People having problems with Facebook updating

[Kelly Kearns]

I heard from Samsung. The issue is being further escalated. They have ever very good notes on my ticket. The rep said that everyone having this problem needs to call Samsung.

You can tell them a ticket has been escalated, they can't give you info from my ticket, but they can do a ticket for you and reference my ticket for their department handling this. The more tickets filed, the more attention this will get at Samsung.

If you are calling a Samsung outside of the US, be sure and tell the rep, the ticket number is a Samsung USA ticket number.

Here is the ticket number to tell the rep to reference. Tell them you do not want info, but you are having the same issue and you got this info off Android Central forums.

Ticket number: 2135760316

 

[anon(8413510)]

And the problem is?

Posted via the Android Central App

 

[Kelly Kearns]

And the problem is?

Posted via the Android Central App

Facebook is updating outside of the Play Store and through the app and forcing updates.

It is basically bypassing all security and downloading and installing on the phone. It happens with the pre-installed version only.

 

[anon(8413510)]

Disable it

Posted via the Android Central App

 

[Kelly Kearns]

Can't do that, I use it.

That isn't the big issue though. If Facebook can bypass security and download and install without permission, anyone else that creates an app can also.

This is a security risk at this point.

 

[eljeffe58]

I saw this happen on my Edge phone. I was like wth! I will call and report it.

 

[anon(8413510)]

I have no knowledge of Facebook (non user) but for the time being cant you disable the app and just use your browser?

Posted via the Android Central App

 

[Kelly Kearns]

I have no knowledge of Facebook (non user) but for the time being cant you disable the app and just use your browser?

Posted via the Android Central App

I need the push notifications.

It being Facebook is not the big issue. The issue is someone can download and install on my device. Who it is doesn't matter.

I can't even connect my device to my work network now because my device can be accessed without my permission.

 

[Kelly Kearns]

I saw this happen on my Edge phone. I was like wth! I will call and report it.

Please do and be sure and share this. I had it update when I just got my phone, no Google account or Samsung account logged into and I was downloading Lollipop.

I found a way to stop my updates then. I don't know if it will work for you. I only tried it when nothing had been downloaded or set up on my phone.

There is a Facebook thread just a few below this one (I updated it a few minutes ago) and I posted instructions the other day for how I was able to stop it.

 

[anon(8413510)]

Back door instalation doesn't sound good, now I understand your concern

Posted via the Android Central App

 

[Kelly Kearns]

Back door instalation doesn't sound good, now I understand your concern

Posted via the Android Central App

Yup.. That is the big issue.

 

[Kelly Kearns]

I don't have a dog in this fight (no Facebook account), but I feel compelled to be Captain Obvious here. If they (Facebook) have no qualms about circumventing the PlayStore with a backdoor update to their app, how can you even trust them with ANY of your info you provide them? IMHO, this is just icing on the already rotten cake. Point being, if you value your privacy don't just push back on this, but on using Facebook at all!!! I know it's a throwing out the baby with the bathwater so to speak, but in this case both are needed. Otherwise why bother?

Well I give them very little info but I don't like they have this access now.

I am concerned that they are doing this, someone else will create a free app that people love, just for the purpose of getting access. I don't want to have to cancel cards because they were compromised.

Also Samsung needs to fix this, no one should be allowed to download and install like this on our phones now. This is the an old Galaxy S with no security..

 

[natehoy]

I am concerned that they are doing this, someone else will create a free app that people love, just for the purpose of getting access. I don't want to have to cancel cards because they were compromised.

Also Samsung needs to fix this, no one should be allowed to download and install like this on our phones now. This is the an old Galaxy S with no security..

One of the permissions in the Android security model is "download files without notification". Facebook has inserted that permission into their app. The unfortunate thing about preinstalled apps is that you never see the security settings that come up unless the app author asks for MORE permissions, and the preinstalled Facebook app already has this permission on the Note 4.

With this control, Facebook can install anything they want in the app space on your phone. Even if you never set up a Facebook account. The code can run resident any time it damned well pleases, and you're toast. If the app is disabled ("turned off" in Samsung parlance), it is not capable of running at all on your phone. The code is dormant, and cannot download anything.

If you really need Facebook notifications, the best thing I can suggest is to create a throwaway email address and set your Facebook settings to email that address when a notification comes in - then you can add that email address to your phone and customize notifications for it. Or you can have Facebook SMS you your notifications if you don't mind FB having your phone number. Then use the mobile web site for any actual interaction with Facebook.

What Samsung needs to do is to remove the pre-installed Facebook app. They can't really do much about the fact that it requires this permission if a user opts to install it themselves - I'm not even sure what would happen to the functionality of apps if the OS doesn't support a permission it is demanding.

I suppose Sammy could drop in a "notify user and ask for confirmation if app is asking to download without notification" clause in the code. If Samsung added that to the code, and started firewalling excessive permissions like that, I'd be a Samsung customer for life.

 

[Kelly Kearns]

One of the permissions in the Android security model is "download files without notification". Facebook has inserted that permission into their app. The unfortunate thing about preinstalled apps is that you never see the security settings that come up unless the app author asks for MORE permissions, and the preinstalled Facebook app already has this permission on the Note 4.

With this control, Facebook can install anything they want in the app space on your phone. Even if you never set up a Facebook account. The code can run resident any time it damned well pleases, and you're toast. If the app is disabled ("turned off" in Samsung parlance), it is not capable of running at all on your phone. The code is dormant, and cannot download anything.

If you really need Facebook notifications, the best thing I can suggest is to create a throwaway email address and set your Facebook settings to email that address when a notification comes in - then you can add that email address to your phone and customize notifications for it. Or you can have Facebook SMS you your notifications if you don't mind FB having your phone number. Then use the mobile web site for any actual interaction with Facebook.

What Samsung needs to do is to remove the pre-installed Facebook app. They can't really do much about the fact that it requires this permission if a user opts to install it themselves - I'm not even sure what would happen to the functionality of apps if the OS doesn't support a permission it is demanding.

I suppose Sammy could drop in a "notify user and ask for confirmation if app is asking to download without notification" clause in the code. If Samsung added that to the code, and started firewalling excessive permissions like that, I'd be a Samsung customer for life.

I got mine stopped, I caught what was allowing it and was able to disable those files.

I have never had any app update outside of the Play Store. It is against the contract the developer has with Google to update outside of the Play Store.

 

[mrcil20]

Something happened... Did not change anything, I just went in Google play and I have a Facebook update pending! No auto install on that one. I don't know if it's because of you Kelly but if it is, big thanks to you.
I won't touch it to see what will happen.

 

[Kelly Kearns]

Something happened... Did not change anything, I just went in Google play and I have a Facebook update pending! No auto install on that one. I don't know if it's because of you Kelly but if it is, big thanks to you.
I won't touch it to see what will happen.

Well it never comes from the Play Store for me, just through the app and has a Facebook notification of the update, not a Play Store notification, like this one with their logo.

 

[mrcil20]

My two last updates was like that. But not today... It was updating by itself without my consent before.

 

[Kelly Kearns]

Did you find the files and disable them?

 

[mrcil20]

I did absolutely nothing.

 

[Kelly Kearns]

Oh.. You might want to try this. See if you can find these two files in downloaded in the app manager. They look like files but are apps and allow the update. Click on them, force stop, uninstall updates, clear data and the doable them. Some people can't disable them, I could. It stopped the updates.