Android's permissions system for stuff like that is indefensible. Anything with severe privacy implications like "years of text message history" should explicitly opt-in with a permission request popup at runtime like iOS has done for features like camera since launch.<p>Of all the things to not copy from iOS, of course privacy is the one that they decide to skimp out on. I'm glad they've started to catch up, but they have a ways to go yet.
I removed my phone number from Facebook profile months ago.
Now and then, Facebook still asks me if "XXXXXX" is my number?
Once I unintentionally linked my Facebook account with my insta account. And then I started getting follow suggestions from people in my Facebook friend list.
I tried many thing to de-link the accounts. Ultimately, I created a fake Facebook account and linked it to my insta.<p>Once you give something to Facebook; it's never truly erased.
I realize that it's too late to cry over spilled milk, but that was one of the reasons for which Firefox OS was developed. We wanted to push a different permission model in which permissions were much more fine-grained and could be audited and revoked easily. Sadly, one of the reactions of the development community (including HN commenters) at the time was along the lines of "Android is just fine".<p>I understand that recent versions of Android have moved towards adopting a permission model closer to that of Firefox OS, though, and I suspect that the example given by Firefox OS at least showed that it was possible.<p>P.S.: Yes, Firefox OS had other problems. Let's not try and idealize the past :)
What’s the supposed justification for scraping text message data? I mean the contact list could be justified as a means of cross referencing friends. I’m having a hard time coming up with a <i>legitimate</i> use for text message data. Best I’ve got is “<i>who do you contact regularly?</i>” which is still insanely creepy.
Funny how this is popping up now (presumably because some guy noticed his call logs were in his facebook data download and tweeted about it), even though the permissions in question (described in no unecrtain terms) were in the app for years, and there was an explicit setting in the app to turn this on/off <a href="http://i.imgur.com/NRarWdh.jpg" rel="nofollow">http://i.imgur.com/NRarWdh.jpg</a>.
I'm ex-FB and have it on good authority that this is indeed used to improve the relevance of friend suggestions (i.e. distinguish between your best friends and the plumber in your contacts). I'm also told it's opt-in, and the app dialog (not just the system dialog) does say call logs will be scraped.<p>But still, IMO it's an incredibly invasive, incredibly dumb thing to be doing in the current context for the small benefit it brings. I hope they wake the f<i></i>* up to just how bad it makes FB look like to the outside world, and kill this feature with fire.
The mile-long list of app permissions requested by Facebook's app should have been a red flag for most.<p>There are alternatives, such as using the mobile web interface, or any of the various apps that wrap the site, such as <a href="https://f-droid.org/en/packages/it.rignanese.leo.slimfacebook/" rel="nofollow">https://f-droid.org/en/packages/it.rignanese.leo.slimfaceboo...</a>
When you allow an app to access your contacts, they grab all of them and upload them to their servers. It's less severe in iOS because they can't access SMS and call logs.
This is one of the things that led me to stop using Facebook last year. In order to use the app you have to give it all manner of permissions. And of course, if Facebook can access your data they’re going to suck in as much as they can. They don’t respect you, they want to use you.<p>So put me in the “not surprised” category, but I’m really glad there’s more discussion of this.
Yawn! We knew this was happening for years. FB scraped data for one purpose only: To figure out who your close friends were offline. And they wanted all sorts of information that could indicate closeness. From location data that would show how often you meet up together and how long you hang out. To phone call and sms data.<p>Now a lot of that data is dead data. Like it has no use after a couple of years. But just like Google cookie having an expiration date of 20 years, FB just does not know when that data becomes irrelevant.<p>FB and zuck have this manifest dream of figuring out connections and then figuring out the strength of those connections. Then they want to figure out social relevance. Then they want to use that info to bind people together on their platform. It is not a bad idea overall, until you add in government and corporate entities.<p>And by that time you know how evil of a thing you signed up for.
I'll throw in another place where permissions aren't nearly granular enough - online file storage (Dropbox, Onedrive, Box.com, etc.). Perhaps I'd like to allow an app to save information for cross-platform use or just because I want it on my own personal cloud storage - 1Password's older versions are a great example of this. I haven't looked at it recently, but I'm not aware of any changes that add that level of granularity to the APIs.<p>What throws me is that I'd expect security conscious developers to be clamoring for this. If I'm writing an app that should store data for users on the user's own accounts, it's not "I do not want to have access to everything" it's "I do want to NOT have access to everything."
People had been running untrusted apps in the browser and collaborating over the internet for more than two decades now. Mobile OSes threw out all the safety lessons codified into web browsers and built an entirely new permissions model. A decade later, here we are - there are hundreds of companies holding varying levels of access to your entire contacts list, text messages, GPS data, photos and other media. And all of them will hold on to it for eternity.<p>I for one, am glad web apps are making a comeback. Now I use web apps wherever possible, fully aware that I can't do anything about what's already been shared.
From my insider source, I'm told that permissions will change significantly in the near future.<p>Just FYI: a lot of other apps also utilize the same permission. Just an aside but Google also has the authority to whitelist certain applications for these permissions - meaning they can enable certain invasive permissions without asking the users.<p>We shouldn't just vilify Facebook. It was how the privacy framework was designed for Android that's the issue. This will change in the next upcoming versions.
Their permission requests are outrageous. That's why I refuse to install any apps from Facebook on my phone, and pollute my Facebook account with false personal data.<p>Fake news for fake data:)
Users need to be able to mislead the apps.<p>Right now, an app can force a choice: enable all the permissions, or you don't get to use the app. Users need to be able to feed fake data into the app. For example, maybe Facebook should think I am spending my time with Bill Gates in Bhutan. Users should be able to install dishonesty plugins to generate this data.
I already suspected this due to getting more posts from my friends based on who I texted, and they were Android users. It's fucking annoying. Also, using the same wifi network leads to getting friend suggestions
Google is as much to blame here as Facebook is. It shouldn't have allowed apps with "contacts" permission to scrape sms & call logs. I hope both of them are held accountable