I can see a couple of potential issues with a solution like this:
- If a users (old) password is compromised, then an attempt to log in with it can be used to confirm that the user exists, and has an account - probably not a big deal in the context of FB, where most accounts are searchable anyway, but I still think the principle holds in general.
- If someone suspects that they have your password, this can be used to at least confirm that the user has a specific password previously. For the average users, chances are good that that same password will be used for any number of other services too then.
Those two hold even if a user has a good password (ie. a long string of hard-to-guess characters). Since the average FB user is likely to use the name of his or her cat/dog/child/hamster/boyfriend/girlfriend/whatever instead, then being able to confirm the previous use of a certain password can provide insight that may help someone guess a new password too.
As a concrete example, I know of someone who for a long time used the following scheme based on the names of their children (names changed, obviously):
- First child: Mark
- Second child: Emma
- Third child: Carl
Based on those, the user would switch between passwords like this:
- ...and so on.
Sure, guessing a next password based on some quasi-random scheme like this may still require a significant amount of work, but a lot of it can be automated, and it will in any case be far easier than for a random string.
If you can establish a pattern by confirming the existence of one or two previous passwords like this however, then you have a pretty strong incentive to keep trying...