A physical token to the user in the form of a unique card having a grid of images thereon. Each column and row of images has a unique text string of text. In addition, each user knows a special image, not necessarily present on the token card, on which one particular point or zone functions as an extra authentication feature. Users may be queried for a username, then shown a random one of the images on their card, and asked for the row text string plus column text string identifying the image. Users are also prompted to select their particular point or zone within their known special image, which is displayed, among a jumble of other images, by the computer system requesting authorization, such display serving to authenticate the computer system to the user. The system may be combined with password protection and methods to identify a user's machine.