A method comprising: generating a challenge at a server, wherein the challenge comprises a random challenge generated by a random number generator on the server; storing the challenge in a secure storage on the server; encrypting the challenge at the server using a public encryption key; transmitting the encrypted challenge to a connected device having a first connection over a network with the server; providing the encrypted challenge from the connected device to a user device; decrypting the encrypted challenge at the user device using a private encryption key corresponding to the public encryption key to determine the challenge; converting the challenge to a converted challenge, the converted challenge having a different format than the original challenge, wherein converting the challenge comprises truncating a portion of the challenge and using the truncated portion or a remaining portion following truncation for the converted challenge; receiving the converted challenge at the connected device and providing the converted challenge from the connected device to the server wherein receiving the converted challenge at the connected device comprises receiving manual user entry of the converted challenge via a user input device coupled to the connected device; and validating the converted challenge at the server to authenticate the user, wherein validating the converted challenge comprises reading the challenge from the secure storage and truncating the same portion of the challenge on the server and comparing the converted challenge truncated on the server with the converted challenge provided from the connected device. generating a challenge at a server, wherein the challenge comprises a random challenge generated by a random number generator on the server; storing the challenge in a secure storage on the server; encrypting the challenge at the server using a public encryption key; transmitting the encrypted challenge to a connected device having a first connection over a network with the server; providing the encrypted challenge from the connected device to a user device; decrypting the encrypted challenge at the user device using a private encryption key corresponding to the public encryption key to determine the challenge; converting the challenge to a converted challenge, the converted challenge having a different format than the original challenge, wherein converting the challenge comprises truncating a portion of the challenge and using the truncated portion or a remaining portion following truncation for the converted challenge; receiving the converted challenge at the connected device and providing the converted challenge from the connected device to the server wherein receiving the converted challenge at the connected device comprises receiving manual user entry of the converted challenge via a user input device coupled to the connected device; and validating the converted challenge at the server to authenticate the user, wherein validating the converted challenge comprises reading the challenge from the secure storage and truncating the same portion of the challenge on the server and comparing the converted challenge truncated on the server with the converted challenge provided from the connected device. <EOS>