Is it normal for domains other than facebook.com to ask for a facebook password? If so that seems very risky. I would have assumed Facbook Inc to require third

Is it normal for domains other than facebook.com to ask for a facebook password? If so that seems very risky. I would have assumed Facbook Inc to require third-party sites use a federated auth API, such as OAuth.