Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UK network o2 send your number to every site you visit

lew.io

Post reply on HN
Print view View original

61–70 of 180 posts

Re: UK network o2 send your number to every site you visit

#61

Post by naz »

otoburb wrote: post #51
naz wrote: post #43

Earlier quoted context omitted.

No site served over unencrypted HTTP can be considered trusted. So there's no circumstance under which they should insert this header, since they can't modify HTTPS requests.

Consider the circumstance where a carrier portal sits on subnets owned by the carrier. In this case, unencrypted HTTP requests to the portal originating from the carrier's proxy are usually considered trusted. In such a circumstance, carriers may consider this "trusted".

That's true. I imagine they'll be considering some third-party sites trusted too.

Re: UK network o2 send your number to every site you visit

#62

Post by ntmartin »

Leynos wrote: post #31

Using Opera Mini seems to disable this "feature". Of course, doing so means all of my web traffic goes via Oslo. And of course, any apps using an http API are presumably affected too. I'm rather disappointed to hear about this.

+1 the header is gone via Opera Mini and their proxy. Leaving O2 after this, definitely not cool.

Re: UK network o2 send your number to every site you visit

#63

Post by jarofgreen »

otoburb wrote: post #45
jarofgreen wrote: post #41

Earlier quoted context omitted.

Can you tell us more about the kind of people who count as a trusted site, how you get on this list, and if this is made public/opt-outable anywhere? (Thanks for reporting!)

The criteria varies per carrier. In most cases, a trusted site is one run or owned by the carrier (e.g. carrier portal site). Getting on this list usually (from what I understand) requires a whole lot of paperwork and approvals. In terms of being made public or opt-outable, I'm not aware of any carriers that do this. I guess it depends on which 3rd party sites have negotiated agreements and obtained appropriate opt-i…

It's the 3rd party sites I'm more interested in - I can see that carriers may want it as a security function for internal websites and as they already have your number and all your details anyway, it's not really an issue then.

For instance with your banking example, yes, I may have given my number and probably have if I'm a customer. But what if I'm just browsing a banks website thinking about opening an account? Should they have my number then? (but of course banks are unlikely to abuse this for spam or anything.)

But can you see how people would think this is a grey area with potential for abuse? So basically, we just have to trust our carriers not to sell us out with no way of checking up on them?

Re: UK network o2 send your number to every site you visit

#64

Post by cubicle67 »

jarofgreen wrote: post #6
jarofgreen wrote: post #3

Confirmed on a Google Nexus. In his webpage he also says "They downgrade all images and insert a javascript link into the HTML of each page." The image downgrading has been know about for ages, the JS I have not heard about before. I have asked for more info on Twitter but will investigate myself if I can find time today.

https://twitter.com/#!/O2/status/161872584634408960 says "@lewispeckover Hi Lewis. The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru" As Lewis replies, "@O2 User-agent header ID's the device. Passing mobile number to third party sites is not ok! Seems like a data protection act breach to me?" Being charitable, that could be clueless support rather than…

The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru"

...and for people using iPod Touches or similar?

Re: UK network o2 send your number to every site you visit

#69

Post by jarofgreen »

rmc wrote: post #52
jarofgreen wrote: post #14

Earlier quoted context omitted.

I would sodding hope it's illegal in the UK to! Altho as IANAL I can't think of which law exactly would cover it. Anyone know? I'm envious, you Germans have great privacy laws.

you Germans have great privacy laws. A lot of these laws are from EU Directives, which the UK would have implemented aswell. Brussles isn't all bad! :P

You mean "should have implemented". It's left to member countries to make the laws to match the directives, and if the EU thinks the law doesn't match the directive it's a very long legal process to sort it out.

The example in the UK I can think about is the detention in prison without trial for terrorism case. When the European court said "Ah, no." they scrapped it. And instead brought in house arrest without trial. Cue another long legal process.

But yes, I agree the EU has some great bits :-)

(Again, IANAL, and I worry I'm confusing the EU, European Commission and European court here ...)

Re: UK network o2 send your number to every site you visit

#70

Post by otoburb »

jarofgreen wrote: post #63
otoburb wrote: post #45

Earlier quoted context omitted.

The criteria varies per carrier. In most cases, a trusted site is one run or owned by the carrier (e.g. carrier portal site). Getting on this list usually (from what I understand) requires a whole lot of paperwork and approvals. In terms of being made public or opt-outable, I'm not aware of any carriers that do this. I guess it depends on which 3rd party sites have negotiated agreements and obtained appropriate opt-i…

It's the 3rd party sites I'm more interested in - I can see that carriers may want it as a security function for internal websites and as they already have your number and all your details anyway, it's not really an issue then. For instance with your banking example, yes, I may have given my number and probably have if I'm a customer. But what if I'm just browsing a banks website thinking about opening an account? Sh…

> For instance with your banking example, yes, I may have given my number and probably have if I'm a customer. But what if I'm just browsing a banks website thinking about opening an account?

Sorry I wasn't clearer. I was referring to the use-case where you have an HTTPS connection open with the banking site, and the carrier has agreed to send your mobile number to the banking site only under these conditions (perhaps for security/tracing/auditing purposes).

>Should they have my number then? (but of course banks are unlikely to abuse this for spam or anything.)

I'm not a carrier, but I'm pretty sure that we're on same page here when I say that ideally no egress HTTP request destined beyond/outside of the carrier network should contain a plaintext mobile number.

> But can you see how people would think this is a grey area with potential for abuse?

Yes. This is the same grey area with the potential for abuse that every single company must deal with whenever we hand them our personal information (Google, Facebook, etc).

> So basically, we just have to trust our carriers not to sell us out with no way of checking up on them?

I'm not sure why you're implying that I hold this opinion. It seems we're in violent agreement here.

EDIT: In essence, we do trust carriers not to sell our data and "sell us out" too much. Given the amount of personal data and habits that telecom companies have on us, I'm surprised that they haven't sold our records, logs and patterns to marketing firms. For all we know, they might be doing that already.

Post reply on HN