> This screen in the Messenger application offers to conveniently track all your calls and messages. But Facebook was already doing this surreptitiously on some Android devices until October 2017, exploiting the way an older Android API handled permissions.
read your text messages (SMS or MMS)
read call log
"It'd be too risky to their business for them to do something like that!"
"Someone would have leaked the secret by now!"
"There's no way a company that big could get by doing something that blatant!"
I think people just don't like uncomfortable truths, even when staring them in the face.
I think most people would be surprised if they discovered that apps were uploading their emails. And photos. And tax documents. Just because they happened to be on the hard drive, and there were no permissions to prevent it.
Expecting FB to not do similar and respect basic privacy by default is reasonable. FB doing such things just because they can is not.
It says read, not steal and keep in their own servers.
On mobile, suddenly, it's: lol, you gave it away!
That makes little sense. Yes, we should have better sandboxes - but we still have very few (none) usable general operating systems with Internet access that are "secure beyond trust".
Absurdly, I'd be more confident in a typical Debian install with thousands of programs from "main", some running in the kernel - than a typical Android device.
Because of presumed incentives for the volunteers/employees working on debian and the various upstream projects.
This is 99% about trust and incentives and 1% about capabilities.