Is it possible to use variables in the push notification text sent to the privacyidea app? We’d like to display the remote IP trying to access the account.
Ah, this is interesting.
So you want to do something like: “Do you want to login from your client a.b.c.d?”.
Cool. No, to my knowledge this is not possible. You would have to issue a feature request — or rather issue a pull request! 
Yes, this would ensure people can detect MITM / OTP forwarding attacks.
Well, you could still create different policy with different PUSH texts and make the policy dependent on the IP addresses.
This could be useful for known IP ranges, for instance internal/external messages however this wouldn’t work for forwarding attacks for internet facing services.
We’d like to be able to show the remote user ip (possibly expandable to hostname/geo location services for the cleverer coding people).
Just for reference: