Which of the following methods involves requesting a user's approval via a push notification to verify the user's identity?

An authenticator application is a form of multi-factor authentication (MFA) that can use push notifications sent to a registered device, such as a smartphone. When a login attempt occurs, the user receives a notification on their device and must approve or deny the request to complete the authentication process. This method is considered more secure than SMS-based codes as it is less susceptible to SIM-swapping attacks and provides real-time, context-aware approval.

A. Call: This method involves an automated phone call where a user might press a key to approve, which is different from a push notification on an app.

C. Hardware token: This is a physical device that generates a one-time password (OTP) and does not use push notifications for verification.

D. SMS: This method sends a one-time password via a text message to the user's phone, which the user must then manually enter.

1. National Institute of Standards and Technology (NIST). (2017). Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management. Section 5.1.3.2, "Out-of-Band Devices," describes the use of push notifications to a "specific, separate device" for authentication. (https://doi.org/10.6028/NIST.SP.800-63b)

2. Microsoft Corporation. (2023). How to use Microsoft Authenticator. Microsoft Learn Documentation. The document explicitly states, "The app can be used... to respond to a push notification for multifactor authentication."

3. Carnegie Mellon University, Information Security Office. (n.d.). Using the Duo Mobile App. This university resource details the "Duo Push" feature, stating, "A push notification is sent to your device. Tap Approve to authenticate."