Over on reddit, there’s a post to the picture below about how Facebook wants access to text messages, email, and other things on a person’s cell phone.
Although it cannot be verified, someone who claims they work with the Facebook Android app gave this response.
I work at Facebook, more specifically, I’ve spend a considerable chunk of my time working on our Android app and the Android permissions we request. (I also worked on that same problem before I joined Facebook)
The description that includes the words “send emails … without owners’s knowledge” comes from Android itself and applies to the WRITE_CALENDAR permission. This permission is needed by any application that wants to create a calendar feed in the unified Android calendar storage, and create/modify events in it.
In particular, the Facebook app would like to give you the option to import your Facebook events (that you created or you were invited by your friends to) so that you can see them side-by-side with your other calendars like Google Calendar, corporate Exchange accounts and so on. The rationale for this is that it will make the planning of your day easier as you will be able to see all your agendas at the same time.
Unfortunately, the way this specific Android permission works is that it also allows apps that create or modify an event to send event invites and updates to the attendees by email automatically using the your email account on the device. We don’t need to do this, as we have other channels of communication with all the attendees of Facebook events – we have the email they provided to us when creating their Facebook accounts, we can directly update the event in their feed, we can send them a push notification in theri app, we can send them an SMS from our system if they have given us their phone number. However, there is no way for us to explain this to Android and to exclude that specific functionality from the permission.
As for the READ_SMS permission, we require that so we can automatically intercept login approvals SMS messages for people that have turned 2-factor authentication for their accounts, or for phone confirmation messages when you add a phone number to your Facebook account. Unfortunately, the Androids permissions system does not allow us to specify that we would like to be able to read only SMS messages from a specific number (plus that wouldn’t scale well because the list of numbers varies per country, but that’s a separate issue).
It’s also worth noting that we would love to be able to ask only for the permissions we need for the specific features particular users uses. For example if you don’t use Facebook events or you don’t want to see them in your device calendar we would prefer to not request the WRITE_CALENDAR calendar; or if you don’t have login approvals and don’t add a phone number, we don’t ask for READ_SMS. However, Android does not allow permission requests on demand; we have to request all permissions that cover each feature at install time, and the users can only grant or deny all of them and have no control over individual permissions.
We also have an official Help Center page that covers this.
It really is important to know and understand what any app is doing on your cell phone. It’s your decision then as to whether you really want that app on your phone, accessing your information.