How a couple of simple permissions let an application steal passwords, log user actions, and do many other nasty things.