Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

So they just uploaded everything, "just in case"? Your description doesn't sound any better than the article's.


No, I think the parent comment is making the distinction that the Android permissions model at the time wasn't very granular, so Facebook's app had to request more permissions than it intended to use, and that FB offered a separate opt-in within their own app.

I don't use the FB app, and I have no idea how this was presented to users and whether it was a legitimate choice or a "dark pattern" to trick users into handing over everything.


Pretty much, though the problem isn't that the permissions weren't granular - reading the call log has been its own permission since Android 4.1, and apps targetting that version have to request it separately even if they support older versions - but that there simply wasn't any way for users to grant only some permissions. So Facebook had to request all the permissions they might want to use from every single user, regardless of whether those users ever opted into the features that required them.

The first official version of Android that allowed users to turn individual permissions off was Marshmallow, released in October 2015 with the first beta in May 2015 - the email in question is dated the start of February 2015 and says they planned to ship it by the end of the month.


And FB's platform permission stuff itself was not very granular for a long time - still might not be.

Years ago, building basic 'login with facebook' things for apps, the minimum my app could do was to have access to your email, name, and your friends list. Whether the friends list was used or wanted or not, it was always part of basic permission requests.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: