A system comprising a first device and a second device , the second device comprising: a user interface operable to present information to a user and to receive input therefrom; and user-authentication-based approval logic operable to receive a session identifier (ID) from the first device over an insecure channel, wherein the first device received the session ID from an identity provider , and to perform the following in response to at least receiving the session ID from the first device : send the session ID to the identity provider ; receive from the identity provider first user-observable information, or an identifier thereof, and a security challenge, the first user-observable information bearing a user-discernable relationship to second user-observable information received by the first device from the identity provider and presented to a user by the first device ; present the first user-observable information to the user via the user interface ; and generate a response to the security challenge and transmit the response to the security challenge to the identity provider based at least on input received from the user via the user interface , the response to the security challenge being indicative of the suitability of the first device for user-authentication-based approval by the identity provider . a user interface operable to present information to a user and to receive input therefrom; and user-authentication-based approval logic operable to receive a session identifier (ID) from the first device over an insecure channel, wherein the first device received the session ID from an identity provider , and to perform the following in response to at least receiving the session ID from the first device : send the session ID to the identity provider ; receive from the identity provider first user-observable information, or an identifier thereof, and a security challenge, the first user-observable information bearing a user-discernable relationship to second user-observable information received by the first device from the identity provider and presented to a user by the first device ; present the first user-observable information to the user via the user interface ; and generate a response to the security challenge and transmit the response to the security challenge to the identity provider based at least on input received from the user via the user interface , the response to the security challenge being indicative of the suitability of the first device for user-authentication-based approval by the identity provider . send the session ID to the identity provider ; receive from the identity provider first user-observable information, or an identifier thereof, and a security challenge, the first user-observable information bearing a user-discernable relationship to second user-observable information received by the first device from the identity provider and presented to a user by the first device ; present the first user-observable information to the user via the user interface ; and generate a response to the security challenge and transmit the response to the security challenge to the identity provider based at least on input received from the user via the user interface , the response to the security challenge being indicative of the suitability of the first device for user-authentication-based approval by the identity provider . <EOS>