Consider mobile authentication applications, such as Microsoft Authenticator, Google Authenticator, and LastPass Authenticator. They all offer 6-digit MFA authentication, but this is not my focus; my focus is on notification verification, which (I believe) all three support.
- User requests to log in to a service on device A (usually desktop/laptop).
- User receives a notification to verify the request on device B (usually mobile).
- This notification opens an authenticator application, wherein the user is given two options, "Approve" or "Deny".
(1) Are there best practices to implement such functionality? I have not been able to find any scholarly articles, but perhaps I am searching the wrong keywords.
I imagine two approaches:
When the user completes step 1, some state is updated in the backend. All the while, the authenticator application is periodically checking for this state. If on mobile, this check executes in a background task. E.g., the state could be a database entry, and since the authenticator application is already tied to the user's account, it knows where to look for this entry.
A stateless implementation using web sockets. The backend acts as a web socket server and device B as a client. When device A requests to log in, the server posts a message. All the while, device B has a background task that waits for the message.
I would appreciate some feedback on my ideas, and of course, would love to hear some other implementations, perhaps better!
(2) Are there security concerns with MFA challenges, at least compared to 6-digit authentication?