A method comprising: making available, by a first user device, a public key of the first user device to devices of a device mesh, wherein the first user device is in the device mesh; receiving, at the first user device and from a user, a request to access one or more resources via the first user device; in response to receiving the request to access the one or more resources, determining a second user device in the device mesh having access to the public key of the first user device; signing, by the first user device and using a private key of the first user device, a request for user input of a credential at the second user device to generate a signed request; sending, from the first user device and to the second user device in the device mesh, the signed request for user input of the credential at the second user device, wherein the public key of the first user device is available to the second user device for verifying the signed request; receiving, at the first user device, the credential from the second user device; sending, from the first user device and to a server, a request comprising an identifier of at least one of the user or the first user device; receiving, from the server and based on the request comprising the identifier: an encrypted credential, encrypted static server entropy, and time-limited server entropy; decrypting, based on the time-limited server entropy and the credential from the second user device, the encrypted static server entropy; decrypting, based on the decrypted static server entropy and the time-limited server entropy, the encrypted credential; and authenticating, by the first user device, the user based on a comparison between the decrypted credential and the credential received from the second user device. making available, by a first user device, a public key of the first user device to devices of a device mesh, wherein the first user device is in the device mesh; receiving, at the first user device and from a user, a request to access one or more resources via the first user device; in response to receiving the request to access the one or more resources, determining a second user device in the device mesh having access to the public key of the first user device; signing, by the first user device and using a private key of the first user device, a request for user input of a credential at the second user device to generate a signed request; sending, from the first user device and to the second user device in the device mesh, the signed request for user input of the credential at the second user device, wherein the public key of the first user device is available to the second user device for verifying the signed request; receiving, at the first user device, the credential from the second user device; sending, from the first user device and to a server, a request comprising an identifier of at least one of the user or the first user device; receiving, from the server and based on the request comprising the identifier: an encrypted credential, encrypted static server entropy, and time-limited server entropy; decrypting, based on the time-limited server entropy and the credential from the second user device, the encrypted static server entropy; decrypting, based on the decrypted static server entropy and the time-limited server entropy, the encrypted credential; and authenticating, by the first user device, the user based on a comparison between the decrypted credential and the credential received from the second user device.