That's a standard challenge if you try to log into your FB account from a new machine / IP address that geolocates somewhere you don't typically seem to be. Of course, that's pretty ironic since your Tor exit could be anywhere, but it's not specific to Tor anyhow. I have seen the same behavior using VPN, too.
The problem is not the existence of the challenge. The problem is it is broken in a fresh, unmodified install of the TOR Browser. Sorry, but I can't recognize a pure white square properly as a person.
There isn't an exit when accessing an onion address - the identity of the client-chosen part of the circuit would be unknown to the hidden service operator.
