Facebook’s porous security model is one reason why I never “link” my Facebook account to other websites.
Facebook finally provided a way to keep any random jerk in the café from hijacking your account. But you have to go out of your way to enable this protection, and you might have to wait. Still: Jump on this.
Facebook has at long last offered an option to use the encrypted HTTPS protocol, a feature it will begin rolling out today but won’t finish for a “few weeks.” You should check now if it’s available, and sign up as soon as it is enabled for your account. The performance overhead is minor—zippy Gmail, for example, uses HTTPS for everything—and it’s an important step to keep your Facebook account safe from being hijacked on an open or poorly secured wireless network.
via The Facebook Setting You Should Change as Quickly as Possible.