Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Android app sends phone number to Facebook servers without consent

symantec.com

Post reply on HN
Print view View original

41–50 of 91 posts

Re: Facebook Android app sends phone number to Facebook servers without consent

#41

Post by andymcsherry »

lawnchair_larry wrote: post #35
andymcsherry wrote: post #24

Earlier quoted context omitted.

Actually, when you install an application you accept the READ_PHONE_STATE permission. So you're explicitly giving them permission to take your phone number. This doesn't really apply to pre-installed applications, but there's really no argument that they're doing it without your consent if you download the application from the Play Store.

There is an argument, because normal people don't know what the hell a READ_PHONE_STATE is.

The description is PHONE CALLS READ PHONE STATUS AND IDENTITY Allows the app to access the phone features of the device. This permission allows the app to determine the phone number and device IDs, whether a call is active, and the remote number connected by a call.

Re: Facebook Android app sends phone number to Facebook servers without consent

#42

Post by Livven »

andymcsherry wrote: post #21

This is pretty standard in Android apps for analytics tracking to use the phone number, IMEI or other values. A while back, a few production phones shipped where Settings.Secure.ANDROID_ID returned invalid values (null, the same value for all devices of that model, etc). This is the reason that most apps you come across ask for the READ_PHONE_STATE permission.

Thanks for mentioning this. It's always annoying when stuff like this is taken out of context and reinterpreted by people who don't have intimate knowledge about the topic, resulting in the kind of useless knee-jerk reactions seen in this comment thread.

If you told the average web-using person that whenever they visit google.com Google gets to know which internet provider you use and from which country, possibly even city you come from and which language you speak, they'd probably freak out thinking it was some evil Google scheme to mine data when in fact, all that is simply a byproduct of any reasonable logging or analytics solution that is not special to Google at all.

Re: Facebook Android app sends phone number to Facebook servers without consent

#43

Post by speeder »

dschep wrote: post #22
jbail wrote: post #9

You know what the super not cool part is? Tons of Android phones come pre-packaged with a Facebook app that you can't delete unless you root your phone.

Do carriers remove the "Disable" feature in Android 4+ in "Manage Apps?"

Several carriers still ship Android 2, specially for cheaper phones (or stupid phones, like Xperia Play that only supports Android 2...)

Oh, and my Xperia Play came with Facebook for Xperia that integrated a lot with it and I almost bricked the phone trying to remove it, needed to do some warranty-breaking stuff to re-install a firmware from scratch.

Re: Facebook Android app sends phone number to Facebook servers without consent

#44

Post by scott_karana »

guelo wrote: post #33

Android's take-it-or-leaveit install-time permission model sucks. I just counted 32 permissions for the Facebook app. When the user goes to install the app they are supposed to review that long list and decide if they are going to take it or leave it. The reality is most users have no idea what they're being asked and just hit Accept. Which means for most practical purposes there is no permission security. Much bette…

I agree. I wish Android had denial or "spoofing" of permissions in stock form.

I do appreciate that Android points out even smaller details, however: "access to your contacts" is one that works without prompting on iOS, if I remember correctly.

It'd be nice if users could choose both the level of detail and choose piecemeal.

Re: Facebook Android app sends phone number to Facebook servers without consent

#45

Post by rimantas »

guelo wrote: post #33

Android's take-it-or-leaveit install-time permission model sucks. I just counted 32 permissions for the Facebook app. When the user goes to install the app they are supposed to review that long list and decide if they are going to take it or leave it. The reality is most users have no idea what they're being asked and just hit Accept. Which means for most practical purposes there is no permission security. Much bette…

What's more, there is no legitimate way to get phone number on iOS.

Re: Facebook Android app sends phone number to Facebook servers without consent

#46

Post by sixothree »

guelo wrote: post #33

Android's take-it-or-leaveit install-time permission model sucks. I just counted 32 permissions for the Facebook app. When the user goes to install the app they are supposed to review that long list and decide if they are going to take it or leave it. The reality is most users have no idea what they're being asked and just hit Accept. Which means for most practical purposes there is no permission security. Much bette…

I'm quite sick of cavalier permissions. I started getting spam calls almost immediately after moving to an Android phone on the same account.

Re: Facebook Android app sends phone number to Facebook servers without consent

#47

Post by andymcsherry »

aguynamedrich wrote: post #36
andymcsherry wrote: post #21

This is pretty standard in Android apps for analytics tracking to use the phone number, IMEI or other values. A while back, a few production phones shipped where Settings.Secure.ANDROID_ID returned invalid values (null, the same value for all devices of that model, etc). This is the reason that most apps you come across ask for the READ_PHONE_STATE permission.

That doesn't give you the phone number though, nor does it excuse them using the phone number (as I'm inferring from the wording in the article). TelephonyManager.getDeviceId() returns the IMEI/MEID/ESN, not the phone number. When most developers require READ_PHONE_STATE for a unique id, this is what they use.

TelephonyManager.getDeviceId() has it's own set of issues. See: http://android-developers.blogspot.com/2011/03/identifying-a...

Re: Facebook Android app sends phone number to Facebook servers without consent

#48

Post by bricestacey »

scott_karana wrote: post #44
guelo wrote: post #33

Android's take-it-or-leaveit install-time permission model sucks. I just counted 32 permissions for the Facebook app. When the user goes to install the app they are supposed to review that long list and decide if they are going to take it or leave it. The reality is most users have no idea what they're being asked and just hit Accept. Which means for most practical purposes there is no permission security. Much bette…

I agree. I wish Android had denial or "spoofing" of permissions in stock form. I do appreciate that Android points out even smaller details, however: "access to your contacts" is one that works without prompting on iOS, if I remember correctly. It'd be nice if users could choose both the level of detail and choose piecemeal.

iOS 6 I believe made requesting contacts require permission.

Re: Facebook Android app sends phone number to Facebook servers without consent

#49

Post by rimantas »

scott_karana wrote: post #44
guelo wrote: post #33

Android's take-it-or-leaveit install-time permission model sucks. I just counted 32 permissions for the Facebook app. When the user goes to install the app they are supposed to review that long list and decide if they are going to take it or leave it. The reality is most users have no idea what they're being asked and just hit Accept. Which means for most practical purposes there is no permission security. Much bette…

I agree. I wish Android had denial or "spoofing" of permissions in stock form. I do appreciate that Android points out even smaller details, however: "access to your contacts" is one that works without prompting on iOS, if I remember correctly. It'd be nice if users could choose both the level of detail and choose piecemeal.

  > "access to your contacts" is one that works without
  > prompting on iOS, if I remember correctly.
It used to work, but was fixed in iOS6.

Re: Facebook Android app sends phone number to Facebook servers without consent

#50

Post by kayoone »

kryten wrote: post #28
abraham wrote: post #12

Earlier quoted context omitted.

Facebook never said it was an accident.

Indeed. Facebook are a rotten company like this. They'll throw something out, then yank it if they get caught. It makes you wonder what we haven't noticed yet.

yep, the whole "move fast and break things" mantra doesnt really suit privacy concerns.
Post reply on HN