1. A method for authenticating a user comprising: prompting a user for a free-form password; receiving a user utterance; processing the utterance through a speech recognition engine to generate an acoustic baseform; matching future user utterances against the acoustic baseform; and using results from the matching to determine whether to grant the user access to a secure resource.