Hacker News Reader

What is push code?

I meant a push notification to accept/decline login (so without code in fact).

I've seen Google Authenticator do this (for Google accounts), or the Blizzard Authenticator. I would guess that Duo has a product for this.

Then it's separate feature from TOTP. It's not a real 2fa because it works like service>duo>user where duo can accept anything for you.

Agreed. I said "TOTP app" where I should have said "2FA app".

I still think it's a second factor. Only a third party might have access to the factor too, like SMS codes/3DSecure.

Yeah it's a mess when you recommend duo/authy not clear TOTP or internal system. It's a second factor but not the one that's worth implementing: basic link to email has same security and costs $0

Its not that simple.

Its true that push2factor have some disadvantages, but it has one really strong advantage above pure TOTP: phishing dosnt work as the 2factor is send directly to the site and cant be mitmed at your terminal. Read about it.

What stops phishing? The attacker triggers push request, victim accepts - everything is the same?

Reply on news.ycombinator.com