A method comprising: obtaining, at data processing hardware of a user device executing a service application and an authenticator application, an operation request requesting the service application to access a remote entity to perform an operation, the operation request comprising: a remote entity identifier identifying the remote entity; and operation information associated with the operation; issuing, by the service application executing on the data processing hardware, an authentication request requesting the authenticator application to obtain user authentication credentials of a user of the user device associated with the remote entity for authenticating the user before the remote entity performs the operation; encrypting, by the authenticator application executing on the data processing hardware, the obtained user authentication credentials using a public key of the remote entity so that the service application is restricted from obtaining the user authentication credentials in unencrypted form; providing, by the authenticator application executing on the data processing hardware, the encrypted user authentication credentials to the service application; and transmitting, by the service application executing on the data processing hardware, to the remote entity, the operation request and the encrypted user authentication credentials, the operation request and the encrypted user authentication credentials when received by the remote entity causing the remote entity to: decrypt the encrypted user authentication credentials using a private key of the remote entity; and validate the decrypted user authentication credentials. obtaining, at data processing hardware of a user device executing a service application and an authenticator application, an operation request requesting the service application to access a remote entity to perform an operation, the operation request comprising: a remote entity identifier identifying the remote entity; and operation information associated with the operation; a remote entity identifier identifying the remote entity; and operation information associated with the operation; issuing, by the service application executing on the data processing hardware, an authentication request requesting the authenticator application to obtain user authentication credentials of a user of the user device associated with the remote entity for authenticating the user before the remote entity performs the operation; encrypting, by the authenticator application executing on the data processing hardware, the obtained user authentication credentials using a public key of the remote entity so that the service application is restricted from obtaining the user authentication credentials in unencrypted form; providing, by the authenticator application executing on the data processing hardware, the encrypted user authentication credentials to the service application; and transmitting, by the service application executing on the data processing hardware, to the remote entity, the operation request and the encrypted user authentication credentials, the operation request and the encrypted user authentication credentials when received by the remote entity causing the remote entity to: decrypt the encrypted user authentication credentials using a private key of the remote entity; and validate the decrypted user authentication credentials. decrypt the encrypted user authentication credentials using a private key of the remote entity; and validate the decrypted user authentication credentials.