A big part is bespoke authentication on top of OAuth, rather than correctly implementing an actual standard to do such (OpenID Connect). OAuth is not an authent

A big part is bespoke authentication on top of OAuth, rather than correctly implementing an actual standard to do such (OpenID Connect). OAuth is not an authentication protocol, it only gives guidance for delegated authorization. OpenID Connect gives a mandated list of steps for verification. Facebook Connect really only is supported via usage by an official SDK. If you are using an implementation that reverse engineered support for Facebook Connect rather than using the official SDK, you are on your own.