Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Android app sends phone number to Facebook servers without consent

symantec.com

Post reply on HN
Print view View original

51–60 of 91 posts

Re: Facebook Android app sends phone number to Facebook servers without consent

#51

Post by sinnerswing »

guelo wrote: post #33

Android's take-it-or-leaveit install-time permission model sucks. I just counted 32 permissions for the Facebook app. When the user goes to install the app they are supposed to review that long list and decide if they are going to take it or leave it. The reality is most users have no idea what they're being asked and just hit Accept. Which means for most practical purposes there is no permission security. Much bette…

Perfect timing. saw this article 2 days ago:

"Android malware up 614%. Android Home to 92% of Mobile Market's Malware"

http://www.theregister.co.uk/2013/06/26/android_malware_bloo...

Re: Facebook Android app sends phone number to Facebook servers without consent

#52

Post by gohrt »

guelo wrote: post #33

Android's take-it-or-leaveit install-time permission model sucks. I just counted 32 permissions for the Facebook app. When the user goes to install the app they are supposed to review that long list and decide if they are going to take it or leave it. The reality is most users have no idea what they're being asked and just hit Accept. Which means for most practical purposes there is no permission security. Much bette…

> When the user goes to install the app they are supposed to review that long list

No, the user is supposed to see the first 2, ignore the hidden "show more" button, and then just hit Accept.

This is one of Android's more obnoxious user-security flaws.

Re: Facebook Android app sends phone number to Facebook servers without consent

#53

Post by gohrt »

qwertzlcoatl wrote: post #25
eli wrote: post #19

Earlier quoted context omitted.

I supposed I could have googled it to find out, but I've certainly never had a carrier tell me in advance what apps would be on my phone. Perhaps it's buried in the fine print that I agreed to without reading, but honestly I doubt it.

Every Smartphone comes with certain pre-installed apps that you might not necessarily desire. But facebook certainly never was one of them. At least none of the Samsung series comes with it.

The Google Nexus One had Facebook force-installed; (I think) it came with one of the OS upgrades, which is even worse than pre-installed, because I really had no choice.

Re: Facebook Android app sends phone number to Facebook servers without consent

#54

Post by nivla »

I thought this was a known fact. Isn't there numerous articles were people were surprised how Facebook knew and was recommending their dentist/plumber/clients to be added? Towards the end it turned out to be from the contact list uploaded from the user's phone.

I am not going to say to avoid FB, but if you really want it on the phone, please use a non-official version for privacy sake. Atleast on android, they are less sucky than the official version. One of those times I am happy a company doesn't make an official version for Windows Phone and the MS version doesn't suck.

Re: Facebook Android app sends phone number to Facebook servers without consent

#55

Post by IanCal »

werid wrote: post #8
monkmartinez wrote: post #4

You don't need Facebook. Kill your profile.

in case you didn't read the article "The first time you launch the Facebook application, even before logging in, your phone number will be sent over the Internet to Facebook servers. You do not need to provide your phone number, log in, initiate a specific action, or even need a Facebook account for this to happen." so an accidental launch is all you need.

You do still need to install and agree to the permissions though. I wonder if this is in the list.

Re: Facebook Android app sends phone number to Facebook servers without consent

#56

Post by MichaelGG »

andymcsherry wrote: post #24
Steko wrote: post #23

Earlier quoted context omitted.

Everyone is focusing on FB but the bigger problem is that any app can probably take your phone number without permission. Paging Al Franken.

Actually, when you install an application you accept the READ_PHONE_STATE permission. So you're explicitly giving them permission to take your phone number. This doesn't really apply to pre-installed applications, but there's really no argument that they're doing it without your consent if you download the application from the Play Store.

Actually, most of the time it's explained as being needed to determine if the phone is in a call. Which sounds perfectly fine - I'd like music to stop or games to pause on incoming calls.

The fact that "phone state" is mixed up with Phone Unique ID is terrible.

Re: Facebook Android app sends phone number to Facebook servers without consent

#57

Post by akaBruce »

That's not so bad compared to the other permissions on there. With Facebook, I'd guess (maybe incorrectly) you're already listing your phone number on there and they'll eventually get it anyway. I'd like to know the reason behind some other things on that permissions list...

https://play.google.com/store/apps/details?id=com.facebook.k...

* Directly call phone numbers: Allows the app to call phone numbers without your intervention. This may result in unexpected charges or calls. Note that this doesn't allow the app to call emergency numbers. Malicious apps may cost you money by making calls without your confirmation.

* Read phone status and identity: Allows the app to access the phone features of the device. This permission allows the app to determine the phone number and device IDs, whether a call is active, and the remote number connected by a call.

* Write call log: Allows the app to modify your device's call log, including data about incoming and outgoing calls. Malicious apps may use this to erase or modify your call log.

* Read call log: Allows the app to read your device's call log, including data about incoming and outgoing calls. This permission allows apps to save your call log data, and malicious apps may share call log data without your knowledge.

Account management I can understand. Location makes sense for checking-in and what not. Reading/modifying contacts also makes sense if you'd like it to manage your contacts automatically.

The call logs are the ones that really confuse me. The only thing I can think of that would make sense is charging for Facebook Credits via your carrier and trying not to confuse the user into thinking they're getting charged twice (once via the Facebook App and once more via the phone call).

Re: Facebook Android app sends phone number to Facebook servers without consent

#58

Post by vabmit »

As much as I wanted to install their app, I never did because I didn't trust them. I clicked to the requested permissions screen a few times. But, I just couldn't get myself to go any further. Now, I feel vindicated for my paranoia. I'm sure they're doing many more nefarious things.

Re: Facebook Android app sends phone number to Facebook servers without consent

#59

Post by werid »

IanCal wrote: post #55
werid wrote: post #8

Earlier quoted context omitted.

in case you didn't read the article "The first time you launch the Facebook application, even before logging in, your phone number will be sent over the Internet to Facebook servers. You do not need to provide your phone number, log in, initiate a specific action, or even need a Facebook account for this to happen." so an accidental launch is all you need.

You do still need to install and agree to the permissions though. I wonder if this is in the list.

facebook comes pre-installed on a lot of phones. can't even remove it without rooting the phone.

Re: Facebook Android app sends phone number to Facebook servers without consent

#60

Post by akaBruce »

MichaelGG wrote: post #56
andymcsherry wrote: post #24

Earlier quoted context omitted.

Actually, when you install an application you accept the READ_PHONE_STATE permission. So you're explicitly giving them permission to take your phone number. This doesn't really apply to pre-installed applications, but there's really no argument that they're doing it without your consent if you download the application from the Play Store.

Actually, most of the time it's explained as being needed to determine if the phone is in a call. Which sounds perfectly fine - I'd like music to stop or games to pause on incoming calls. The fact that "phone state" is mixed up with Phone Unique ID is terrible.

Well, not only if your phone is in a call, but also your phone number, device id and the number of the person you're connected to.

Read phone status and identity: Allows the app to access the phone features of the device. This permission allows the app to determine the phone number and device IDs, whether a call is active, and the remote number connected by a call.

https://play.google.com/store/apps/details?id=com.facebook.k...

And don't worry if your friend has the Facebook app and calls you if you don't have a profile. They can just search through your friend's contacts to associate your number with a shadow profile of you anyway.

Post reply on HN