Agreed. I said "TOTP app" where I should have said "2FA app".
I still think it's a second factor. Only a third party might have access to the factor too, like SMS codes/3DSecure.
I still think it's a second factor. Only a third party might have access to the factor too, like SMS codes/3DSecure.
Its true that push2factor have some disadvantages, but it has one really strong advantage above pure TOTP: phishing dosnt work as the 2factor is send directly to the site and cant be mitmed at your terminal. Read about it.