Hacker News Reader

Comment by tjr | Hacker News Reader

When you install the Facebook app on your phone it requires permission to read your contacts, call log, location, accounts, and application data.

Is this true?

View on HN

Good thing deleting the pre-installed Facebook application (if it's ever been used at all it was inadvertently) off of my Android phone is quick and easy, and doesn't require root access!

EDIT: This is why we need sarcasm tags. No, I have not actually been able to remove my Facebook application.

How? Sony Ericsson Xperia Arc S, ICS, locked to my carrier, unrootable. I've been wanting to get rid of it ever since the phone started running out of space all the time, app info gives no option to remove it. Is this a case of my manufacturer/carrier are more annoying than yours, or am I really missing something?

I was being sarcastic. I'll probably never rid myself of the damn thing.

Dammit, it's really easy on my rooted Touchpad, but this thing's horrible for it. It'd be fine if it had storage space, but nope.

You can "disable" it through the Applications menu under Settings.

I had to uninstall updates (the option where disable normally is), and then I could go and disable it, weird. Thanks though, disabled and uses about 1/6 of the space of the updated one :)

Excellent. :) It's not the best solution, the best solution would be the ability to uninstall it completely, but it's better than nothing.

I was able to root my Arc S (but UK model/unlocked). I seem to recall using this method, but would need look on my PC for the files i used to verify... http://theunlockr.com/2012/10/09/how-to-root-the-sony-xperia...

I always have a chuckle when Android users say it's open source and free. iPhone is worse, of course, but still. We all really need an actual FOSS phone that is liberated from the carriers. Maybe Canonical's (modulo Amazon results when searching contacts).

I jumped for joy when my new phone didn't come with preinstalled facebook!

Yes, but this shouldn't come as a shocker to anyone that uses Facebook and Android. You can arrange to have contacts synced in Android so that you can see updates / photos / phone numbers merged with your Google contacts. NSA access notwithstanding, Facebook is in the business of making it easier to interact and socialize with people.

Alternatively, you can use the app "Tinfoil" for Facebook, which is essentially a locked-down web browser that provides a watered down Facebook experience.

First thing to do on an Android is to go under settings/apps/All and disable the privacy parasites such as the facebook apps(4) and google+.

But aren't you doing this AFTER you install the app? Which defies the purpose because by the time you turn it off, all your data is transferred.

You could do it after you install the app but before you login/use it.

Some OEMs include Facebook in their system image.

Anyone knows if the preinstalled FB application sends anything to FB even if you've never used it?

If you are disabling the app in the Applications menu in Settings, the process for that app will not be able launch while disabled, so FB won't be able to collect anything.

Theoretically it could, definitely. I don't know if anyone's done the packet sniffing for it.

Even better, it updates your contact book email addresses to facebook domain ones.

They had to do that for national security purposes, and you know, the children. </sarc>

And yeah, that was very sad. http://news.cnet.com/8301-1023_3-57464415-93/facebook-e-mail...

I never sync Facebook/my contacts, but I do wonder if they steal this info anyway... most likely is my guess, but that's just me being a cynic.

yes, the facebook android app requires about 20 other permissions

on Android, yes

I use iOS, and don't use Facebook, but you can't selectively disallow Facebook access to things like the address book? It's all or nothing?

The lack of fine-grained permissions per app is Android's fault, not Facebook's (not that they aren't benefiting).

Android application manifests means that if even just one user of your app might want to use a feature that requires elevated permissions, your entire app must be given these permissions for all users at installation time.

Which is obviously a huge security issue. What if I want to use the Facebook app but deny it permission to my address book? Not possible out of the box.

E.g. There's a feature to see if any of your phone contacts already have Facebook accounts. To service the potential people that wants this feature to work so they can easily "friend" these people on Facebook, the app must have this permission for everyone who installs it.

Thanks for the reply. I appreciate the info.

It's all or nothing, that's correct. Either you install it and accept it's access conditions or don't install it. A popular mod for Android (CyanogenMod) has an extension to the OS that has a toggle button to block any elected app from accessing personally identifiable information, this includes sending the app (say Facebook) an empty address book when asked, and fake details like IMEI, GPS location etc. It should be part of every mobile OS in my opinion. A feature I'm scared to live without.

I love that feature the most. Every phone and computer should have a feature like that. And permissions should be fine-grained and it should be possible to turn them off.

Yeah I wish desktop OS' had this feature. I suppose we'll be heading there. The ability to not deny but send a blank list is better than the former too. Do you know if CM is doing fine grained? I suppose it would be better of AOSP themselves did it.

It no longer asks for these things on iOS?

iOS doesn't allow access to most of the items listed.

Others are prompt-based and can be disabled/prevented by the user in the iOS privacy settings.

http://0.tqn.com/d/ipod/1/0/S/O/-/-/ios-6-privacy.jpg

Yes

Reply on news.ycombinator.com