While I applaud any attempt to gather real and first-person observations...

> I don't see any evidence of any mic uploads.

... I am somewhat concerned at what seems to be a common assumption that Facebook (or any other remote server) is sending the same software to everybody. I find that unlikely when "AB testing" and similar practices are are commonly used. Facebook is very strongly involved with "targeted" services which suggests they are more likely than most to send different versions to different audiences. Obviously that isn't proof, but it's a good reason to extrapolating from a single example.

Version numbers and hashes of the installer or binaries from all parties would help a lot.

> I encourage those curious to try it and see for themselves

That's always good advice.

If we're talking about mobile apps, it seems more likely that they would send the same software to everyone and just turn on these features being tested by sending some activation signal from a central coordinating service, or perhaps including it in some web content that the app might use. That seems much easier than actually distributing different apps.

> more likely

My point is that guessing without actual data isn't evidence. It's easy to speculate and guess at what we think is going on, but it's a bad idea to assume any particular speculation is right in the best situations. It's foolish when the subject of the investigation's core business model is based on sending different things to specifically targeted groups.

> just turn on these features

Perhaps. There are many ways a feature like this could be implemented. See the various obfuscated code contests for extreme examples of how functionality can be hidden in a program. This just means network logs from different clients are also needed, in addition to hashes of binaries.

How would you know if it is tunneling out the data, concealed as any other kind of traffic, and at some future point after recording?

I am pretty sure it would be undetectable if done right, given no access to the source code of the multiple Facebook components running on your device (some pre-installed by the manufacturer and unremoveable).

This would make an interesting blog post.

Thanks. I don't keep a blog anymore or I'd do it. They have also recently denied doing this: http://www.businessinsider.com/is-facebooks-app-spying-on-me... so if anyone can show evidence otherwise, it would likely be A Big Deal.

EDIT: Sounds like they might pin certs on newer versions of the iOS app. https://github.com/Naituw/HackingFacebook might be useful to get around that. I haven't tried it.