Push notification verification: what it is
Push notification verification sends an alert to your phone: you tap "Yes, it's me" and you're in, without typing any code. Convenient, and completely tied to having that phone on you, with battery and signal.
- What it is
- Tapping "Yes, it's me" on your phone
- Since
- 2016 (Google Prompt)
- Verdict
- Yes, but…
What it is
Instead of asking you for a six-digit code, the service sends a notification to your phone when someone tries to log in with your password. You just look at it and tap "Yes" or "No." Google calls it Google Prompt; Microsoft, Duo and many banks have their own version with the same mechanism.
It's faster than typing a code, but it depends on having your phone on hand, charged, and connected to the internet at that moment.
Since when
Google introduced this system, under the name Google Prompt, in June 2016, as an alternative to SMS within its two-step verification. Since then, most major services have added their own version of "approve from your phone" instead of typing a code.
Why it's used
It's used because it's more convenient: one tap instead of copying six digits, and it also shows details like the city or device the login attempt is coming from.
The flip side has its own name: "notification fatigue," or MFA fatigue. If someone already has your password, they can send you one notification after another until, by mistake or exhaustion, you tap "Yes" without meaning to. It's a documented technique in several well-known security breaches in recent years.
Do we use it?
Yes, but never as your only method, and never approve a notification you didn't request. If one arrives without you logging in, it's always a "No."
Check this
- Would you know how to say no to a login notification you weren't expecting?
- Do you have another method besides push notifications, in case this phone has no battery or signal?
- Do you check the city and device shown on the notification before approving?
Sources: New settings for 2-step verification (Google, Jun. 2016)