Over on reddit, there’s a post to the picture below about how Facebook wants access to text messages, email, and other things on a person’s cell phone.
Although it cannot be verified, someone who claims they work with the Facebook Android app gave this response.
I work at Facebook, more specifically, I’ve spend a considerable chunk of my time working on our Android app and the Android permissions we request. (I also worked on that same problem before I joined Facebook)
The description that includes the words “send emails … without owners’s knowledge” comes from Android itself and applies to the WRITE_CALENDAR permission. This permission is needed by any application that wants to create a calendar feed in the unified Android calendar storage, and create/modify events in it.
In particular, the Facebook app would like to give you the option to import your Facebook events (that you created or you were invited by your friends to) so that you can see them side-by-side with your other calendars like Google Calendar, corporate Exchange accounts and so on. The rationale for this is that it will make the planning of your day easier as you will be able to see all your agendas at the same time.
Unfortunately, the way this specific Android permission works is that it also allows apps that create or modify an event to send event invites and updates to the attendees by email automatically using the your email account on the device. We don’t need to do this, as we have other channels of communication with all the attendees of Facebook events – we have the email they provided to us when creating their Facebook accounts, we can directly update the event in their feed, we can send them a push notification in theri app, we can send them an SMS from our system if they have given us their phone number. However, there is no way for us to explain this to Android and to exclude that specific functionality from the permission.
As for the READ_SMS permission, we require that so we can automatically intercept login approvals SMS messages for people that have turned 2-factor authentication for their accounts, or for phone confirmation messages when you add a phone number to your Facebook account. Unfortunately, the Androids permissions system does not allow us to specify that we would like to be able to read only SMS messages from a specific number (plus that wouldn’t scale well because the list of numbers varies per country, but that’s a separate issue).
It’s also worth noting that we would love to be able to ask only for the permissions we need for the specific features particular users uses. For example if you don’t use Facebook events or you don’t want to see them in your device calendar we would prefer to not request the WRITE_CALENDAR calendar; or if you don’t have login approvals and don’t add a phone number, we don’t ask for READ_SMS. However, Android does not allow permission requests on demand; we have to request all permissions that cover each feature at install time, and the users can only grant or deny all of them and have no control over individual permissions.
We also have an official Help Center page that covers this.
It really is important to know and understand what any app is doing on your cell phone. It’s your decision then as to whether you really want that app on your phone, accessing your information.
As I read a story on Slashdot about Facebook removing the ability to download your posts, I came across this bit of information from user bobbied that I hadn’t pondered before, yet needs more attention.
An excellent reason to NOT post personal information on ANY site, your data becomes another’s property. Sites like Facebook collect an astounding amount of information from your activity, more than you likely suspect.
I know of multiple births which where announced on Facebook. Birth announcements only gave the full name and date of the birth but one could deduce a lot more from Facebook. One parent posts the announcement of full name and date. You got the proud parent’s name who has a spouse relationship so you now have both parents’ names. You look at the mother who has her mother shown and volia, mother’s maiden name. Births are recorded in the county records, so you look for what counties are close to their home address. You can usually weed that down to one or two. Now we have Father’s name, Mother’s name, Mother’s maiden name, date of birth and county of birth which is more than enough information to take over somebodies identity. Poor kids…Don’t even know how much trouble their parents may have caused them, even before they get out of the hospital for the first time.
When people are sharing their information on Facebook, they don’t think about the fact that they are sharing with Facebook, they think that they are sharing information with only their friends. They aren’t and they need to be more aware of just how a third party, in this case Facebook, are handling their information.