[kunjanshah]

The best way to prevent this in this app, and many other apps is to use "App Ops" in 4.4 or use CyanogenMod and enable privacy guard and then you can long press on the app and prevent the app from reading SMS and many other things while you are at it.

[hamburglar]

I wish Google would recognize that it would be beneficial to protect users from this kind of thing by providing a decent management UI that didn't require using CM. Of course, that goes against some of Google's own interests...

[mrb]

App Ops was removed in 4.4.2. It had been accidentally added to 4.3: http://www.engadget.com/2013/12/13/google-removes-apps-ops-p...

App Ops was not an ideal solution anyway. A specific permission couldn't be disabled until after the app used the permission at least once. So the Facebook app could read your SMS when launched, and only then you would be able to disable the permission.