"is there anything you can do with direct logins that you cannot with Facebook Connect and full permissions" Yes, and that is exactly the problem. Facebook's A

"is there anything you can do with direct logins that you cannot with Facebook Connect and full permissions" Yes, and that is exactly the problem. Facebook's APIs enforce very strict access controls on the data available to external or embedded applications. If you have my user name and password, you effectively have full permissions. Secure by design means no access by default. Sometimes, there are things not yet or not fully exposed to the APIs under the API's definition of full permissions. Other times, the granularity of access controls doesn't exactly match what your application needs. The user name and password lets you avoid playing by the rules and has the potential to greatly undermine user confidence in the security of their data.