Access my basic information: OK
Send me email: OK
Post to my Wall: No. Why do you need to post to my wall? To spam my friends? Do you have a better reason?
Access posts in my News Feed: No. There's private stuff in there which you don't need.
Access my data any time: No. I like the idea of my auth-token only lasting an hour. It limits the damage you can do.
What would work for me is to be asked at the time if I want to grant a permission (e.g. "Share this on my wall" triggers a Facebook alert the first time). I realise that this is extra work and there's a chance most users will agree to the initial screen without comment, but it's stopped me from going any further.
Posting is required for sharing.
Access data at any time allows you to stay connected so you don't have to sign in with facebook every time you go to the site.
I thought you could do it all via the Open Graph API /links/ feed? Or am I missing something? :)
1. You don't need access to my newsfeed to grab PUBLIC posts to my newsfeed, only private ones.
2. Posting is NOT required for sharing, only for "sharing" without the user's explicit permission. You can always use stream.publish, show a FB lightbox and share. Or user share.php.
3. You don't need to "login to FB every time you go to the site". An app can re-up the access token if there is a logged in Facebook account. If there isn't, you can ask the user to login. Again, this is typically used to pull data when you're not logged into FB at all.
Shady.
A popup detracts from the user experience.