FB 2 factor auth works with TOTP. There is a code generator in our app, and you can set it up with Google Authenticator or other TOTP implementations.
However, there are people in the world that don't know much about computers, don't own a desktop, and their smartphone is the only general computing device they have. Throw in that mix the issue that quite a lot of these people have a low end device, where they can't install every and all apps they want. There are phones (one of them on my desk) where installing Facebook, WhatsApp, Messenger, and Hangouts pretty much maxes out the device memory. You can't afford a dedicated authenticator app.
At the same time, there are a lot of people that like to logout explicitly from their Facebook app before they close it.
So, no dedicated TOTP. No second device. Logged out, so can't use the built in code generator. What's your option for still using 2 factor auth for security, but making it as easy as possible for the legitimate account owner on their primary device, because said owner might know jack about computers?
I work at Facebook, more specifically, I've spent a considerable chunk of my time working on our Android app and the Android permissions we request. (I also worked on that same area before I joined Facebook)
These permissions were actually added several months ago, long before the WhatsApp deal was announced. There's no connection.
I want to correct some of the misrepresentations in the article.
The WRITE_CALENDAR permission: As many app developers will know, this permission is needed by any application that wants to create a calendar feed in the unified Android calendar storage, and create/modify events in it. In particular, the Facebook app would like to give you the option to import your Facebook events so that you can see them side-by-side with your other calendars like Google Calendar, corporate Exchange accounts and so on. We don't need to be able to send event invites or updates to attendees by email, but we can't divide the pre-set Android permission into any smaller pieces.
We use the READ_SMS permission to automatically read SMS codes from people who have turned on 2-factor authentication (called Login Approvals) for their accounts, or for phone confirmation messages when you add a phone number to your Facebook account. Unfortunately, the Android permissions system doesn't allow us to specify that we would like to be able to read only SMS messages from a specific number—the one we use to send these codes.
In general, we would love to be able to ask only for the permissions we need for the specific features we expect people to use. However, Android doesn't allow permission requests on demand; we have to request all permissions that cover each feature at install time, and people must choose to accept or deny all of them at once.
If you have specific questions about other permissions that our app requires, don't hesitate to ask, and I'll do my best to explain how they're used. We also have an official Help Center page that covers a lot of this material at https://www.facebook.com/help/210676372433246.
However, there are people in the world that don't know much about computers, don't own a desktop, and their smartphone is the only general computing device they have. Throw in that mix the issue that quite a lot of these people have a low end device, where they can't install every and all apps they want. There are phones (one of them on my desk) where installing Facebook, WhatsApp, Messenger, and Hangouts pretty much maxes out the device memory. You can't afford a dedicated authenticator app.
At the same time, there are a lot of people that like to logout explicitly from their Facebook app before they close it.
So, no dedicated TOTP. No second device. Logged out, so can't use the built in code generator. What's your option for still using 2 factor auth for security, but making it as easy as possible for the legitimate account owner on their primary device, because said owner might know jack about computers?