I came in to say, perhaps push notifications are less secure than users typing in their TOTP. However, as someone else mentioned, this is a solved problem by p

I came in to say, perhaps push notifications are less secure than users typing in their TOTP. However, as someone else mentioned, this is a solved problem by prompting the user to select the correct number/symbol shown by Service Provider. It's a clever, implemented way of making the user understand intuitively "I should only respond to these messages if I am actively logging in to a system".