QuizUp had legitimate user info needed to manage the game (you need a person's FB account and/or email to contact and identify them), the problem is they were transmitting it unencrypted. So permissions didn't make a difference there.