A system comprising a first device and a second device, the second device comprising: a user interface operable to present information to a user and to receive input therefrom; and user-authentication-based approval logic operable to receive a session identifier from the first device over an insecure channel, wherein the first device received the session ID from an identity provider, and to perform the following in response to at least receiving the session ID from the first device: send the session ID to the identity provider; receive from the identity provider first user-observable information, or an identifier thereof, and a security challenge, the first user-observable information bearing a user-discernable relationship to second user-observable information received by the first device from the identity provider and presented to a user by the first device; present the first user-observable information to the user via the user interface; and generate a response to the security challenge and transmit the response to the security challenge to the identity provider based at least on input received from the user via the user interface, the response to the security challenge being indicative of the suitability of the first device for user-authentication-based approval by the identity provider. a user interface operable to present information to a user and to receive input therefrom; and user-authentication-based approval logic operable to receive a session identifier from the first device over an insecure channel, wherein the first device received the session ID from an identity provider, and to perform the following in response to at least receiving the session ID from the first device: send the session ID to the identity provider; receive from the identity provider first user-observable information, or an identifier thereof, and a security challenge, the first user-observable information bearing a user-discernable relationship to second user-observable information received by the first device from the identity provider and presented to a user by the first device; present the first user-observable information to the user via the user interface; and generate a response to the security challenge and transmit the response to the security challenge to the identity provider based at least on input received from the user via the user interface, the response to the security challenge being indicative of the suitability of the first device for user-authentication-based approval by the identity provider. send the session ID to the identity provider; receive from the identity provider first user-observable information, or an identifier thereof, and a security challenge, the first user-observable information bearing a user-discernable relationship to second user-observable information received by the first device from the identity provider and presented to a user by the first device; present the first user-observable information to the user via the user interface; and generate a response to the security challenge and transmit the response to the security challenge to the identity provider based at least on input received from the user via the user interface, the response to the security challenge being indicative of the suitability of the first device for user-authentication-based approval by the identity provider.