Twitter ReceiveSMS permission On Twitter November 25, 2013 update, they ask for receive text messages (SMS) permission.
Does anyone know what exactly this is for ?
I was concerned about this as well and decided to decompile the app to find out what it's doing. Twitter receives SMS messages via a BroadcastReceiver in com.twitter.applib.client.SmsReceiver. Here is what the code looks like after decompiling it to Java with dex2jar and jd-gui.

public class SmsReceiver extends BroadcastReceiver
{
  private void a(Context paramContext, SmsMessage paramSmsMessage)
  {
    if (paramSmsMessage != null)
    {
      String str1 = paramSmsMessage.getMessageBody();
      String str2 = paramContext.getText(mb.sms_verification_text).toString();
      if (("40404".equals(paramSmsMessage.getOriginatingAddress())) &amp;&amp; (str1.startsWith(str2)))
      {
        SharedPreferences localSharedPreferences = PreferenceManager.getDefaultSharedPreferences(paramContext);
        localSharedPreferences.edit().putString("device_registration_sms_text", str1).commit();
        String str3 = localSharedPreferences.getString("device_registration_normalized_phone_number", "");
        if ((!TextUtils.isEmpty(str3)) &amp;&amp; (!TextUtils.isEmpty(str1)))
          a.a(paramContext).c(str3, str1);
      }
    }
  }

  public void onReceive(Context paramContext, Intent paramIntent)
  {
    Bundle localBundle = paramIntent.getExtras();
    if (localBundle != null)
    {
      Object[] arrayOfObject = (Object[])localBundle.get("pdus");
      int i = arrayOfObject.length;
      for (int j = 0; j &lt; i; j++)
        a(paramContext, SmsMessage.createFromPdu((byte[])arrayOfObject[j]));
    }
  }
}


You see see here that when a text message is received, the app passes the message to a() and checks that it comes from twitter's number. Then it writes the content of the message to shared preferences. As Problematic suggested, the app is only verifying your number and not doing anything malicious. Although Twitter isn't doing anything malicious, it would have been nice if they would have explained why the app needs this permission in the last update.