I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were autocompleted by my browser. Then I decided to misspell my email and see what would happen if I tried to log in.
To my surprise I logged in with no problem after changing my email from
firstname.lastname@example.org. I then started experimenting with different spelling errors and I had no problem logging in as long as it was not too far off my real email. I tried changing the domain name as well
email@example.com, my email prefix
Then I also tried misspelling my password and as long as it was not too far off my real password I could log in no problem (with the password it worked when adding one random letter before or after the real password, but not when adding a letter in the middle of it).
I also checked the actual data sent in the request by looking at it in Chrome DevTools and in fact it was the wrong data sent.
How can this be? Should I be worried about my account's security?