1. A method of providing authentication codes to authenticate a user to an authentication server, the method comprising: generating, by an electronic apparatus, token codes from a cryptographic key; obtaining, by the electronic apparatus, biometric measurements from a user; and outputting, by the electronic apparatus, composite passcodes as the authentication codes; wherein the composite passcodes include the token codes and biometric factors based on the biometric measurements; wherein the token codes and the biometric factors of the composite passcodes act as authentication inputs to user authentication operations performed by the authentication server; wherein the electronic apparatus is a mobile device which stores the cryptographic key and which runs a soft token application; wherein generating the token codes from the cryptographic key includes deriving, as the token codes, a series of one-time use passwords (OTPs) based on the cryptographic key using the soft token application, each OTP being valid during a respective time window and invalid outside that respective time window; wherein the mobile device is equipped with a set of biometric assessment applications; wherein the method further comprises processing, by the mobile device, the biometric measurements using the set of biometric assessment applications to form the biometric factors based on the biometric measurements; wherein the set of biometric assessment applications includes a typing recognition application; wherein obtaining the biometric measurements from the user includes capturing, by a keyboard of the mobile device, a set of current typing samples from the user during a current authentication attempt; wherein processing the biometric measurements using the set of biometric assessment applications includes identifying, using the typing recognition application, a deliberate mistyping and typing correction event provided by the user; and wherein outputting the composite passcodes as the authentication codes includes providing an alert to signal user distress to the authentication server in response to identification of the deliberate mistyping and typing correction event.