Sorry for the late reply. This system isn't designed to be used on a terminal over the net. From the original paper:

    The proposed system is designed to be
    used as a local password mechanism requiring physical
    presence. That is, we consider authentication at the 
    entrance to a secure location where a guard can ensure 
    that a real person is taking the test without the aid of 
    any electronics.

And . . .

    We note that physical presence is necessary in 
    authentication systems designed to resist coercion 
    attacks. If the system supported remote authentication 
    then an attacker could coerce a trained user to 
    authenticate to a remote server and then hijack the 
    session.

If you're allowed remote attempts and multiple failures, the system is insecure in several ways. It's designed to work in a scenario where you get ONE attempt, and there's an armed guard who doesn't take kindly to it if you fail.