When the user first authenticates (and removes certain permissions) then Facebook will return what you were allowed for. If Foobar ignores the auth failure for

When the user first authenticates (and removes certain permissions) then Facebook will return what you were allowed for. If Foobar ignores the auth failure for publish_stream and just assumes that everything will be ok, then yes, they ARE at fault for designing their app poorly and making assumptions about what they get back from Facebook. What they SHOULD do is store the list of permissions the user has, and when they click on the 'Share to Facebook' button, check the permission and if you don't have it, re-auth with additional permissions. Some web apps do this automatically. I had an app (I forget which) that I authenticated to with Facebook just to log in. Eventually, I found some feature that I wanted to use that required further Facebook permissions, and it re-prompted me with the additional permissions it needed. It's not really that hard.