> And then fb should tell you about unusual accesses to your account unless the phone vendor is also your Telco and extremely careful. With the API, presumably

> And then fb should tell you about unusual accesses to your account unless the phone vendor is also your Telco and extremely careful. With the API, presumably there's an auth token that is only stored on your device. Facebook should also be able to detect unusual access with an auth token. Really, the auth token makes it easier to detect funny business than a username/password.