Is Facebook’s one-time password system safe?

Facebook announced a new feature yesterday, which claims to give you another way to keep your social networking account secure.

A one-time password is said by Facebook to:

“..make it safer to use public computers in places like hotels, cafes or airports. If you have any concerns about security of the computer you’re using while accessing Facebook, we can text you a one-time password to use instead of your regular password.”

Facebook explains that by sending an SMS text message of “otp” (one-time password, y’see?) to 32665 on your mobile phone, you’ll be sent a temporary password to your account that will expire after 20 minutes. Of course, you’ll need to have registered a mobile phone number with your account.

That means that even if malware manages to grab your password as you type it in, it will only be valid for a short period of…

Read more in my article on the Naked Security website.

Found this article interesting? Follow Graham Cluley on Twitter or Mastodon to read more of the exclusive content we post.

Graham Cluley •   @gcluley

Graham Cluley is a veteran of the cybersecurity industry having worked for a number of security companies since the early 1990s when he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows. Now an independent analyst, he regularly makes media appearances and is an international public speaker on the topic of cybersecurity, hackers, and online privacy. Follow him on Twitter, Mastodon, Bluesky, or drop him an email.