An authentication device , comprising: a processor ; communications circuitry ; a first memory having an operating system, OS, agent module stored thereon, said OS agent module comprising computer readable OS agent instructions that are executable by said processor from within a OS runtime environment of said authentication device ; and a second memory having a pre boot authentication module, PBAM , stored thereon, said PBAM comprising computer readable instructions that are executable by said processor from within a pre boot environment of said authentication device ; wherein said OS agent instructions are configured to cause said authentication device to reboot and transfer control to said PBAM within said pre boot environment; and said PBAM is configured to perform the following operations within said pre-boot environment: producing a platform authentication credential, PAC, from within said pre boot environment of said authentication device ; and transmitting a copy of said PAC to an account management device that manages access to a user account, characterized in that said PAC is generated from identifying indicia specific to the authentication device and from user input, said user input comprising at least one of a keystroke pattern, one or more words, biometric information, or account information; and transmitting a copy of said PAC to said account management device comprises transmitting a second copy of said PAC in a PAC second copy signal, said PAC second copy signal being configured to cause said account management device to verify said second copy of said PAC against a first copy of said PAC bound to the user account, and transmit account restoration information for said user account if verification of said second copy against said first copy succeeds. a processor ; communications circuitry ; a first memory having an operating system, OS, agent module stored thereon, said OS agent module comprising computer readable OS agent instructions that are executable by said processor from within a OS runtime environment of said authentication device ; and a second memory having a pre boot authentication module, PBAM , stored thereon, said PBAM comprising computer readable instructions that are executable by said processor from within a pre boot environment of said authentication device ; wherein said OS agent instructions are configured to cause said authentication device to reboot and transfer control to said PBAM within said pre boot environment; and said PBAM is configured to perform the following operations within said pre-boot environment: producing a platform authentication credential, PAC, from within said pre boot environment of said authentication device ; and transmitting a copy of said PAC to an account management device that manages access to a user account, characterized in that producing a platform authentication credential, PAC, from within said pre boot environment of said authentication device ; and transmitting a copy of said PAC to an account management device that manages access to a user account, characterized in that said PAC is generated from identifying indicia specific to the authentication device and from user input, said user input comprising at least one of a keystroke pattern, one or more words, biometric information, or account information; and transmitting a copy of said PAC to said account management device comprises transmitting a second copy of said PAC in a PAC second copy signal, said PAC second copy signal being configured to cause said account management device to verify said second copy of said PAC against a first copy of said PAC bound to the user account, and transmit account restoration information for said user account if verification of said second copy against said first copy succeeds. <EOS>