Xjyuk

I've been playing around different login forms online lately to see how they work. One of them was facebook login form. When I logged out of my account my email and password were autocompleted by my browser, then I decided to misspell my email and see what would happen if try to login.

To my surprise I logged in with no problem after changing my email from example@gmail.com to example@gmail.comm, I then started experimenting with different misspelling errors and I had no problem logging in as long as it was not too far off my real email. I tried with changing domain name as well example@gmadil.coom, my email prefix ezfxample@gmail.com etc.

Then I also tried misspelling my password and as long as it was not too far off my real password I can log in no problem (with password it worked when adding one random letter before or after the real password, not when adding letter in the middle of it).

I also checked actual data send in request by looking at it in chrome dev tools and in fact it was the wrong data sent.

How can this be? Should I be worried about my accounts security?

Facebook is allowing you to make a handful of mistakes to ease the login process. A Facebook engineer explained the process at a conference. The gist of it is that Facebook will try various permutations of the input you submitted and see if they match the hash they have in their databae

For example, if your password is "myRealPassword!" but you submit "MYrEALpASSWORD!" (capslock on, shift inverting capslock). The submitted password obviously doesn't match what they have stored. Rather than reject you flat out, Facebook tries to up the user experience by trying to "correct" a few common mistakes such as inserting a random character before or after, capitalizing (or not) the first character, or mistakenly using capslock. Facebook applies these filters one by one and checks the newly "corrected" password against what they have hashed in their database. If one of the permutations matches, Facebook assumes you simply made a small mistake and authorizes your session.

While worrying at first glance, this is actually still perfectly secure for a few reasons. First and foremost, Facebook is able to do this without storing the password in plaintext because they are transforming your provided (and untrusted) input from the form field and checking if it matches. Secondly, this isn't very helpful for someone trying to bruteforce the password because online attacks are nigh impossible thanks to ratelimiting and captchas. Finally, the odds of an attacker/evil spouse knowing the text of your password and not the capitalization are abysmally small and so the risk created as a result of this feature is equally small.

Should you be worried? No, probably not.

Further reading: https://www.howtogeek.com/402761/facebook-fudges-your-password-for-your-convenience/

It is long know that Facebook allows you on purpose to log in with the password case reversed or the first character capitalized (see this article). They do this by storing the different hashes of the password. Are you seeing that more differences are allowed?

Apparently, they also have some similar usability features for the email address.
Automatically "correcting" gmail.comm to gmail.com is actually harmless, since there's (currently) no comm tld, so nobody would actually have a valid gmail.comm email address. I am however surprised that they would allow gmadil.com (currently for sale) or a different username, as that could be someone else's email address.

They might have decided that usability is of utter importance and, if there is a log in attempt for an email address for which there is not an account, automatically attempt the log in with the most similar username, but -while not completely bad- it doesn't seem a good approach, as someone else could sign up tomorrow with the ezfxample@gmail.com email and, although unlikely, also use Password123 as password, then what?

Update: This had been tested a few years back by Lukas on Does correcting misspelled usernames create a security risk? and apparently logging in with a misspelled email address only works when you have not deleted Facebook cookies from your earlier session. Thus, it only autocorrects your email address when it knows that you used to log in as example@gmail.com, and otherwise fails.

Note: AndyGrayland had suggested earlier that the cookies could be playing a part of this, but it is now in a deleted answer.