There is no way for an app to install on your profile without your permission, it's just not in the API and I see no reason why Facebook would give them access to a secret API. Are you sure you didn't sign in to Pandora with your Facebook account? This is a pretty serious accusation. I'm no facebook fan but we need to be honest in our criticism if we want to be credible.
In this case, there was a bug that was showing applications on a user’s Application Settings page that the user hadn’t authorized. No information was shared with those applications and the user’s list of applications was not shown to anyone but the user. This bug has been fixed.
It does appear that unauthorized apps are no longer being added to users' pages, however any unwanted applications that were previously added will still need to be removed manually."
http://www.macworld.com/article/151087/2010/05/facebook_addi...
It may have been a bug, and it may be different now, but there was certainly a period of time that apps could add themselves without my explicit permission.
There was the blue Facebook bar on top saying that Pandora is connected with my Facebook. I could click no to disable it.
There is a special service that Pandora, yelp and a few others are using. It is on by default and opt-out.
Not very private if you ask me.
How I understand the concept of the like button is this:
The like button is an extremely easy version of Facebook connect. When you are logged into Facebook and visit a site with the like button implementation, you have automatically logged in. You do not need to click the like button. (Remember you could once sign in automatically to TechCrunch's commenting system by just visiting).
This way Facebook can monitor the sites you visit and in future can serve you better ads on those websites than Google. (that is how they are a major Google competitor.
The so called apps that were installed without permission was was just a internal tracking tool that was made public. It still exsits but users just don't see it any more.
Trust me, when I opened Pandora and saw "Kyle Blahblah" likes the same music as you, I was furious. Which is when I found out I now had apps on my profile I had never approved.
The only app I ever wanted on my Facebook was Twitter, and oh boy, did I have more than that. Trust me, I know what I'm doing and I know that I can say with 100% confidence that I did NOT agree to install those apps. I understand how hard is is for me to convey my sincerity, but I know full well how an app is supposed to be presented for access to my profile, and that never happened.
edit Just checked Pandora. It definitely is piggy backing on Instant Personalization which is now turned off. Apparently Pandora even kindly gives one a way of shutting it off while still on a Pandora.com page which is nice. I must have missed that in my rage to go shut it off in my Facebook profile.
Actually, the ONLY reason I even knew it grabbed the info from Facebook was by the profile picture they automatically used, and would not let you change or delete.