4 ms·

> What honest and useful reason can Facebook have to get access to my texts? Seemingly they’re running with the “It will help us target better” message. A Face

> What honest and useful reason can Facebook have to get access to my texts? Seemingly they’re running with the “It will help us target better” message. A Facebook engineer explained this permission on Reddit when the story first broke. They are using SMS access to speed up two-factor authentication. (They send an SMS to your phone, and then read it automatically.) Full explanation here: http://www.reddit.com/r/WTF/comments/1t5z45/facebook_why_the_hell_do_you_think_its_okay_to/ce4y6x2 http://www.reddit.com/r/WTF/comments/1t5z45/facebook_why_the... Should this information comfort you? It depends on if you trust Facebook.

Stealth- 13y ago
ALOT of apps are starting to do this. I believe Snapchat initially was the company that began doing it. When a site like Facebook uses your number to identify you, this feature actually makes sense. I wonder if more fine-grained permissions would make more sense for this sort of feature. Perhaps it would be better if Android had support for "This app may read text messages from 1-800-XXX-XXXX" or something similar instead.
- regecks 13y ago
  I use XPrivacy (https://play.google.com/store/apps/details?id=biz.bokhorst.xprivacy.installer https://play.google.com/store/apps/details?id=biz.bokhorst.x...). With it, I have extremely fine-grained access control to a wide variety of "system calls", including access to contacts, text messages and to the device phone number. In this case, I can permit access temporarily during the 2FA, and then return garbage values the rest of the time. Easy. (Though obviously if they harvest my text messages for other purposes during 2FA, that is a problem - but one can that can be technically solved within XPrivacy imo.) In other cases, such as running Skype, I deny access to everything always (phone number, my location, contacts, Google accounts are the things Skype makes system calls for) and Skype continue to works fine, so I think this is a viable strategy.
  - sizzle 13y ago
    since first being introduced to XPrivacy, I absolutely can not use an android phone without it. It really opened my eyes to how invasive some apps are when running in the background or just inappropriately accessing info in general (especially location information!)
  - sandwell 13y ago
    It sucks that you have to have a rooted device to use this. While I think Android in general is fantastic, I'm torn but the fact that I am forced to choose between having control of my privacy or being able to use online banking, get regular updates etc.
- sliverstorm 13y ago
  Google Hangouts just did it to me a few days ago to verify the number on my account, I wasn't expecting it.
cyphax 13y ago
I've seen Telegram do this: they send a confirmation code when you sign up and the app reads the text right when it comes in and handles the verification code for you. It's quite convenient. However, if an app can get access to ALL texts just for this feature, I think these texts need to be categorized. It doesn't need access to all my texts, just the ones that THEY sent. Otherwise I'd prefer to enter verification codes (which usually seem to be only 4 digits anyway) myself. But we still can't really decide what an app may and may not access: it's all or nothing. I hope this changes. I do know it's possible to install an application to protect your system afterwards (like LBE Privacy Guard) but that's only a workaround for what I consider to be a problem.
- chucknelson 13y ago
  Agreed on the specific permission to read a text from a certain source. This "access to all SMS" sounds crazy - next step is let an app peruse my email inbox I guess? Even though I'm sure that isn't too far fetched with the latest news on email privacy.
enscr 13y ago
I believe this is something where Android can provide a better experience by not giving a blanket permission to read all SMS. How about only allow SMS with a pre-defined header to be read by an app.
- mverwijs 13y ago
  Or a time-limit, as with Bluetooth. "Read your text messages for the next 5 minutes."
jrs235 13y ago
"we require that so we can automatically intercept login approvals SMS messages for people that have turned 2-factor authentication for their accounts" Wait, how does that work? Doesn't that kind of break 2 form authentication? If no input is required by the user then it's pointless. If I hack your account and Facebook sends your phone an SMS to authenticate but the Facebook App automatically "intercepts" and reads the SMS message and says "Yup! It's good!" What's the point in sending the SMS message? Think about that for a moment. Why not just send a request to my smart toaster and have my smart toaster just reply "Yup, I got your message!" Am I missing something?

Stealth- 13y ago

ALOT of apps are starting to do this. I believe Snapchat initially was the company that began doing it. When a site like Facebook uses your number to identify you, this feature actually makes sense. I wonder if more fine-grained permissions would make more sense for this sort of feature. Perhaps it would be better if Android had support for "This app may read text messages from 1-800-XXX-XXXX" or something similar instead.

regecks 13y ago
I use XPrivacy (https://play.google.com/store/apps/details?id=biz.bokhorst.xprivacy.installer https://play.google.com/store/apps/details?id=biz.bokhorst.x...). With it, I have extremely fine-grained access control to a wide variety of "system calls", including access to contacts, text messages and to the device phone number. In this case, I can permit access temporarily during the 2FA, and then return garbage values the rest of the time. Easy. (Though obviously if they harvest my text messages for other purposes during 2FA, that is a problem - but one can that can be technically solved within XPrivacy imo.) In other cases, such as running Skype, I deny access to everything always (phone number, my location, contacts, Google accounts are the things Skype makes system calls for) and Skype continue to works fine, so I think this is a viable strategy.
- sizzle 13y ago
  since first being introduced to XPrivacy, I absolutely can not use an android phone without it. It really opened my eyes to how invasive some apps are when running in the background or just inappropriately accessing info in general (especially location information!)
- sandwell 13y ago
  It sucks that you have to have a rooted device to use this. While I think Android in general is fantastic, I'm torn but the fact that I am forced to choose between having control of my privacy or being able to use online banking, get regular updates etc.
sliverstorm 13y ago
Google Hangouts just did it to me a few days ago to verify the number on my account, I wasn't expecting it.

cyphax 13y ago

I've seen Telegram do this: they send a confirmation code when you sign up and the app reads the text right when it comes in and handles the verification code for you. It's quite convenient. However, if an app can get access to ALL texts just for this feature, I think these texts need to be categorized. It doesn't need access to all my texts, just the ones that THEY sent. Otherwise I'd prefer to enter verification codes (which usually seem to be only 4 digits anyway) myself. But we still can't really decide what an app may and may not access: it's all or nothing. I hope this changes. I do know it's possible to install an application to protect your system afterwards (like LBE Privacy Guard) but that's only a workaround for what I consider to be a problem.

chucknelson 13y ago
Agreed on the specific permission to read a text from a certain source. This "access to all SMS" sounds crazy - next step is let an app peruse my email inbox I guess? Even though I'm sure that isn't too far fetched with the latest news on email privacy.

enscr 13y ago

I believe this is something where Android can provide a better experience by not giving a blanket permission to read all SMS. How about only allow SMS with a pre-defined header to be read by an app.

mverwijs 13y ago
Or a time-limit, as with Bluetooth. "Read your text messages for the next 5 minutes."

jrs235 13y ago

"we require that so we can automatically intercept login approvals SMS messages for people that have turned 2-factor authentication for their accounts" Wait, how does that work? Doesn't that kind of break 2 form authentication? If no input is required by the user then it's pointless. If I hack your account and Facebook sends your phone an SMS to authenticate but the Facebook App automatically "intercepts" and reads the SMS message and says "Yup! It's good!" What's the point in sending the SMS message? Think about that for a moment. Why not just send a request to my smart toaster and have my smart toaster just reply "Yup, I got your message!" Am I missing something?