I was reading up on the latest security meta for 2fa and learned that sms is not a secure way to conduct device verification due to phishing concerns. It seemed most articles/blogs stressed the importance of push notification authentication. Essentially, you get a push notification sent to your phone on every log in attempt, which allows you to confirm or deny the attempt. However, this is all contingent on already having third party apps installed, like Authy, which have api's that send and receive the notifications.
However, requiring users to already have a separate app installed would pretty much murder sign up conversion rates, specially in the beginning. Yet it seems that if I were to build out a push system endemic to my app, it would have the same functionality, while cutting out the third party, since all they really are offering is an existing api (which seems easily replicable). Is this correct? Or would I be missing some security features that only existing third party apps have?
(Let's assume that we're only worried about phishing/MITM/social engineering attacks which aim at stealing log in credentials/one time passwords and not actual stolen phones, in which case my proposal would have obvious problems, since the push system is tied to the app on that physical device)