Facebook’s Android app now wants to read your SMS, warns Kaspersky

The world’s largest social network Facebook wants to read SMSes and other confidential information of users on Android, cyber-security firm Kaspersky said on Monday.

“Over the last few days there has been a constant scrutiny over Facebook having access to your SMS. Buried within the latest update for Facebook’s Android app is a feature that is causing growing concern among some users,” Kaspersky said in a statement today. The social media’s logic behind seeking access to SMS is that if you add a phone number to your account, this allows them to confirm your the number automatically by finding the confirmation code within a text message. This is the same technique used by various apps, including Whatsapp to verify your phone number at the time of installation.

The updated Facebook application now wants to read calendar events plus confidential information which it justifies as it is required to allow the app to show your calendar availability (based on your phone’s calendar) when you’re viewing an event on Facebook.  “Two-factor authentication provides an extra level of security, so it’s good to see Facebook providing this option … As a final note, we’d urge people to carefully check the permissions requested by any app when you first install it,” Kaspersky Lab’s Principal Security Researcher David Emm said. Kaspersky added the permissions also grants access to multimedia messages, for which reason is not explicitly given.

It expressed apprehension on the word ‘automatic’ used in the permission sought by Facebook. “The key, it seems to lie in the word ‘automatically’. Surely the app doesn’t need to do this automatically. Facebook could simply prompt me to type in the code manually. Or, at the very least, provide this option,” Kaspersky said.

 

It added that this may be an innocent feature but in the light of growing concerns about online privacy, such an option would help to allay people’s fears. It must be noted that just because Facebook has the permission to read your SMSes, it does not mean that all SMSes will be under the purview of the app. The social media company on its website said: “Keep in mind that Android controls the way the permissions are named, and the way they’re named doesn’t necessarily reflect the way the Facebook app uses them. We realise that some of these permissions sound scary, so we’d like to provide more info about how we use them.”

 

On the issue of permission sought by Android to access information and edit feature in user’s phone, Google has earlier said, “It’s an app which you (user) have a choice of installing.”