I concede that Facebook fan pages are a whole other animal altogether. In that case (in terms of having an account to manage a fan page as a professional face,

I concede that Facebook fan pages are a whole other animal altogether. In that case (in terms of having an account to manage a fan page as a professional face, so to speak), then performing user authentication based on knowledge of "friends" (account connections) makes no sense whatsoever. All joking and discourse regarding "friends" aside, I think it's fair to have multi-factor authentication when it appears that an account has been breached. But yes, they could have implemented this differently. (See Gmail's "last account activity" alerts, which notify you regarding a breach once you log in from a recognized IP address but do not prevent access to your account: https://mail.google.com/support/bin/answer.py?ctx=gmail&answer=45938 https://mail.google.com/support/bin/answer.py?ctx=gmail&... ) I suppose I'm one of those odd, longtime users that wishes Facebook wouldn't try to be everything, hence the jabs at "I have too many friends" issue.