Abstract: A method for recording a password for providing access to secure resources in a computer network, including a user establishing a session via the computer network in which the user is in communication with a password authority via the session; the user identifying themselves to the password authority via the session and requesting a password via the session; the password authority sending a code to the user otherwise than via the session; the user receiving the code and providing the code to the password authority via the session; the user providing a proposed password value to the password authority via the session; the password authority receiving and checking the validity of the code provided by the user and, if the code entered is valid, recording the proposed password value entered by user; in which the code is only valid if provided via the session via which the password is requested.