I've just realised that facebook accepts 3 forms of a password:
Facebook actually accepts three forms of your password:
Your original password.
Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word.
Your original password with the case reversed, for those with a caps lock key on.
Obviously they are claiming that the security compromised is insignificant. My question is is the security compromised really insignificant ?
How much easily is a hacker able to achieve a login with 2 additional "holes" ?