Initially we had a 2-step process: ask for email permissions only during signup, and for post permissions later when you actually wanted to share something. Unfortunately this confused our users even more - they didn't understand why they had to FB-auth twice. I guess that many don't actually read the list of permissions (although a short list is better than a long list).