A system comprising: one or more hardware platforms implementing a hosted authentication service to provide authentication services for relying parties , the hosted authentication service and the relying parties being separate parties, the hosted authentication service registering a relying party by sharing a key with the relying party , the hosted authentication service comprising an administration portal through which a relying party administrator configures the hosted authentication service to provide authentication services on behalf of the relying party ; a first program code component provided by the hosted authentication service is inserted into an application hosted by the relying party , the first program code component causing a client device accessing the application to be redirected to the hosted authentication service for user-authentication and other authentication-related functions including registering one or more new authenticators and deregistering one or more authenticators of a user's client device; and the hosted authentication service , based on a plurality of different authentication-related events occurring between the client device and the hosted authentication service , transmitting a plurality of assertions directly to the relying party thereby bypassing the client device , each assertion of the plurality of assertions specifying one different authentication-related event occurring between the client device and the hosted authentication service , each assertion of the plurality of assertions including at least one indication, wherein a first assertion indicates that the user has registered a new authenticator with an associated security strength/level, a second assertion indicates that the user has deregistered an authenticator , and a third assertion indicates that the user has authenticated with the authentication service using an authenticator , wherein the relying party validates each one of the plurality of assertions using the key . one or more hardware platforms implementing a hosted authentication service to provide authentication services for relying parties , the hosted authentication service and the relying parties being separate parties, the hosted authentication service registering a relying party by sharing a key with the relying party , the hosted authentication service comprising an administration portal through which a relying party administrator configures the hosted authentication service to provide authentication services on behalf of the relying party ; a first program code component provided by the hosted authentication service is inserted into an application hosted by the relying party , the first program code component causing a client device accessing the application to be redirected to the hosted authentication service for user-authentication and other authentication-related functions including registering one or more new authenticators and deregistering one or more authenticators of a user's client device; and the hosted authentication service , based on a plurality of different authentication-related events occurring between the client device and the hosted authentication service , transmitting a plurality of assertions directly to the relying party thereby bypassing the client device , each assertion of the plurality of assertions specifying one different authentication-related event occurring between the client device and the hosted authentication service , each assertion of the plurality of assertions including at least one indication, wherein a first assertion indicates that the user has registered a new authenticator with an associated security strength/level, a second assertion indicates that the user has deregistered an authenticator , and a third assertion indicates that the user has authenticated with the authentication service using an authenticator , wherein the relying party validates each one of the plurality of assertions using the key . <EOS>