An authentication device, comprising: a processor; communications circuitry; a first memory having an operating system, OS, agent module stored thereon, said OS agent module comprising computer readable OS agent instructions that are executable by said processor from within a OS runtime environment of said authentication device; and a second memory having a pre boot authentication module, PBAM, stored thereon, said PBAM comprising computer readable instructions that are executable by said processor from within a pre boot environment of said authentication device; wherein said OS agent instructions are configured to cause (204, 304) said authentication device to reboot and transfer (205, 305) control to said PBAM within said pre boot environment; and said PBAM is configured to perform the following operations within said pre-boot environment: producing (208, 307) a platform authentication credential, PAC, from within said pre boot environment of said authentication device; and transmitting (209, 308) a copy of said PAC to an account management device that manages access to a user account, characterized in that said PAC is generated (208, 307) from identifying indicia specific to the authentication device and from user input, said user input comprising at least one of a keystroke pattern, one or more words, biometric information, or account information; and transmitting (209, 308) a copy of said PAC to said account management device comprises transmitting a second copy of said PAC in a PAC second copy signal, said PAC second copy signal being configured to cause said account management device to verify said second copy of said PAC against a first copy of said PAC bound to the user account, and transmit account restoration information for said user account if verification of said second copy against said first copy succeeds. a processor; communications circuitry; a first memory having an operating system, OS, agent module stored thereon, said OS agent module comprising computer readable OS agent instructions that are executable by said processor from within a OS runtime environment of said authentication device; and a second memory having a pre boot authentication module, PBAM, stored thereon, said PBAM comprising computer readable instructions that are executable by said processor from within a pre boot environment of said authentication device; wherein said OS agent instructions are configured to cause (204, 304) said authentication device to reboot and transfer (205, 305) control to said PBAM within said pre boot environment; and said PBAM is configured to perform the following operations within said pre-boot environment: producing (208, 307) a platform authentication credential, PAC, from within said pre boot environment of said authentication device; and transmitting (209, 308) a copy of said PAC to an account management device that manages access to a user account, characterized in that producing (208, 307) a platform authentication credential, PAC, from within said pre boot environment of said authentication device; and transmitting (209, 308) a copy of said PAC to an account management device that manages access to a user account, characterized in that said PAC is generated (208, 307) from identifying indicia specific to the authentication device and from user input, said user input comprising at least one of a keystroke pattern, one or more words, biometric information, or account information; and transmitting (209, 308) a copy of said PAC to said account management device comprises transmitting a second copy of said PAC in a PAC second copy signal, said PAC second copy signal being configured to cause said account management device to verify said second copy of said PAC against a first copy of said PAC bound to the user account, and transmit account restoration information for said user account if verification of said second copy against said first copy succeeds.