[jerbear4328]

Facebook does do this, and it's perfectly fine: https://security.stackexchange.com/a/214815

It exchanges a few bits of entropy for a much smoother user experience, and it doesn't actually aid an attacker much (they could just try the permutations themselves)

[anymouse123456]

Thanks for the link. That's helpful info.