Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UK network o2 send your number to every site you visit

lew.io

Post reply on HN
Print view View original

51–60 of 180 posts

Re: UK network o2 send your number to every site you visit

#51

Post by otoburb »

naz wrote: post #43
cornet wrote: post #39

Firstly I don't work for O2 but I work in the mobile industry. O2 should only be passing your number to trusted sites (and to get on that list is pretty hard). We have reported it to them via various internal contacts we have. Hopefully they will fix this soon!

No site served over unencrypted HTTP can be considered trusted. So there's no circumstance under which they should insert this header, since they can't modify HTTPS requests.

Consider the circumstance where a carrier portal sits on subnets owned by the carrier. In this case, unencrypted HTTP requests to the portal originating from the carrier's proxy are usually considered trusted.

In such a circumstance, carriers may consider this "trusted".

Re: UK network o2 send your number to every site you visit

#52

Post by rmc »

jarofgreen wrote: post #14
MrKurtHaeusler wrote: post #7

Just tested on o2 Germany, and no such header was inserted. It would probably be illegal here anyway.

I would sodding hope it's illegal in the UK to! Altho as IANAL I can't think of which law exactly would cover it. Anyone know? I'm envious, you Germans have great privacy laws.

you Germans have great privacy laws.

A lot of these laws are from EU Directives, which the UK would have implemented aswell. Brussles isn't all bad! :P

Re: UK network o2 send your number to every site you visit

#53

Post by chitabox »

wgx wrote: post #2

Tried it on my iPhone using o2's network and my number was indeed inserted into the headers.

Confirmed with Samsung S2, Additionally, x-wap-profile provides phone model (GT-I9100)

Additionally, confirmed on HTC HD2 on Tesco Mobile - Custom ROM (ICS 4.03), thinks its a Nexus HD2 - Stock browser display phone number, Dolphin Mini also displays number!

Re: UK network o2 send your number to every site you visit

#56

Post by alexchamberlain »

mooism2 wrote: post #49
alexchamberlain wrote: post #26

Earlier quoted context omitted.

Headers are too easily spoofed to carry security information without a signature.

It's like security through obscurity: on its own it's inadequate, but as an extra layer it can be helpful.

How is this helpful? We have proved it's inconsistent... Do you check IP addresses for security too?

Re: UK network o2 send your number to every site you visit

#60

Post by iamichi »

msmithstubbs wrote: post #18
edandersen wrote: post #15

You should be able to bypass the proxy that inserts the HTTP headers with the following APN on O2: apn: mobile.o2.co.uk username: bypass password: password Worked in 2008 when I tried it ( http://www.edandersen.com/2008/07/13/iphone-o2-fix-the-image... ) as they used to screw with images on the App Store. I don't have access to O2 anymore, can someone try this and see if it still works? Edit: It still includes your p…

Just tried it. The phone number header is still being included.

Same for me.
Post reply on HN