In their experiment they asked subjects to count the number of times a letter appears on a screen. Each time a subject found the letter, their brains flashed a certain signal to the electroencephalogram. This signal, which is a change in the electrical potential measured by the EEG, is the same whenever someone is looking for a certain stimulus.
Cota said this means it's possible to build a two-level password system using images. Imagine, he said, choosing two pictures, one of a landmark, say Big Ben, and the other of a relative, one's mother, for instance.
To authenticate, one would choose the picture of Big Ben presented out of a set. Then one would see another set of pictures, showing Mom.
When looking at the correct picture, the brain generates a signal, which acts as the input, just like entering a PIN on a keypad. Since the reaction of the brain is stronger when looking at the target image, so the change in the electric potential of the brain will only happen in both cases for the "right" person.