Facebook is buying stolen passwords from the dark web

The company says it wants to protect users, but researchers query its effectiveness