A computing system for providing cryptographic isolation between a client device and a server computer for providing a network service to the client device, the computing system comprising: a first data port coupled to the client device; a second data port coupled to the server computer; a non-transitory, tangible storage medium in which is stored (a) an encryption, using an irreversible encryption algorithm, of original user authentication data that are a function of a unique property of the client device and a unique property of a user of the client device, and (b) an encryption, using a reversible encryption algorithm that uses the original user authentication data as a decryption parameter, of service authorization data required by the server computer to be presented to the server computer as a condition of permitting the user to access the network service; and a computing processor configured to receive purported user authentication data in combination with a request to access the network service, and in response to such receipt, to perform the processes of: encrypting the purported user authentication data using the irreversible encryption algorithm to produce encrypted purported user authentication data; only when the encrypted purported user authentication data matches the stored encryption of the original user authentication data, decrypting the encryption of the service authorization data to produce decrypted service authorization data; presenting, to the server computer using the second data port, the decrypted service authorization data in combination with a request to access the network service on behalf of the user; and upon receipt in the computing system from the server computer of data indicating that the user is authorized to access the network service, exchanging service data between the client device using the first data port and the server computer using the second data port a first data port coupled to the client device; a second data port coupled to the server computer; a non-transitory, tangible storage medium in which is stored (a) an encryption, using an irreversible encryption algorithm, of original user authentication data that are a function of a unique property of the client device and a unique property of a user of the client device, and (b) an encryption, using a reversible encryption algorithm that uses the original user authentication data as a decryption parameter, of service authorization data required by the server computer to be presented to the server computer as a condition of permitting the user to access the network service; and a computing processor configured to receive purported user authentication data in combination with a request to access the network service, and in response to such receipt, to perform the processes of: encrypting the purported user authentication data using the irreversible encryption algorithm to produce encrypted purported user authentication data; only when the encrypted purported user authentication data matches the stored encryption of the original user authentication data, decrypting the encryption of the service authorization data to produce decrypted service authorization data; presenting, to the server computer using the second data port, the decrypted service authorization data in combination with a request to access the network service on behalf of the user; and upon receipt in the computing system from the server computer of data indicating that the user is authorized to access the network service, exchanging service data between the client device using the first data port and the server computer using the second data port encrypting the purported user authentication data using the irreversible encryption algorithm to produce encrypted purported user authentication data; only when the encrypted purported user authentication data matches the stored encryption of the original user authentication data, decrypting the encryption of the service authorization data to produce decrypted service authorization data; presenting, to the server computer using the second data port, the decrypted service authorization data in combination with a request to access the network service on behalf of the user; and upon receipt in the computing system from the server computer of data indicating that the user is authorized to access the network service, exchanging service data between the client device using the first data port and the server computer using the second data port