Pushtodennusta

Push-todennusta, or push-based authentication, is a method of user verification in which a login attempt triggers a notification to a registered device, such as a smartphone or hardware token. The user approves or denies the request on the device to complete the authentication. The system typically binds the login to the specific user account and the trusted device, using cryptographic assertions to authorize the session.

Etymology and usage: The term is a Finnish rendering of the English concept “push authentication.” It is used in IT security literature and by identity providers and banks as an alternative to password entry or code-based one-time passwords.

Mechanism: When a user starts a login, the server sends a push notification to the user’s registered device. The user authenticates locally on that device (often with a biometric, PIN, or secure unlock) to approve the request. The approval yields a cryptographic assertion or session token that the server verifies to grant access. Some implementations require an additional factor on the device, while others rely on device-bound credentials.

Security and considerations: Push-based authentication can reduce phishing risks by avoiding password entry and codes that can be intercepted. It improves convenience and can speed up sign-ins. Limitations include risk if the device is lost or stolen, potential notification fatigue from frequent prompts, and the need for reliable network connectivity. When combined with strong on-device verification or WebAuthn-style credentials, it can offer robust security.

See also: Two-factor authentication, SMS-based codes, TOTP, WebAuthn, phishing resistance.