Protecting your customers’ private information has always been a pain. Data security is just hard to provide, and thanks to hackers, even harder to protect. Web 2.0 and social networking have only made things worse, providing more opportunities for a breach every hour.

Yet web security has long been a last vestige of innovation in the software space, and for one very good reason: there was never any money in it.

But that may be about to change. A one-and-a-half-year-old startup based in Tulsa, Okla., called Vidoop claims it has a business plan — and the technology — to actually make money off user logins.

Vidoop’s engineers (led by a CTO who is ex-Microsoft) have developed software that finally improves upon the leaky “user name + password” method, replacing it with a process of image recognition based on a grid of pictures displayed on the screen.

But here’s the really clever part: Vidoop will monetize the process by selling the images in the grid to advertisers for product placement. Instead of seeing a generic car in the image grid, consumers might see a Ford (F) Mustang, or a Prius (TM) . Instead of a cuppa Joe, they might see a tall Starbucks (SBUX).

The product is called Vidoop Secure. Through one business model, Vidoop will give away its software licenses for free, and then share revenue from the ad sales with its clients. Now large companies that have been putting off upgrading their site security over budgetary constraints (or that standard aversion to a software installation) have a cash incentive to do so.

And since Vidoop plans to broker, bundle and serve up ads from its servers to clients, even small companies — or startups too young to have even yet considered their security risks — have something to gain from installing Vidoop: a potential new revenue stream.

“Web security has always been a cost center. We’re turning it into something that makes you money,” says Vidoop’s 27-year-old founder, Luke Sontag.

The last company that figured out how to convert a utility transaction that we all took for granted into a cash machine has a stock trading at $579. It’s called Google (GOOG).

Here is how it works: When you register on a new site, you’re asked to pick three categories. Suppose you choose cars, planes and beverages. When you log in, Vidoop’s image grid pops up with a display of 12 images, pulled at random from Vidoop’s database. You never see the same combination of images twice — but there will always be a car, a plane and a drink.

Inside each image is a letter or number, also randomized. The letters and numbers displayed in the car, drink and plane act as a pass code for that single login. Since images and characters are chosen at random, no two logins are ever the same. This curbs the riskiest kind of hacking, says Sontag: “It is impossible to keystroke-record this,” Sontag says.

Vidoop might not be the next Google, but this idea is cool, and for my money, it has legs. The technology goes a long way toward advancing OpenID, too. Through a consumer play called MyVidoop, the company will let you log in to any web site you want through www.vidoop.com. For a very nice review on MyVidoop’s pros and cons, see our WebWorkerDaily post.

This summer Vidoop Secure landed its first anchor client, Schwab Retirement Technology, a business unit of the discount brokerage firm (SCHW).

Vidoop will make a modest licensing fee off its Schwab RT, but financial services are a huge potential client base. And the real money for Vidoop is in a licensing deal with a major media company, one that sees hundreds of millions of unique visitors a month, like Yahoo (YHOO), AOL (TWX), Google or even Microsoft (MSFT). Partnered with such a company, where ad buyers pay $20 per CPM, Vidoop, which will seek a near-50 percent revenue share, could generate tens of millions in annual revenues off just one contract.

Sontag says this is peanuts compared to what the company could make. “Until now no one track[ed] logins, and why? Because until now, no one knew how to monetize them,” he exclaims.

Vidoop confirms it is negotiating contracts with several of such media companies. Sontag wouldn’t name a potential partner, but at least one announcement is rumored to be imminent.

And security is clearly already on these companies’ radar. Google recently paid $625 million for Postini, which specializes in security email. We’re sure they have an appetite for more. Stay tuned.