Universal anonymous cross-site authentication

A computer-readable medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors, cause the one or more processors to:
• receive a request from a user device to initiate a secure session associated with a particular provider,
• the user device having received authentication credentials from a server;
• provide, to the user device, a challenge code associated with the secure session and a session key identifying the secure session;
• receive authentication information responding to the challenge code from the user device;
• provide, to the server, the authentication information from the user device and the challenge code;
• receive, from the server, a success code indicating that the authentication information is valid,
• the success code identifying the secure session,
• the success code indicating that the server confirmed that the authentication information includes a response to the challenge code that matches an expected response to the challenge code for the user device;
• and
• provide, to the user device, an indication that the secure session associated with the session key is authenticated based on receiving the success code.

A method, comprising:

• receiving, by a device from a user device, a request to initiate a secure session that is associated with a particular provider of multiple providers associated with providing secure sessions,
• the user device having received cryptographic information associated with generating responses to challenge codes;
• providing, by the device, a challenge code and a session key associated with the secure session;
• receiving, by the device, authentication information including a response to the challenge code,
• the authentication information being determined to be associated with the secure session based on the session key;
• determining, by the device, that the authentication information is valid without the particular provider being provided with access to user information identifying a user of the user device,
• the response to the challenge code having been determined to match an expected response to the challenge code determined based on other cryptographic information matching the cryptographic information;
• and
• providing, by the device, an indication that the secure session is authenticated based on determining that the authentication information is valid.