I was having the debate of TOTP vs Push Notifications and found this claim online:

Is the 2FA method protected against phishing?

enter image description here

Chart Explanation: The most common method of phishing is persuading a user to click on an email that leads them to a website that looks like a legitimate site they do business with. The rogue site will steal both the user’s username and password, AND their one-time password delivered by SMS or Voice. It can even steal TOTPs generated from a disconnected soft-token app or physical hard token.

Why Is This Important: This is the biggest and most prevalent vulnerability with 2FA-protected solutions today, and all one-time password solutions are vulnerable. Push authentication methods eliminate this type of attack.


In their example scenario, the attacker is getting the user's password (and TOTP) through a fake website and using it on the real site. In this same scenario (minus the TOTP), the attacker entering the password on the real site would trigger a push notification on the user's device.

If the user has been convinced that they are logging onto the real site, it stands to reason that they would approve the login attempt just as readily as they would enter a TOTP.

In this scenario, (how) does the Push Notification offer any additional protection compared to a TOTP?


1 Answer 1


Push 2FA is the new OIDC CIBA specification to authorize the sign-in attempt from the registered device called Authenticating Device. The authenticating device is registered by signing your account into the OIDC Provider's app and selecting the device from your account settings that will receive the approval. E.g. Along side TOTP, Microsoft Authenticator supports OIDC CIBA for Microsoft web services.

All sign-in approvals are sent to the app and the app can show various details about the sign-in attempt like location, IP Address, browser agent and the type of device. The client app is not covered by OIDC CIBA so what information can it show is the agreement between the OIDC Provider and the client app. The app also authenticates the account owner with biometrics or by asking to unlock the screen first before the approval can be done.

With the quick sign-in approval, account owner verification and sign-in details can protect the user against potential phishing attempt. OIDC CIBA requires the authenticating device to be online so the OIDC Provider can also detect the phishing attempt by comparing the location of the device with the location of the sign-in attempt. Now you can also see one disadvantage of using this. TOTP works even if the device is offline. They both have their own convenience in the right use case. But online approval does make push notification a little more secure and quicker to login.

Push 2FA may or may not protect the user against MITM. It depends on the implementation of the client app. If the approval request and response are cryptographically secured by a secret that was obtained during the device registration process, the attacker won't be able to tamper with them even if the communication between OIDC Provider and the client app is compromised. The implementation of the client app is not covered by OIDC CIBA.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .