Thwarting one-time password theft

1. A computer-implemented method for thwarting one-time password (OTP) theft, at least a portion of the method being performed by a mobile device comprising at least one processor, the method comprising:

receiving, at a messaging application executing on the mobile device, a text message from a website that includes an original OTP;

encrypting, by the messaging application, the original OTP included in the text message to thwart theft of the original OTP from the text message;

storing, by the messaging application, the text message including the encrypted OTP;

detecting, at an OTP plugin application, entry of the encrypted OTP into the website loaded into a browser application;

decrypting, by the OTP plugin application, the encrypted OTP to reveal the original OTP; and

replacing, by the OTP plugin application, the encrypted OTP with the original OTP prior to submission of the original OTP to the website.

2. The method of claim 1 , wherein the messaging application is a custom messaging application configured to handle all incoming text messages received at the mobile device.

3. The method of claim 1 , wherein the encrypting of the original OTP comprises encrypting the original OTP with a format preserving encryption algorithm.

4. The method of claim 3 , wherein the format preserving encryption algorithm is configured to cause the encrypted OTP to have the same number of characters as the original OTP.

5. The method of claim 1 , wherein the encrypting of the original OTP comprises:

generating, by the messaging application, an asymmetric key pair including a private key and a public key;

storing, at the mobile device, the private key;

sending, from the messaging application to the OTP plugin application, the public key;

generating, by the OTP plugin application, an original session key;

encrypting, by the OTP plugin application, the original session key using the public key;

sending, from the OTP plugin application to the messaging application, the encrypted session key;

decrypting, by the messaging application, the encrypted session key using the stored private key to reveal the original session key; and

encrypting, by the messaging application, the original OTP using the original session key.

6. The method of claim 5 , wherein the public key and the encrypted session key are sent via a first server that is different from a second server that hosts the website.

7. The method of claim 1 , wherein the replacing of the encrypted OTP with the original OTP comprises automatically filling in a form field of the website, into which the encrypted OTP was entered, with the original OTP.

8. A computer-implemented method for thwarting one-time password (OTP) theft, at least a portion of the method being performed by a mobile device comprising at least one processor, the method comprising:

receiving, at a messaging application executing on the mobile device, a text message from a website that includes an original OTP;

upon receipt of the text message at the messaging application, automatically encrypting, by the messaging application, the original OTP included in the text message, with a format preserving encryption algorithm, to thwart theft of the original OTP from the text message;

storing, by the messaging application, the text message including the encrypted OTP; and

displaying, by the messaging application, the text message with the encrypted OTP being visible.

9. The method of claim 8 , wherein the messaging application is a custom messaging application configured to handle all incoming text messages received at the mobile device.

10. The method of claim 8 , wherein the format preserving encryption algorithm is configured to cause the encrypted OTP to have the same number of characters as the original OTP.

11. The method of claim 8 , wherein the encrypting of the original OTP comprises:

generating, by the messaging application, an asymmetric key pair including a private key and a public key;

storing, at the mobile device, the private key;

sharing, by the messaging application, the public key;

receiving, at the messaging application, an encrypted session key that was encrypted using the public key;

decrypting, by the messaging application, the encrypted session key using the stored private key to reveal an original session key; and

encrypting, by the messaging application, the original OTP using the original session key.

12. The method of claim 11 , wherein the public key and the encrypted session key are sent via a first server that is different from a second server that hosts the website.

13. The method of claim 8 , wherein the text message is a Short Message Service (SMS) text message.

14. A computer-implemented method for thwarting one-time password (OTP) theft, at least a portion of the method being performed by a network device comprising at least one processor, the method comprising:

detecting, at an OTP plugin application executing on the network device, entry of an encrypted OTP into a website loaded into a browser application executing on the network device;

decrypting, by the OTP plugin application, the encrypted OTP to reveal an original OTP; and

replacing, by the OTP plugin application, the encrypted OTP with the original OTP prior to submission of the original OTP to the website.

15. The method of claim 14 , wherein the encrypted OTP was encrypted with a format preserving encryption algorithm.

16. The method of claim 15 , wherein the format preserving encryption algorithm is configured to cause the encrypted OTP to have the same number of characters as the original OTP.

17. The method of claim 14 , wherein the encrypted OTP was encrypted using a session key that was generated by the OTP plugin application.

18. The method of claim 14 , wherein the replacing of the encrypted OTP with the original OTP comprises automatically filling in a form field of the website, into which the encrypted OTP was entered, with the original OTP.

19. The method of claim 14 , wherein the network device is a mobile device at which a text message from the website that includes the original OTP is received.