I was having the debate of TOTP vs Push Notifications and found this claim online:
Is the 2FA method protected against phishing?
Chart Explanation: The most common method of phishing is persuading a user to click on an email that leads them to a website that looks like a legitimate site they do business with. The rogue site will steal both the user’s username and password, AND their one-time password delivered by SMS or Voice. It can even steal TOTPs generated from a disconnected soft-token app or physical hard token.
Why Is This Important: This is the biggest and most prevalent vulnerability with 2FA-protected solutions today, and all one-time password solutions are vulnerable. Push authentication methods eliminate this type of attack.
In their example scenario, the attacker is getting the user's password (and TOTP) through a fake website and using it on the real site. In this same scenario (minus the TOTP), the attacker entering the password on the real site would trigger a push notification on the user's device.
If the user has been convinced that they are logging onto the real site, it stands to reason that they would approve the login attempt just as readily as they would enter a TOTP.
In this scenario, (how) does the Push Notification offer any additional protection compared to a TOTP?