This is not an accurate way to view the situation. Here's the situation. The user has purchased a device (such as a smart phone) from a device manufacturer (su

This is not an accurate way to view the situation. Here's the situation. The user has purchased a device (such as a smart phone) from a device manufacturer (such as Apple). The device runs an operating system (iOS) and a whole boatload of software, including telecommunications equipment necessary to operate cellular radios, the higher level OS, then user-installed applications and such. If you don't trust the device manufacturer, then that's the ball game. If you assume that the device manufacturer is untrustworthy, then you should assume that it can steal the user's data just as easily from a web browser (when the user visits facebook.com) as it can from a native application. When the user decides to sign into Facebook (or any website or application) from their device - the manufacturer-supplied device - the user is trusting the manufacturer with their data. Whether the application is delivered through a web browser, or is a so-called 'native' app installed through an app store, doesn't substantially change the trust relationship between Facebook and the manufacturer. If you believe the manufacturer is doing nefarious things, then you should assume the manufacturer will install a spyware web browser that siphons data out of every web page that you visit. Partnering with the device manufacturer to allow them to distribute a Facebook-branded mobile app does not substantially grant them more trust than they would have already.