Permissions asked for by Uber Android app
<i>TLDR</i>: Uber's Android app is literally malware<p>Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your:<p>- <i>SMS list</i> [edit: see other comments re SMSLog, SMS permission is not currently requested] 
- call history
- wifi connections
- GPS location
- every type of device fingerprint possible (device IDs)<p>It also checks if you're phone is rooted/jailbroken and if it's vulnerable to Heartbleed... which it also calls home.<p>From my understanding, which the author somehow missed, is that it is using <a href="http://www.inauth.com" rel="nofollow">http://www.inauth.com</a> SDK which provides 'malware detection'. This SDK is popular in the 'mobile finance industry' and the banking sector. Also notably one of the founders is former DHS/FBI.<p>Two possible theories: it is being used for fraud detection and/or an intelligence gathering tool.<p>Edit: here is a copy of the decompiled source code <a href="http://www.gironsec.com/blog/wp-content/uploads/2014/11/InAuthManager.txt" rel="nofollow">http://www.gironsec.com/blog/wp-content/uploads/2014/11/InAu...</a> note the name "package com.inauth.mme"<p>Edit #2: here is a screenshot of Uber's permission request <a href="https://i.imgur.com/4MmYrJH.png" rel="nofollow">https://i.imgur.com/4MmYrJH.png</a> no SMS on the list