A computer-implemented method for passwordless authentication of a user the method performed by a security server, the method comprising: identifying a request by the user to access an access-restricted target resource (107, 108, 109), the user operating on a client computing device and the request being associated with a network address for the access-restricted target resource (107, 108, 109); intercepting the request before the request can reach the access-restricted target resource (107, 108, 109); generating a unique session identifier for the user; making available, through a computer-based user interface, the unique session identifier to the user of the client computing device; and authenticating the user through a concurrent verification of the identity of the client computing device and the physical presence of the user, wherein the authenticating comprises: generating a prompt for a physical authentication of the user through the client computing device, confirming a result of the physical authentication of the user based on one or more unique physical characteristics of the user, receiving, from the client computing device concurrently with the physical authentication, the unique session identifier that was made available to the user, the unique session identifier being returned through an action by the user operating the client computing device, and confirming the identity of the client computing device associated with the user, based on the received unique session identifier, and the user's current physical presence at the client computing device, based on the result of the physical authentication. identifying a request by the user to access an access-restricted target resource (107, 108, 109), the user operating on a client computing device and the request being associated with a network address for the access-restricted target resource (107, 108, 109); intercepting the request before the request can reach the access-restricted target resource (107, 108, 109); generating a unique session identifier for the user; making available, through a computer-based user interface, the unique session identifier to the user of the client computing device; and authenticating the user through a concurrent verification of the identity of the client computing device and the physical presence of the user, wherein the authenticating comprises: generating a prompt for a physical authentication of the user through the client computing device, confirming a result of the physical authentication of the user based on one or more unique physical characteristics of the user, receiving, from the client computing device concurrently with the physical authentication, the unique session identifier that was made available to the user, the unique session identifier being returned through an action by the user operating the client computing device, and confirming the identity of the client computing device associated with the user, based on the received unique session identifier, and the user's current physical presence at the client computing device, based on the result of the physical authentication. generating a prompt for a physical authentication of the user through the client computing device, confirming a result of the physical authentication of the user based on one or more unique physical characteristics of the user, receiving, from the client computing device concurrently with the physical authentication, the unique session identifier that was made available to the user, the unique session identifier being returned through an action by the user operating the client computing device, and confirming the identity of the client computing device associated with the user, based on the received unique session identifier, and the user's current physical presence at the client computing device, based on the result of the physical authentication.