The fact that legitimate sites ask for this information is really bad for consumers. It makes them think it's business as usual to just give away their passwords to anybody that happens to have a website and a button that says "Import my contacts" or "Tell my friends" or "Send me money" or whatever.

Even if we can trust Facebook with this information, it lends an air of nonchalance to the practice.