Hot answers tagged facebook
This is simply Facebook trying to provide a better user experience for those users who may have Caps Lock enabled, or who's devices automatically capitalize the first letter of the password. I don't think there any any cookies per your question. It is likely that the password hashing and storage is as standard as you would expect. The alternate passwords ...
To specifically address the scenario, Facebook doesn't need to wait until a user logs in to capture an OAuth token. Since you're trusting Facebook as your authentication provider, they can generate a valid OAuth token for any user in their system anytime they please. Given that, there are three potentially correct answers here. This is not a threat, ...
I suspect it really means «They have stolen your cookies and can impersonate you. Change your password in order to invalidate the session» Another explanation would be that they could show a fake login prompt (eg. simulating that you got logged out, or entered a wrong password) and obtain your password from there.
Only top voted, non community-wiki answers of a minimum length are eligible