A method comprising: obtaining, at data processing hardware of a user device executing a service application and an authenticator application , an operation request requesting the service application to access a remote entity to perform an operation , the operation request comprising: a remote entity identifier identifying the remote entity ; and operation information associated with the operation ; issuing, by the service application executing on the data processing hardware , an authentication request requesting the authenticator application to obtain user authentication credentials of a user of the user device associated with the remote entity for authenticating the user before the remote entity performs the operation ; encrypting, by the authenticator application executing on the data processing hardware , the obtained user authentication credentials using a public key of the remote entity so that the service application is restricted from obtaining the user authentication credentials in unencrypted form; providing, by the authenticator application executing on the data processing hardware , the encrypted user authentication credentials to the service application ; and transmitting, by the service application executing on the data processing hardware , to the remote entity , the operation request and the encrypted user authentication credentials , the operation request and the encrypted user authentication credentials when received by the remote entity causing the remote entity to: decrypt the encrypted user authentication credentials using a private key of the remote entity ; and validate the decrypted user authentication credentials . obtaining, at data processing hardware of a user device executing a service application and an authenticator application , an operation request requesting the service application to access a remote entity to perform an operation , the operation request comprising: a remote entity identifier identifying the remote entity ; and operation information associated with the operation ; a remote entity identifier identifying the remote entity ; and operation information associated with the operation ; issuing, by the service application executing on the data processing hardware , an authentication request requesting the authenticator application to obtain user authentication credentials of a user of the user device associated with the remote entity for authenticating the user before the remote entity performs the operation ; encrypting, by the authenticator application executing on the data processing hardware , the obtained user authentication credentials using a public key of the remote entity so that the service application is restricted from obtaining the user authentication credentials in unencrypted form; providing, by the authenticator application executing on the data processing hardware , the encrypted user authentication credentials to the service application ; and transmitting, by the service application executing on the data processing hardware , to the remote entity , the operation request and the encrypted user authentication credentials , the operation request and the encrypted user authentication credentials when received by the remote entity causing the remote entity to: decrypt the encrypted user authentication credentials using a private key of the remote entity ; and validate the decrypted user authentication credentials . decrypt the encrypted user authentication credentials using a private key of the remote entity ; and validate the decrypted user authentication credentials . <EOS>