Abstract: A user of a computer seeking to access a protected resource must first authenticate with an authentication appliance. The user provides credentials to the authentication appliance for verification and for use in determining a mobile device associated with the user. The authentication appliance then dynamically generates a reference shared secret, such as an image, pattern, or key, which is also displayed to the user on the computer. The authentication appliance sends an authentication request to an application on the mobile device associated with the user. The application provides an interface in which the user may select, enter, draw, or reproduce the earlier-viewed shared secret on the mobile device. The user-provided secret is then compared to the reference shared secret. If the user-provided secret matches the reference shared secret, then the authentication appliance may provide the user or the computer access to the protected resource.