I've seen Telegram do this: they send a confirmation code when you sign up and the app reads the text right when it comes in and handles the verification code for you. It's quite convenient. However, if an app can get access to ALL texts just for this feature, I think these texts need to be categorized. It doesn't need access to all my texts, just the ones that THEY sent. Otherwise I'd prefer to enter verification codes (which usually seem to be only 4 digits anyway) myself. But we still can't really decide what an app may and may not access: it's all or nothing. I hope this changes. I do know it's possible to install an application to protect your system afterwards (like LBE Privacy Guard) but that's only a workaround for what I consider to be a problem.