As developers , haven’t we settled that the endless permission dialog boxes are a security risk and not a solution?
I'm not suggesting adding more permission dialog boxes. The way I see it is more along the lines of what Google does with Android: anything that would return a unique identifier (IMEI, serial number, Android ID, MAC addresses) returns either random data or zeros. And, crucially, it needs to be such that the app can't know whether it's getting real or fake data.
> but the real problem boils down to services being able to mandate what client you use
The underlying problem is that these threats to third-party client developers have teeth. The US government would happily enforce them it seems, paid for by people's taxes. In a saner world, a Facebook lawyer trying to sue someone who built a better Facebook app would be laughed out of the court building.