Is selling such information even illegal? Is it against Facebook's terms?

By using an app you are giving them access to a whole bunch of your personal information. I always assumed that many were scraping data from my profile. This is why I have never use Facebook for authentication.

When I read the original post I figured Facebook would want the data so they could narrow down who the probable culprit is. I would have thought finding a common app among a million users probably wouldn't be too difficult.

That said the nature of this conversation is ridiculous.