825644 - Facebook app for importing contact details asks for scary permissions

Status: RESOLVED DUPLICATE of bug 805240

(Firefox OS Graveyard :: Gaia::First Time Experience, defect)

Description

[Josh Matthews [:jdm]]

An app that's going to import my friends' contact details shouldn't need to post things on my behalf, or do a large number of other things that it claims to need to be able to do.

Comment 1

[Joe Cheng [:jcheng] (please needinfo)]

Triage: can you list out the permissions being asked for?

Comment 2

[Josh Matthews [:jdm]]

Using this app requires:
* Your basic info
* Your email address
* Your profile info: description, activities, birthday, education history, groups, hometown, interests, likes, location, relationship status, relationship details, religious and political views, website and work history
* Your stories: checkins, events, notes, photos, status updates and videos
* Friends' profile info: descriptions, activities, birthdays, education histories, groups, hometowns, interests, likes, locations, relationship statuses, relationship details, religious and political views, websites and work histories
* Stories shared with you: checkins, events, notes, photos, status updates and videos
* Access to post on your behalf
* Access to messages in your inbox
* Access to posts in your News Feed
* Permission to access your data when you're offline
* Permission to publish check-ins on your behalf

Comment 3

[Beatriz Rodríguez [:brg]]

Jose Manuel, could you please clarify if this is normal behaviour? Thanks

Comment 4

[Dylan Oliver [:doliver]]

The facebook integration does more than import the contacts -- if you go back into a contact's details after the import, you can access some direct FB functionality there including creating posts and messages. 

Duping to bug 805240.

Comment 5

[Jose Manuel Cantera]

yes, but the permissions prompted are more than those really necessary. As it was reported in bug 805240 this has to be fixed by Facebook. It was requested weeks ago but Facebook has not fixed it yet.