Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UK network o2 send your number to every site you visit

lew.io

Post reply on HN
Print view View original

111–120 of 180 posts

Re: UK network o2 send your number to every site you visit

#111

Post by dspillett »

edandersen wrote: post #15

You should be able to bypass the proxy that inserts the HTTP headers with the following APN on O2: apn: mobile.o2.co.uk username: bypass password: password Worked in 2008 when I tried it ( http://www.edandersen.com/2008/07/13/iphone-o2-fix-the-image... ) as they used to screw with images on the App Store. I don't have access to O2 anymore, can someone try this and see if it still works? Edit: It still includes your p…

The only way to reliably work around operators messing around with what you access (inserting their own client side code and such) and potentially inserting stuff into the headers like this too is to use a VPN for all Internet traffic that isn't otherwise tamper proof (i.e. HTTPS with a properly signed cert).

I use OpenVPN when I have my netbook tethered to my phone (or when I use any other "untrusted" wireless network for that matter) and route all traffic through my home fibre (I'm with an ISP that I know doesn't mess with my traffic).

There are problems with that though:

* installing OpenVPN on Android is a faf (I've still not got around to it on my device) [see http://vpnblog.info/android-openvpn-strongvpn.html and similar] - most users are not going to want to mess around like that

* there is no garantee that it will even work (or work efficiently enough) on all networks, or they could classify all encrypted traffic in the same lump as encrypted P2P connections and shape/block accordingly

* any VPN adds overheads (at least a set of headers per packet, and keep-alive packets when the connection is otherwise inactive), so if you don't have a cheap data plan that could be a consideration

Re: UK network o2 send your number to every site you visit

#113

Post by jiggy2011 »

alexchamberlain wrote: post #66
Torn wrote: post #54

I'm filing a Data Protection complaint now. I'd encourage other UK HNers to do the same: http://www.ico.gov.uk/complaints/data_protection.aspx

Can you post what you send and then we can all forward it?

What are you guys sending as "supporting evidence"?

Re: UK network o2 send your number to every site you visit

#114

Post by mseebach »

philjones88 wrote: post #36
mseebach wrote: post #29

This does not happen on giffgaff, a MVNO owned by and operating on O2s network.

Actually it does for me. Perhaps its the handset that determines this issue? I have a O2 PAYG HTC HD7 WP7.5 device that I use with GiffGaff and the page clearly lists the header and my phone number.

Perhaps I should turn off wifi. Facepalm. Yes, it happens on Giffgaff too.

Re: UK network o2 send your number to every site you visit

#115

Post by jgrahamc »

It's not just O2 in the UK. This happens all over the place. See this talk done in 2010: http://mulliner.org/security/httpheaderprivacy.php

It mentions: Orange (UK), Rogers (Canada), H3G (Italy), Vodafone/BILDmobil (Germany), Pelephone (Israel), and on and on...

Re: UK network o2 send your number to every site you visit

#117

Post by swombat »

jgrahamc wrote: post #115

It's not just O2 in the UK. This happens all over the place. See this talk done in 2010: http://mulliner.org/security/httpheaderprivacy.php It mentions: Orange (UK), Rogers (Canada), H3G (Italy), Vodafone/BILDmobil (Germany), Pelephone (Israel), and on and on...

Three (UK) don't do it, and it's worth also noting that @O2 has been in overdrive about trying to contain the twitter outrage. Good to see a large corp paying attention for once.

Re: UK network o2 send your number to every site you visit

#118

Post by jgrahamc »

swombat wrote: post #117
jgrahamc wrote: post #115

It's not just O2 in the UK. This happens all over the place. See this talk done in 2010: http://mulliner.org/security/httpheaderprivacy.php It mentions: Orange (UK), Rogers (Canada), H3G (Italy), Vodafone/BILDmobil (Germany), Pelephone (Israel), and on and on...

Three (UK) don't do it, and it's worth also noting that @O2 has been in overdrive about trying to contain the twitter outrage. Good to see a large corp paying attention for once.

Have you examined all the Three headers to ensure that they are not sending a hashed version of the phone number?

Re: UK network o2 send your number to every site you visit

#119

Post by michh »

richardburton wrote: post #83

As bad as this may seem, SMS spoofing is way, way worse. http://www.bbc.co.uk/blogs/watchdog/2010/04/mobile_spoofing.... Nothing has been done about it.

I disagree. SMS spoofing is a serious problem but not such a gigantic privacy issue as sending my phone number to every website I visit.

If it were merely some string that uniquely identifies me across different domains no matter how many times I reset my browse, it'd already be a privacy disaster. But making it my actual phone number? That's... just.. horrible.

Re: UK network o2 send your number to every site you visit

#120

Post by Tyrannosaurs »

jgrahamc wrote: post #118
swombat wrote: post #117

Earlier quoted context omitted.

Three (UK) don't do it, and it's worth also noting that @O2 has been in overdrive about trying to contain the twitter outrage. Good to see a large corp paying attention for once.

Have you examined all the Three headers to ensure that they are not sending a hashed version of the phone number?

The headers I can see (from my iPhone on three) are very minimal and don't include anything that look like they could be a hashed phone number.
Post reply on HN