A user authentication technique that allows a user to access a protected resource such as an account on a web site or secure files on a computing device such as a smartphone, personal computer, tablet computer, and the like, employs a shared secret that employs a state machine to sequentially transition between a series of states during which the user is requested to enter predefined information that is also a part of the shared secret. That is, the shared secret includes user-specific data that must be provided and the particular sequence or manner in which the user-specific data or credentials are to be provided. The authentication technique may supplement the user of conventional one or two factor authentication techniques requiring, e.g., a password or both a username and password, which are commonly used to gain access to a resource.