Method and system for authentication

A method for authentication, comprising:

• obtaining, by a mobile device from a computing device, an identifier for a session to be established between the computing device and a service provider server;
• receiving activation information from a user;
• determining, by the mobile device, if the received activation information matches pre-recorded activation information available to the mobile device;
• and
• in response to determining that the received activation information matches the pre-recorded activation information, sending, by the mobile device to the service provider server, the identifier for the session and a credential embodying an anonymised user identifier.

A service provider server comprising a processor and a memory arranged to store device executable instructions which when executed by the processor, cause the processor to:

• generate, in response to receiving a request for a session from a computing device, an identifier for the session;
• send to the computing device, the identifier for the session;
• obtain, in response to receiving the identifier for the session and a credential from a mobile device, an anonymised user identifier from the credential;
• determine if the anonymised user identifier is associated with a user record accessible to the service provider server, and
• in response to determining that the anonymised user identifier is associated with a user record, authorize the session.