How To Hack Facebook In 51 Seconds

You're right, it might be possible to get an insecure application to give you API-accessible information about some other user (e.g., the application contains a page that spits out your entire profile on the screen, and you pass in your target's userid). That information is guarded by a user-specific session key, so the app would have to store each user's session key on the server (or have already cached the response) for it to work. A really insecure application could probably be coerced into making other API calls as well, like sending notifications or uploading photos.

I guess in that case Facebook might want to look in to providing some vulnerability testing tools to developers, or maybe running tests for them to find vulnerabilities. It's definitely a hard problem.

The client libs handle everything for you if you use fbml, since every request is proxied by facebook and has its own signature. If you use an iframe, like the Moods app and many other popular apps, requests go directly to your server, so you have to explicity include and validate a signature for each request.

It's still not terribly difficult, but most facebook app devs are trying to churn out apps and features so fast that there's no time for this kind of detail.