A couple days ago I was informed that the Facebook app on my Samsung Galaxy S3 wanted to update. But it needed me to agree to some additional permissions for the app. I clicked the button to see what they were and was greeted with this:
I was more than a little surprised by the things that Facebook expected me to agree to let them have access to on my phone. Let’s be honest, that’s a pretty invasive list of things that I’m being asked to agree to allow and trust that Facebook will do no harm.
So I decided not to upgrade.
Here’s the thing, though. While I was originally angry with Facebook (I still am to some degree), I realized that Google is to blame here as well. They’ve developed this “all or nothing” permissions model. It’d clearly be more friendly to the user if every one of those permissions had an associated checkbox. That would allow me to choose the things which are reasonable and uncheck those that are not. The price, of course, is that I wouldn’t get the application’s full feature set. But maybe I don’t need or want all those features anyway.
I just want to post cat pictures and stuff. Let’s leave my SMS messages and wireless network connections out of it, OK?
This “take it or leave it” system really doesn’t allow for that use case.
I’d remove the app entirely, but I do use the 2-factor authentication codes that it generates. So I’d need to find an alternative way of getting those.
If this was a desktop app, I could at least run it inside a Virtual Machine and manage what it has access to. Maybe we should expect next generation phones, as they’re going to be more and more powerful, to offer similar virtualization? Seems like the wrong solution to me, but I wouldn’t be at all surprised to see it.
Jeremy Zawodny's blog 
Undocumented back-end access to fine-grained control of all permissions on a per-app basis (accessed by a widget called App Ops) was pulled by Google in December (which got the EFF’s attention.) It restored using discoverable methods (usually requiring root). It is also available in CyanogenMod.
Completely agree about it being Google’s fault here, but I’m also disappointed in Facebook’s lack of restraint in asking for so much data.
I have an iPhone, but I deleted Facebook off my phone as well, and have Facebook SMS me for the two factor auth instead of generating it on my phone.
Interestingly, it’s partially because of the virtualization model that Android uses that apps have to ask for these permissions. It’s modified Linux under the hood, and each app runs as its own user, and has access only to its own “home” directory. Permissions for things like network access, SMS, location, etc are controlled by Linux group permissions. This is only checked/assigned at install time. They’d have to come up with a way for apps to dynamically request and be granted group permissions, which is conceivable, at least to my limited understanding. It would take work, but it seems like it could be done
As an aside, this is what makes me nervous about “rooting” and jail breaking. You’re literally giving apps root access to do whatever they want on your phone, including completely bypassing these permissions/restrictions. *shudder*
Blackberry did a good job of this. You were shown the permissions and could set them to ok, ask each time, and denied. They were also grouped so you could permissions for the group instead of each separate one.
The price, of course, is that the app then needs to be able to not crash when it’s denied access to some resources. Given the general state of error handling in software (not just mobile apps) the likely result is that there would be no practical difference for >90% of apps because the user would get the choice between granting the app everything it asks for or having it crash randomly.
The best solution I can think of is some sort of automated testing infrastructure “Upload your app here and we’ll test it on the top 50 hand sets and with a matrix of denied permissions (sorry, no option to turn that last bit off).”
Pingback: Android 5.0 is out | Typing Animal
There are so many apps that request permissions that they shouldn’t really need, I don’t see why a game would need access to your messages and contacts but a lot of them request it, I guess most people treat it like a tos and just click accept.
If you install the Facebook app on your Android, your phone or tablet should let you know that the app is asking for your permission to access information or use features from your Android. Almost all apps need certain permissions to run on Android, and we use these permissions to run features in the app. Keep in mind that Android controls the way the permissions are named, and the way they’re named doesn’t necessarily reflect the way the Facebook app uses them.
We realize that some of these permissions sound scary, so we’d like to provide more info about how we use them. Below, you’ll find a list of some of the permissions we request for the Facebook app, as well as an example of how we use each one. Keep in mind that this list doesn’t include all of the Android permissions we request or all of our uses of those permissions. If you’ve already installed the Facebook app, you can find a list of the permissions the app uses in your phone’s Applications Manager, or by visiting the Play Store and clicking View details under Permissions. To know more please click Click here
I guess most people treat it like a tos and just click accept.