Consider mobile authentication applications, such as Microsoft Authenticator, Google Authenticator, and LastPass Authenticator. They all offer 6-digit MFA authentication, but this is not my focus; my focus is on notification verification, which (I believe) all three support.

The flow:

  1. User requests to log in to a service on device A (usually desktop/laptop).
  2. User receives a notification to verify the request on device B (usually mobile).
  3. This notification opens an authenticator application, wherein the user is given two options, "Approve" or "Deny".

(1) Are there best practices to implement such functionality? I have not been able to find any scholarly articles, but perhaps I am searching the wrong keywords.

I imagine two approaches:

Approach #1:

When the user completes step 1, some state is updated in the backend. All the while, the authenticator application is periodically checking for this state. If on mobile, this check executes in a background task. E.g., the state could be a database entry, and since the authenticator application is already tied to the user's account, it knows where to look for this entry.

Approach #2:

A stateless implementation using web sockets. The backend acts as a web socket server and device B as a client. When device A requests to log in, the server posts a message. All the while, device B has a background task that waits for the message.

I would appreciate some feedback on my ideas, and of course, would love to hear some other implementations, perhaps better!

(2) Are there security concerns with MFA challenges, at least compared to 6-digit authentication?

  • Do you mean the Push MFA?
    – schroeder
    Jan 11 at 18:21
  • @schroeder I believe I meant Push MFA in my original question, based on the word, "push". And TOTP is different in the sense that there is a code the user must enter.
    – Oliver
    Jan 11 at 19:01
  • Are you saying that challenge-response authentication can incorporate TOTP, in that the TOTP key is used to decrypt the server's challenge and encrypt the client's response?
    – Oliver
    Jan 11 at 19:14
  • No, Push MFA is different. But it sounds like with the term "Push MFA" you should be able to find the design docs you're looking for.
    – schroeder
    Jan 11 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.