41–50 of 180 posts
Firstly I don't work for O2 but I work in the mobile industry. O2 should only be passing your number to trusted sites (and to get on that list is pretty hard). We have reported it to them via various internal contacts we have. Hopefully they will fix this soon!
Firstly I don't work for O2 but I work in the mobile industry. O2 should only be passing your number to trusted sites (and to get on that list is pretty hard). We have reported it to them via various internal contacts we have. Hopefully they will fix this soon!
Confirmed on a Google Nexus. In his webpage he also says "They downgrade all images and insert a javascript link into the HTML of each page." The image downgrading has been know about for ages, the JS I have not heard about before. I have asked for more info on Twitter but will investigate myself if I can find time today.
http://stackoverflow.com/questions/4113268/how-to-stop-javas...
Besides injecting the bmi.js they also do their own javascript compression. At that time we had our own minified version of jquery, which got corrupted by their compression. They assume that /* always denotes a starting comment. This is wrong for the jquery lib, which contains some strings containing /* to denote mime type patterns. Anyways, we solved those compression issues with cache-control:no-transform. Also gzip compressing the HTTP responses worked.
Firstly I don't work for O2 but I work in the mobile industry. O2 should only be passing your number to trusted sites (and to get on that list is pretty hard). We have reported it to them via various internal contacts we have. Hopefully they will fix this soon!
Can you tell us more about the kind of people who count as a trusted site, how you get on this list, and if this is made public/opt-outable anywhere? (Thanks for reporting!)
In terms of being made public or opt-outable, I'm not aware of any carriers that do this. I guess it depends on which 3rd party sites have negotiated agreements and obtained appropriate opt-ins from you and/or the carrier in various Terms of Agreements. For example, banking sites probably get a free pass when it comes to your mobile number because you may have entered it in to the banking application for verification purposes (just an example).
Isn't this information used as an extra security layer when using your mobile phone for payments or bank transactions? Here in The Netherlands when I want to use my mobile phone to log in to my bank account and do transactions, I first need to confirm my phone number and a special code. I can imagine that then they need the phone number in the header to verify it is my phone. And how is this information different the…
Confirmed on a Google Nexus. In his webpage he also says "They downgrade all images and insert a javascript link into the HTML of each page." The image downgrading has been know about for ages, the JS I have not heard about before. I have asked for more info on Twitter but will investigate myself if I can find time today.
While waiting for an upload, I had a look. This tag is inserted in the head: http://1.2.3.4/bmi-int-js/bmi.js language="javascript"> This is inserted at the end: The external JS is here: http://pastebin.com/rv3k4meX Analysis please. At an initial glance it seems to just be about the image compression.
My quick glace at it agrees with you, it looks like it replaces the URLs of the images, presumably to load compressed versions.
Isn't this information used as an extra security layer when using your mobile phone for payments or bank transactions? Here in The Netherlands when I want to use my mobile phone to log in to my bank account and do transactions, I first need to confirm my phone number and a special code. I can imagine that then they need the phone number in the header to verify it is my phone. And how is this information different the…
Headers are too easily spoofed to carry security information without a signature.