Facebook Introduces OTP (One-time Password) Functionality

The New Acunetix V12 Engine


Nice to see an innovation on the security front for once rather than endless ‘feature’ updates and announcements of ‘the next big thing’. Facebook has had its fair share of security woes so it’s nice to see they are doing something which I think may be genuinely useful for it’s burgeoning user base.

A lot of banks use a similar system labeled as a TAC (Transaction Authorisation Code) or similar when you want to carry out a transaction which involves moving money out from your account (bill payment, fund transfers etc).

Facebook began rolling out new service on Tuesday that allows people using public computers to log into the site without having to enter their regular password.

Instead, users can login with a one-time password that, upon request, Facebook zaps to their mobile phones. The temporary access code is good for 20 minutes only. The new feature is designed to prevent account compromises that result when credentials are entered into machines that have been compromised by keyloggers and similar types of malware.

“We’re launching one-time passwords to make it safer to use public computers in places like hotels, cafes or airports,” Jake Brill, a Facebook product manager, blogged here. “If you have any concerns about security of the computer you’re using while accessing Facebook, we can text you a one-time password to use instead of your regular password.”

I think it’s a useful thing for Facebook users on the move who may not want to use their proper password on a public computer in an airport or cybercafe for example as they may be infected with malware.

Of course the pessimists and conspiracy theorists will say Facebook is just running a ruse to gather more mobile phone numbers from their user base to leverage more data and improve their ability to suggest connections.


To use the service, users must first configure their accounts to work with a designated mobile phone number. When they text “otp” to 32665, they should immediately receive a password that’s good for the next 20 minutes. The feature is available to select Facebook users for now. Over the next few weeks, it will gradually become available to everyone.

Brill unveiled two other features that are also intended to give users more control over their accounts. One allows users to remotely sign out of accounts. It’s useful in cases when someone forgets to log off of a computer and only later realizes he’s still logged in. In the past, the person had to access the computer to be logged off, but the new service allows this to happen remotely. Users can check to see if they’re still logged in from their Facebook account settings page.

A third service will regularly prompt users to update their security information, Brill said. Facebook uses the information to verify users in the event a password is lost or compromised.

I’m not sure what country this service is rolling out in, but I’d guess it’s probably US-centric and will stay that way for some time. They should use an international number as it’s most likely you’d want to login from a publication location when traveling.

No doubt they’ll address some issues as for now the service is a testing phase and only available to certain users.

The other new security related features are remote log-out, which Gmail from Google has had forever – if you didn’t know about the feature just scroll to the very bottom of the Gmail window and you’ll see something like this:

Source: The Register

Posted in: Countermeasures, Cryptography, Privacy, Web Hacking

, , , , ,


Latest Posts:


DeepSound - Audio Steganography Tool DeepSound – Audio Steganography Tool
DeepSound is an audio steganography tool and audio converter that hides secret data into audio files, the application also enables you to extract from files.
2019 High Severity Vulnerabilities What are the MOST Critical Web Vulnerabilities in 2019?
So what is wild on the web this year? Need to know about the most critical web vulnerabilities in 2019 to protect your organization?
GoBuster - Directory/File & DNS Busting Tool in Go GoBuster – Directory/File & DNS Busting Tool in Go
GoBuster is a tool used to brute-force URIs (directories and files) in web sites and DNS subdomains (inc. wildcards) - a directory/file & DNS busting tool.
BDFProxy - Patch Binaries via MITM - BackdoorFactory + mitmProxy BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads
Domained - Multi Tool Subdomain Enumeration Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains.
Acunetix Vulnerability Scanner For Linux Now Available Acunetix Vulnerability Scanner For Linux Now Available
Acunetix Vulnerability Scanner For Linux is now available, now you get all of the functionality of Acunetix, with all of the dependability of Linux.


One Response to Facebook Introduces OTP (One-time Password) Functionality

  1. Bogwitch October 14, 2010 at 12:21 pm #

    Please forgive my cynicism. Isn’t this just another way for Facebook to ensure they have your mobile telephone number?

    Facebook points to 127.0.0.1 in my HOSTS file….