As someone who develops Facebook apps, I think one of the problems is that there is usually a gap between the reason you need to ask for a permission and what a permission enables you to do. For example, if you want the ability to create albums and post pictures on your users' behalf, you have to request permission to read their albums. This seems to surprise most users: "why do they want access to all my photos?" Answer: the developer probably doesn't care about your photos, but they have a feature that posts pictures. The "offline access" permission is often used to get around rate limits, but users think it means an app is harvesting their deepest secrets. Unfortunately, I can't think of a clear solution to this. Finer-grained permissions will probably look even more nefarious (because the list of permissions being requested will be longer in many cases) and be more confusing to the user.

Maybe some additional text under each permission requested, describing what the app needs it for, e.g.:

- "Post to Facebook as me" - we need that to upload your photos created by XYZ. We will not post status updates on your behalf.

- "Access my data all the time" - we use that to...

etc.

I'd personally like to see more developers open about what they're using given permission for. I'm willing to trust them, just if they're a little more transparent.

But if you trust their reasons, you already trust them?

Why would you believe the reasons given if you don't trust the app developer?

For me it would make a difference on borderline cases. If I trust the developer, I don't care about permissions; if I don't trust (or don't like), I won't accept. But sometimes I'm not 100% sure - especially when an app asks for lot of permissions and I have no idea why they would even need them. Then, a plausible explanation could convince me to give those permissions.