This "Facebook approach" almost certainly requires you to have, at least once, access to your users' non-hashed passwords.
Which is widely regarded as bad security practice because your users' passwords can be compromised by an attacker getting read-only access.
[EDIT] Well, good thing I used "almost", since I was wrong: of course, case-inverting the password and hashing the result could also be done client-side, silly me!
[EDIT'] Answers pointing out that you always have access to non-hashed passwords, and I believe this is wrong. When the user submits their password, it SHOULD be hashed client-side and only the hash SHOULD be sent to you.
Which is widely regarded as bad security practice because your users' passwords can be compromised by an attacker getting read-only access.
[EDIT] Well, good thing I used "almost", since I was wrong: of course, case-inverting the password and hashing the result could also be done client-side, silly me!
[EDIT'] Answers pointing out that you always have access to non-hashed passwords, and I believe this is wrong. When the user submits their password, it SHOULD be hashed client-side and only the hash SHOULD be sent to you.