Hacker News Reader

it is by design, facebook stores three versions of your password, and allows you to login with samecase, oppositecase (i.e. you forgot caps lock) and first-letter-upcase (cause some mobile stuff does that automatically).

There was an article somewhere but I can't find it at the moment.

View on HN

Wow.. this is interesting. But wouldn't this open doors for hackers?

Well, while it makes a brute-force attack somewhat easier, it is still certainly not easy. While I haven't tried it, I suppose Facebook has some strong brute-force prevention methods (rate limiting, for instance, captchas etc).

Most Facebook account's get compromised through social engineering / keyloggers. And that risk is not increased by facebooks login implementation.

Reply on news.ycombinator.com