Secure authentication

A computer-implemented method for passwordless authentication of a user, the method comprising:

• identifying a request by a user to access an access-restricted target resource, the user operating on a client computing device and the request being associated with a network address for the access-restricted target resource;
• intercepting the request before the request can reach the access-restricted target resource;
• generating a unique session identifier for the user, the unique session identifier being unique to the request and being generated independent of an authentication of the user;
• making available, through a computer-based user interface separate from the client computing device, the unique session identifier to the user of the client computing device, wherein the making available comprises at least one of displaying or audibly presenting a representation of the unique session identifier to the user;
• authenticating the user through a concurrent verification of the identity of the client device and the physical presence of the user, comprising:
• generating a prompt for a physical verification of the user through the client computing device, the physical verification being based on one or more unique physical characteristics of the user,
• receiving, from the client computing device concurrently with the physical verification, the unique session identifier that was made available to the user, the unique session identifier being returned through an action by the user on the client computing device as a result of the physical verification, and
• confirming the identity of the client device associated with the user, based on the received unique session identifier, and the user's current physical presence at the client computing device, based on a result of the physical verification.

A computer-implemented method for passwordless authentication of a user of a client computing device, the method comprising:

• sending a request, from the client computing device, for a user of the client computing device to access an access-restricted target resource, the request being associated with a network address for the access-restricted target resource;
• receiving, from a security server and in response to the request, through a computer-based user interface separate from the client computing device, a unique session identifier for the user, the unique session identifier being displayed or audibly presented to the user, being unique to the request, and being generated independent of an authentication of the user;
• and
• performing steps to enable authentication of the user through a concurrent verification of the identity of the client device and the physical presence of the user, comprising:
• receiving a prompt for a physical verification of the user through the client computing device,
• performing a physical verification of the user based on one or more unique physical characteristics of the user, and
• returning a result of the physical verification concurrently with the received unique session identifier to the security server for confirmation of the identity of the client device associated with the user based on the received unique session identifier, and the user's current physical presence at the client computing device based on the result of the physical verification, the unique session identifier being returned through an action by the user on the client computing device as a result of the physical verification.