I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were autocompleted by my browser. Then I decided to misspell my email and see what would happen if I tried to log in.
To my surprise I logged in with no problem after changing my email from
[email protected] to
[email protected]. I then started experimenting with different spelling errors and I had no problem logging in as long as it was not too far off my real email. I tried changing the domain name as well
[email protected], my email prefix
[email protected] etc.
Then I also tried misspelling my password and as long as it was not too far off my real password I could log in no problem (with the password it worked when adding one random letter before or after the real password, but not when adding a letter in the middle of it).
I also checked the actual data sent in the request by looking at it in Chrome DevTools and in fact it was the wrong data sent.
How can this be? Should I be worried about my account's security?