whether the username/password pair is valid, and

selectively granting the user access to the resource if the username/password pair is valid; and

if the user does not possess the cookie:

receiving a username/password pair associated with the user,

determining whether the username/password pair is valid, and

requesting one or more responses to a first Reverse Turing Test (RTT) regardless of whether the username/password pair is valid.

2. The method of claim 1 , further comprising:

if the user does not possess the cookie:

receiving one or more responses to the first RTT, and

selectively granting the user access to the resource if the username/password pair is valid and the one or more responses to the first RTT are valid.

3. The method of claim 1 , wherein a time between performing the step of receiving a username/password pair and performing the step of requesting one or more responses to a first RTT is substantially the same regardless of whether the username/password pair is valid.

4. The method of claim 1 , wherein the first RTT comprises at least one of:

a deterministic function of the valid username/pas sword pair;

a non-deterministic function of the valid username/pas sword pair; and

a random function.

5. The method of claim 1 , further comprising preventing the user from accessing the resource for a predetermined period of time after receiving an invalid response to the first RTT.

6. The method of claim 1 , further comprising receiving one or more responses to the first RTT from the user, wherein the one or more responses to the first RTT are provided by the user using a touch screen.

7. The method of claim 1 , further comprising increasing the difficulty of the first RTT based on the number of received invalid username/password pairs.

8. The method of claim 1 , wherein determining whether the user possesses the cookie comprises retrieving the cookie from a server.

9. The method of claim 1 , wherein determining whether the user possesses the cookie comprises determining whether the cookie is stored on a device associated with the user.

10. A method for authenticating a user for access to a resource performed by a system comprising a processor and a non-transitory computer-readable storage medium storing instructions that, when executed by the processor, cause the system to perform the method, the method comprising:

obtaining personal information associated with a user attempting to access the resource;

determining whether the personal information is valid;

requesting one or more responses to a first Reverse Turing Test (RTT), regardless of whether the personal information is valid; and

selectively granting the user access to the resource only if the personal information is valid and one or more responses to the first RTT are valid.

11. The method of claim 10 , wherein the personal information is entered manually by the user.

12. The method of claim 10 , wherein the personal information is obtained from a cookie associated with the user.

13. The method of claim 10 , wherein the first RTT comprises at least one of:

a deterministic function of the personal information;

a non-deterministic function of the personal information; and

a random function.

14. The method of claim 10 , wherein the system comprises at least one of:

an Internet-enabled personal digital assistant (PDA);

a cellular telephone;

a personal computer;

a server-side computer;

a web-browser;

a client-side computer; and

a television set-top box.

15. The method of claim 10 , wherein the method further comprises notifying the user if the user gives an invalid response to the first RTT.

16. The method of claim 10 , wherein the method further comprises preventing the user from accessing the resource for a predetermined period of time after receiving an invalid response to the first RTT.

17. The method of claim 10 , wherein the first RTT comprises an image on which the user is instructed to locate certain characters.

18. The method of claim 17 , wherein the user is instructed to locate the certain characters using a touch screen display.