I remember working on integrating facebook with an app I was working on several years ago. It was in the pre-M days, so Android was still using the old install time permission system.
As soon as facebook would be installed without even running the app, it would access the contact database and do network operations (very probably uploads .. ).
For this reasons, well among many others, I never installed the facebook app on one of my personal devices at the time.
In their credit, when M arrived, they have updated their app pretty quickly to the new permission model.
Still, I try to be as conservative as possible with critical permissions.
The only one I regret is whatsapp now that facebook owns them.
This is an issue for other messaging clients as well, having the "Sync contacts" enabled by default. So by the time you get in the settings to disable, your contacts might on a server already.
Yeah, it always made me frown when at the time people were using the hidden API to remove permissions manually after install .. (and complain when Google removed that testing tool before shipping proper incremental permissions in the next release). That's just not how it works.
Thankfully now that permissions are incremental, this issue is solved.
Except some apps still target an old API in order to keep install time permissions .. like SnapChat.
This will soon no longer be possible since Google will force apps to target the last API level.
Still, people don't seem to realize what giving an app access to 'contacts' or 'SMS' means.
As soon as facebook would be installed without even running the app, it would access the contact database and do network operations (very probably uploads .. ).
For this reasons, well among many others, I never installed the facebook app on one of my personal devices at the time.
In their credit, when M arrived, they have updated their app pretty quickly to the new permission model.
Still, I try to be as conservative as possible with critical permissions.
The only one I regret is whatsapp now that facebook owns them.