I would love to see permissions in apps etc justified in descriptions more frequently. Some do it, but by no means all. Most are probably innocuous, and although a description doesn't prove a thing, it's a step in the right direction before full code analysis is feasible. In the meantime it means idiots will still accuse apps of wrongdoing - e.g. the fool reviewer who thought a completely reasonably-permissioned (not even any ads) flashlight app was taking photos on the sly, rather than because, duh, the LED is part of the camera module. On the other hand, suspicion is not surprising given the number of apps demanding e.g. location in order to do something completely unconnected.
Re: Permissions should be granular...
That I understand, permissions are already granular for iOS and recent versions of Android.
However, I don't think they handle short-term case-by-case permissions, like "you can use the microphone just for shooting this video right now, and you lose the permission immediately after". Which means that any QR code app is technically allowed to take a picture at any time whenever they want.
Not that Facebook is the only one to do this but:
We only access your microphone if you have given our app permission
Which most users accept without blinking (and not long ago couldn't even refuse if they wanted to use the app at all).
and if you are actively using a specific feature that requires audio. This might include recording a video or using an optional feature we introduced two years ago to include music or other audio in your status updates.
Note how these explanations, here and in T&C's, always say "This might include…"; they never contain an exhaustive list. Because that would mean they cannot add anything in the future without making an announcement about changing their T&C's, which they want to avoid because it just attracts attention to the matter, and gets them in trouble with regulators.
So they leave all options open. They say what they might do, they give examples, but they never say "we will not do this", because that's painting themselves in a corner.
For the record, I don't even think that Facebook is really listening. I'm just pointing out that their statement is completely vacuous, out of abundance of care.
Me and my brother were sitting in the garden and he was talking about a very random type of part to do with his car that he needed. His Android phone was sat on the table. I asked him if he'd googled to try and find this part online and he said he hadn't yet, but he would look later. We had our lunch then he checked his phone and low and behold he magically had an advert for exactly what he was after. The odds of it being a coincidence were extremely high and neither of us could believe it. Maybe it was a huge coincidence maybe he had googled it and they somehow got a cookie with the info. Safe to say he no longer has the facebook app installed....