Facebook Denies Accessing Users' Text Messages

quantr writes "Facebook is being accused of snooping on its users' text messages, but the social network says the accusations are inaccurate and misleading. The company is among a wide-ranging group of Web entities, including Flickr and YouTube, that are using smartphone apps to access text message data and other personal information, according to a Sunday Times report (behind a paywall). The newspaper said Facebook 'admitted' to reading users' text messages during a test of its own messaging service. The report also says information such as user location, contacts list, and browser history are often accessed and sometimes transmitted to third-party companies, including advertisers."

Comments

Worst?

[SJHillman]

What's worse? The the fact that they have to deny these kind of accusations or the fact that they're probably lying?

Re:Worst?

[Anonymous Coward]

The fact that any old app can apparently access your contacts, text messages and browser history.

Re:Worst?

[cpotoso]

Mod parent up. It is really a very big design flaw (on purpose?) of ios and android. Should not be up to the apps to decide whether they can access private data.

Re:Worst?

[Enderandrew]

With iOS, apps just simply have access to this data by default. With Android, for each app you have to specifically grant access to these things while installing the app.

Re:Worst?

[Anonymous Coward]

With Android, for each app you have to specifically grant access to these things while installing the app.

And that is the flaw. The right way of doing it is to let the user grant apps rights to individual resources, possibly temporarily.

Re:Worst?

[Anonymous Coward]

Many smartphones come with facebook pre-installed. I had to root my phone to uninstall it.

Re:Worst?

[PopeRatzo]

What's worse? The the fact that they have to deny these kind of accusations or the fact that they're probably lying?

You know when a corporation says "the accusations are inaccurate and misleading" that they are guilty as hell.

How hard is it to say, "No, we never, ever access private messages or contact information for any reason"?

It's like when a politician says, "To be perfectly honest..." Somebody needs to hit the crash cymbals whenever those words are spoken, to indicate ALERT! LIE COMING....

Re:Worst?

[evilRhino]

Since android is open source, there are ROMs that actually add this functionality to the OS. It was available on Cyanogenmod 7.1.0, for example.

Re:Worst?

[SJHillman]

But then how would we hear the politicians over the constant crashing of cymbals? On the bright side, assassins would no longer need silencers.

Re:Worst?

[TheRaven64]

The problem is, with the stock android install unlike, for example, Symbian, you can't just say 'no, the app can't have this permission but install it anyway'. I was looking for an app to read QR codes a while ago. The first five I found on the market all required full access to my address book. WTF? I skipped installing them, but I'm sure that they'd have worked without this capability. The other big UI problem is that the apps don't say WHY they need these privileges.

Re:Worst?

[Volvogga]

The first five I found on the market all required full access to my address book. WTF? I skipped installing them, but I'm sure that they'd have worked without this capability. The other big UI problem is that the apps don't say WHY they need these privileges.

I'm not certain, but I think that some people are now putting QR codes onto their business cards that have their contact information embedded. I know one person that has a QR code that takes your phone to his website, but was thinking about trying to get the business card reprinted with his information in VCard format within the QR code instead. I'm guessing that was the reason for the address book permissions (to add to it, not to read it), and that if you had that application, you could add a contact instantly.

I agree on a need for reasoning why certain privileges are needed. Most of them are easy to figure out (if it is a free app, chances are it has ads... thus needing internet access), but a few of them are weird, like your QR code scanner issue there. Personally, whenever I run across a weird permission request, I look back to the description or change-log of the application. If the developer has documented why the permission is necessary in either of these locations, I feel fairly confident that they are trustworthy.

Re:Worst?

[Dishevel]

Why should you have that power.
If I write an app and to pay for it I put ads out you have the right to install it or not.
As long as it is made clear what I have access to, If you do not like it then do not install my app.
Being able to install my app in any way you want on a free app is not a "right" that you have.
You are really going to blame Android for telling you what an ap wants and asking if you really want the program?

How much are you paid to make Android seem the same as iOS here?

Re:Worst?

[Rob the Bold]

The first five I found on the market all required full access to my address book. WTF? I skipped installing them, but I'm sure that they'd have worked without this capability. The other big UI problem is that the apps don't say WHY they need these privileges.

I'm not certain, but I think that some people are now putting QR codes onto their business cards that have their contact information embedded.

I have seen an actual instance of this: a local magazine publisher here prints his business card in the mags he publishes and it contains a QR code with his contact info. If an app could write to the contact list, it could add that information automatically.

But on the other hand, QR codes can be used for other data, too, so an app should be installable with or without this privilege.

But on the third hand, if an app can't to something that it promises, or it gives the user an error message stating that it doesn't have permission to do something, then the publisher is looking at a possible tech support request. A user could have forgotten that he denied access to contact list for this app, and then try to get help. The publisher is going to want to keep this to a minimum, since tech support requests eat up resources. So just not installing the application is a simple way to statistically reduce this cost. So while I don't like it, I can see at least one thing that motivates a publisher to take this route.

Re:Worst?

[Nirvelli]

Yes, but most apps are written incorrectly (they don't ask for permissions in a try/catch block), so for example when I told my ROM not to let Facebook access my GPS, the Facebook app would simply crash on opening.
This will only really work if it's a standardized OS-wide feature.

Re:Worst?

[Calos]

Look for:
LBE Privacy Guard
Permissions Denied

Re:Worst?

[LoudNoiseElitist]

Fleshlight app? They make those now? Awesome.

Re:Worst?

[Dishevel]

It is not.
Not that I know of.
The point I was making was that the programmer gets to determine what permissions he wants.
The user gets to determine if he wants to give that stuff up to have the app.
This is not only how it works but in reality it is exactly as it should work. The only times that you have problems are when a user screams "I did not read it!" or when a user screams "I want the stuff you made but I want it how I want it! Just give it to me anyway!".
In both of those cases I am ok with the user getting screwed.

Re:Worst?

[Calos]

Just be aware of the limitations of the model LBE uses. All root apps like it - including DroidWall, which I use as well - are by their very nature, leaky. If they crash and you don't realize it, they do nothing. If they fail to autostart and you don't realize it, they do nothing. In that small window between when Android boots and LBE/DroidWall autostart, they do nothing. The last case can be helped somewhat by startup managers.

PDroid seeks to shore up those shortcomings, however, it is only available for some ROMs and phones as it makes changes to Android itself. It also only appears to be available on 2.3.x releases of Android. But the upside is that it is not leaky like root background apps, and doesn't crash apps like Cyanogenmod does.

Actually, thanks for reminding me to look this up again. I'd forgotten about it, but would love to get it on my phone...

Why are people surprised?

[mr1911]

Facebook is a free service. Facebook users and their data are the commodity being sold to advertisers. The business model isn't a secret.

There are two ways to grow revenue with this model. 1) Sign up more users. 2) Invade deeper into the user data so the data sold to advertisers is more relevant and worth more.

Re:Why are people surprised?

[TubeSteak]

People are surprised because they only expect the government to invade their privacy,
not publicly traded corporations exceeding their authorized access.

Re:Why are people surprised?

[scorp1us]

Because there is the idea that what you enter into one app on your phone is not available to another app.
If I accept the "terms of use" for facebook, I do not also consent to having them go through my text messages.
When I turn off location services for facebook I do not expect them to still access my location.

Re:Why are people surprised?

[Culture20]

People are surprised because this is a cell phone app reading data that is irrelevant to the app's function. It would be like if Google had a picture editing program that sent google a snapshot of your entire filesystem directory listings. Surprising.

Re:Why are people surprised?

[stanlyb]

Actually, that is what is happening right now, the government is accessing all the "public" information.

Re:Why are people surprised?

[phrostie]

But the T in Facebook Stands for Trustworthy.

Oh wait,,,.

Re:Why are people surprised?

[TheRealMindChild]

FYI, "grow" isn't perfectly synonymous with "increase", AND you sound like a poser.

Smartphones

[ciderbrew]

I wish I didn't install their app on my HTC ages ago. It's off now; but it did get the contact data from the phone! I only use the browser for FB now and no way am I installing that Malware again. - Events details locked in FB are a pain.

Well yeah.

[TheSpoom]

I stopped using and uninstalled the Facebook Android app when I saw that it was turning on my phone's GPS as soon as I opened it. Sorry, but there's no legitimate reason for the GPS to be on all the time in this app's context.

Re:is that allowed on mobile APIs?

[colfer]

Android phones in the U.S. come with apps that cannot be deleted, depending on the service. Typically: Facebook, Twitter. You can choose to decline updates, but you cannot remove the app. Look at the comments on this app: https://market.android.com/details?id=com.virginmobileusa.vmlive&hl=en Of them 90% are along the lines of this one: "This program is garbage I wish I could get this crap off my phone."

Oh well

[slasho81]

Just add this complaint along with any other complaint you have regarding Facebook over here. This makes ignoring Facebook issues much more efficient.

Why aren't the apps properly sand-boxed?

[scorp1us]

I think I should be able to go in and modify any app's permissions after the fact. The "accept permissions" button should only set those requested permissions as default, then I should have an app that can revoke them. Currently the app developer gets all the power because people don't know what the permissions tie to and how they actually get used/abused. Such an ability would make app authors think twice...

NHave you seen the permissions?

[Drakin020]

Have you seen the permissions the Facebook App has on the HTC Rezound? (And I'm sure on other phones.) Oh BTW you cant actually remove the FB App from this phone unless you root it.

This is exactly what it says on my phone...

Permissions: This application can access the following on your phone.

- Your personal information
Read contact data, write contact data

-Services that cost you money
Send SMS Messages

-Your messages
Edit SMS or MMS, read SMS or MMS, receive SMS

-Your location
fine(GPS) location

-Network communication
full Internet access

-Your accounts
act as an account authenticator, manage the accouns list

-Storage
modify/delete SD card contents

-Phone calls
read phone state and identity

-System Tools
prevent phone from sleeping, write sync settings

Re:is that allowed on mobile APIs?

[Enderandrew]

Android doesn't do this. Certain carriers push out custom versions of Android where a small handful of the shovel-ware apps can't be deleted. But Facebook and Twitter can be deleted on all the major carriers (Sprint, AT&T, T-Mobile, Verizon).

However, you can always root your phone if you really want to delete these shovel-ware apps.

The real problem

[A beautiful mind]

The real problem is that common applications request almost all of the permissions from the phone when the user installs them, to provide full functionality (importing contacts, etc.). The user's choice is between not installing the app and giving it those permissions.

What should be happening instead is: make the permissions user selectable, to be able to install the facebook app, but to prevent it from accessing anything I don't want. The app store / market rules should mandate that applications cope with the degradation of priviledges gracefully. The OS/app should display a popup when the user tries to do something that requires priviledges the app doesn't have, along the lines of "do you want to grant permission x to this application? [just this once] / [yes] / [no] / [don't ask again]"

Re:is that allowed on mobile APIs?

[wannabgeek]

Google's stock Android doesn't let you uninstall Facebook, Twitter, Amazon MP3 and even Google Books. I'm talking Ginger Bread on Nexus One - so it's not imposed by any carrier. It gets into some weird situations as well - since I'm in India and currently Google Books is not available for India, it won't let me install any updates, but it still shows me update notifications, and would not let me uninstall the app. It sucks, especially since app storage is really small and precious on these old phones.

Facebook denies ...

[golodh]

When I read "Facebook denies [...]" I thought "Well, that makes it official then. Lets see what it is that they are denying."

"Never believe anything until it has been officially denied" (the right hon. J. Hacker.)

How much I may hate Facebook...

[vikingpower]

( and I do ! ), this is simply below all levels of verifiability. "Is being accused of...", "...denies....", "...according to...( behind paywall ).... ". And then the same Sunday Times article suddenly becomes a "report". C'mon. Show us facts, bare, hard, naked facts. Not allegations. Slow news day, Slashdot ?