Live data from Hacker News

Facebook Android app sends phone number to Facebook servers without consent

symantec.com

31–40 of 91 posts

Re: Facebook Android app sends phone number to Facebook servers without consent

#31

That's annoying. But an app that's more intrusive in my mind is the Flickr app which sends your Geo location back to Flickr every single damn time you exit any camera on your Android phone. Even if you haven't launched Flickr in weeks/months. It's done this for as long as I've been monitoring the apps on my phone (a good year now). I started using LBE to selectively block security requests by apps last Summer after b…

what if you don't have your gps on?

Re: Facebook Android app sends phone number to Facebook servers without consent

#33
Android's take-it-or-leaveit install-time permission model sucks. I just counted 32 permissions for the Facebook app. When the user goes to install the app they are supposed to review that long list and decide if they are going to take it or leave it. The reality is most users have no idea what they're being asked and just hit Accept. Which means for most practical purposes there is no permission security.

Much better is the iOS model where there are a select few extra-sensitive permissions that cause a popup when the app requests it and lets the user decide if they're going to grant it at runtime, not install time. That lets the user know what triggered the request and decide if it's legitimate. It also allows them to continue using an app even if they don't want to share their location or whatever.

Re: Facebook Android app sends phone number to Facebook servers without consent

#34
post #19

Earlier quoted context omitted.

I supposed I could have googled it to find out, but I've certainly never had a carrier tell me in advance what apps would be on my phone. Perhaps it's buried in the fine print that I agreed to without reading, but honestly I doubt it.

Every Smartphone comes with certain pre-installed apps that you might not necessarily desire. But facebook certainly never was one of them. At least none of the Samsung series comes with it.

I just purchased a Motorola Defy XT from Republic Wireless and it came with the Facebook app pre-installed. I immediately checked for a system update (which there was one waiting), installed it and the FB app went away. Usually it doesn't work out that nicely though. My last Android was the HTC EVO and you couldn't get rid of FB unless you rooted it your phone.

Re: Facebook Android app sends phone number to Facebook servers without consent

#35
post #23

Earlier quoted context omitted.

Everyone is focusing on FB but the bigger problem is that any app can probably take your phone number without permission. Paging Al Franken.

Actually, when you install an application you accept the READ_PHONE_STATE permission. So you're explicitly giving them permission to take your phone number. This doesn't really apply to pre-installed applications, but there's really no argument that they're doing it without your consent if you download the application from the Play Store.

There is an argument, because normal people don't know what the hell a READ_PHONE_STATE is.

Re: Facebook Android app sends phone number to Facebook servers without consent

#36

This is pretty standard in Android apps for analytics tracking to use the phone number, IMEI or other values. A while back, a few production phones shipped where Settings.Secure.ANDROID_ID returned invalid values (null, the same value for all devices of that model, etc). This is the reason that most apps you come across ask for the READ_PHONE_STATE permission.

That doesn't give you the phone number though, nor does it excuse them using the phone number (as I'm inferring from the wording in the article). TelephonyManager.getDeviceId() returns the IMEI/MEID/ESN, not the phone number. When most developers require READ_PHONE_STATE for a unique id, this is what they use.

Re: Facebook Android app sends phone number to Facebook servers without consent

#38

Earlier quoted context omitted.

Actually, when you install an application you accept the READ_PHONE_STATE permission. So you're explicitly giving them permission to take your phone number. This doesn't really apply to pre-installed applications, but there's really no argument that they're doing it without your consent if you download the application from the Play Store.

There is an argument, because normal people don't know what the hell a READ_PHONE_STATE is.

I'm pretty sure it doesn't literally show them "READ_PHONE_STATE" and other permissions in enum form. There' s a heading and a description of what each permission entails.

Re: Facebook Android app sends phone number to Facebook servers without consent

#39

That's annoying. But an app that's more intrusive in my mind is the Flickr app which sends your Geo location back to Flickr every single damn time you exit any camera on your Android phone. Even if you haven't launched Flickr in weeks/months. It's done this for as long as I've been monitoring the apps on my phone (a good year now). I started using LBE to selectively block security requests by apps last Summer after b…

what if you don't have your gps on?

Location services can always use data or wifi antennas. I believe most Android phones have an OS-level option to turn off app access to location from these sources (otherwise airplane mode would be the only way to do it, I guess).
Post reply on HN