ALOT of apps are starting to do this. I believe Snapchat initially was the company that began doing it. When a site like Facebook uses your number to identify you, this feature actually makes sense.

I wonder if more fine-grained permissions would make more sense for this sort of feature. Perhaps it would be better if Android had support for "This app may read text messages from 1-800-XXX-XXXX" or something similar instead.

I use XPrivacy (https://play.google.com/store/apps/details?id=biz.bokhorst.x...).

With it, I have extremely fine-grained access control to a wide variety of "system calls", including access to contacts, text messages and to the device phone number.

In this case, I can permit access temporarily during the 2FA, and then return garbage values the rest of the time. Easy. (Though obviously if they harvest my text messages for other purposes during 2FA, that is a problem - but one can that can be technically solved within XPrivacy imo.)

In other cases, such as running Skype, I deny access to everything always (phone number, my location, contacts, Google accounts are the things Skype makes system calls for) and Skype continue to works fine, so I think this is a viable strategy.

since first being introduced to XPrivacy, I absolutely can not use an android phone without it. It really opened my eyes to how invasive some apps are when running in the background or just inappropriately accessing info in general (especially location information!)

It sucks that you have to have a rooted device to use this. While I think Android in general is fantastic, I'm torn but the fact that I am forced to choose between having control of my privacy or being able to use online banking, get regular updates etc.

Google Hangouts just did it to me a few days ago to verify the number on my account, I wasn't expecting it.

I've seen Telegram do this: they send a confirmation code when you sign up and the app reads the text right when it comes in and handles the verification code for you. It's quite convenient. However, if an app can get access to ALL texts just for this feature, I think these texts need to be categorized. It doesn't need access to all my texts, just the ones that THEY sent. Otherwise I'd prefer to enter verification codes (which usually seem to be only 4 digits anyway) myself. But we still can't really decide what an app may and may not access: it's all or nothing. I hope this changes. I do know it's possible to install an application to protect your system afterwards (like LBE Privacy Guard) but that's only a workaround for what I consider to be a problem.

Agreed on the specific permission to read a text from a certain source. This "access to all SMS" sounds crazy - next step is let an app peruse my email inbox I guess? Even though I'm sure that isn't too far fetched with the latest news on email privacy.

"we require that so we can automatically intercept login approvals SMS messages for people that have turned 2-factor authentication for their accounts"

Wait, how does that work?

Doesn't that kind of break 2 form authentication?

If no input is required by the user then it's pointless. If I hack your account and Facebook sends your phone an SMS to authenticate but the Facebook App automatically "intercepts" and reads the SMS message and says "Yup! It's good!" What's the point in sending the SMS message? Think about that for a moment. Why not just send a request to my smart toaster and have my smart toaster just reply "Yup, I got your message!"

Am I missing something?

I believe this is something where Android can provide a better experience by not giving a blanket permission to read all SMS. How about only allow SMS with a pre-defined header to be read by an app.

Or a time-limit, as with Bluetooth. "Read your text messages for the next 5 minutes."