The real problem with app permissions is that developers are allowed to even REQUEST permissions that are not necessary for the functioning of their app. This is not just an issue with apps on facebook. It's also an issue with Android apps (and, I presume, iOS apps).

The fact is that the majority of users can not be expected to look out for themselves. People hit install and then hit accept to whatever permissions request pops up. It is like agreeing to the TOS that no one reads.

I tried to download an alarm clock app on Android. It wanted access to virtually everything. Why do you need so much information for a fucking alarm clock? My analog alarm clock doesn't know my name but it still wakes me up each morning.

Platforms (Facebook, Mobile OS's, Desktop OS's) need to reject apps that request unnecessary permissions.