Abstract: Provided is a process, including: retrieving an identifier of a mobile computing device associated with a user; causing a push notification to be sent to the mobile computing device, wherein the push notification comprises or causes the mobile computing device to retrieve an authentication-session specific value; forming an authentication-session record that associates the authentication-session specific value with the mobile computing device; receiving an identifier that identifies the mobile computing device, and a cryptographically signed value demonstrating possession of both the authentication-session specific value and a private cryptographic key; determining to authenticate the user by selecting, the authentication-session record from among a plurality of authentication-session records; and determining, based on both a public cryptographic key of a profile of the user and the authentication-session specific value, that the received cryptographically signed value correctly demonstrates possession of bot