I had a similar idea, probably less user friendly than yours. The secret is a user defined function. When the user attempt to login. Some random inputs will be

I had a similar idea, probably less user friendly than yours. The secret is a user defined function. When the user attempt to login. Some random inputs will be given, the user can use a calculator to produce and type in the output. Since the calculator can be a physical one or just by brain, key logger and screen logger will not be able to steal the secret.