UK network o2 send your number to every site you visit • Hacker News Board

Re: UK network o2 send your number to every site you visit

#121

Post by swombat » Wed, Jan 25, 2012, 11:36 AM UTC

jgrahamc wrote: post #118

swombat wrote: post #117

Earlier quoted context omitted.

Three (UK) don't do it, and it's worth also noting that @O2 has been in overdrive about trying to contain the twitter outrage. Good to see a large corp paying attention for once.

Have you examined all the Three headers to ensure that they are not sending a hashed version of the phone number?

None of the ones listed on the lew.io website seemed to include a phone number hash, but I only glanced at it quickly.

Re: UK network o2 send your number to every site you visit

#122

Post by mbrit » Wed, Jan 25, 2012, 11:36 AM UTC

Here's a proof-of-concept to get the user's location too: http://mbrit.com/o2numberandlocation.aspx.

(Albeit they need to give permission to access the HTML5 location APIs.)

Re: UK network o2 send your number to every site you visit

#123

Post by pwaring » Wed, Jan 25, 2012, 11:40 AM UTC

Torn wrote: post #98

davedevelopment wrote: post #87

Earlier quoted context omitted.

Fired them an email, don't really expect or care for a response, just want to make some noise about it.

You should absolutely expect a response. The ICO was set up exactly for cases like these and is funded by the taxes you are paying. Make sure you have filled in the correct complaint forms and provided your personal details. Sending an email with a link to the lew.io site or this HN thread is useless to them.

The ICO does have a limited budget and powers though, so responding promptly to all complaints might not be possible.

Re: UK network o2 send your number to every site you visit

#124

Post by davej » Wed, Jan 25, 2012, 11:42 AM UTC

mbrit wrote: post #122

Here's a proof-of-concept to get the user's location too: http://mbrit.com/o2numberandlocation.aspx . (Albeit they need to give permission to access the HTML5 location APIs.)

What's wrong with this? This is a browser feature which requires permission from the user. Am I missing something?

Re: UK network o2 send your number to every site you visit

#125

Post by warehouse » Wed, Jan 25, 2012, 11:43 AM UTC

Torn wrote: post #54

I'm filing a Data Protection complaint now. I'd encourage other UK HNers to do the same: http://www.ico.gov.uk/complaints/data_protection.aspx

I am in the process of doing this now, also my contract expires this month with them and I will be moving to another provider - do we know it if only affects 02?

Re: UK network o2 send your number to every site you visit

#126

Post by warehouse » Wed, Jan 25, 2012, 11:44 AM UTC

Torn wrote: post #54

I'm filing a Data Protection complaint now. I'd encourage other UK HNers to do the same: http://www.ico.gov.uk/complaints/data_protection.aspx

I am in the process of doing this now, also my contract expires this month with them and I will be moving to another provider - do we know it if only affects 02?

Re: UK network o2 send your number to every site you visit

#127

Post by pwaring » Wed, Jan 25, 2012, 11:44 AM UTC

forcer wrote: post #78

iamichi wrote: post #72

Earlier quoted context omitted.

Just been looking into this and from the little info I can find, it looks like your phone number would be classed as personal information and so covered by the data protection act.

Yeah. Just submitted a form as well and got response from ICO that case work has been received. According to the law, companies that break Data Protection, can be fined up to £500,000 per case.

Technically the organisation in breach would receive a penalty, not a fine. I realise that's a bit pedantic but there is a difference (fines can usually only be made and enforced by the courts).

The ICO can also prosecute the company and officers in the criminal courts under some situations, including: "unlawfully obtaining, disclosing, or procuring the disclosure of personal data;" (I don't know whether this would count as unlawful disclosure or not).

Re: UK network o2 send your number to every site you visit

#128

Post by DrJokepu » Wed, Jan 25, 2012, 11:53 AM UTC

Apart from the obvious data protection issues, perhaps an even more interesting and frightening aspect of the issue is that that phone number is probably there for a reason. It's entirely possible that some O2 or O2 partner sites use that header field to associate a visitor with an O2 customer.

It would be interesting to see if that could be abused somehow, e.g. fake a phone number header to see if it's possible to "prank your friends" who use O2 or do something ever more malicious. (I'm not advocating anything like that, it's illegal and immoral and bad, I'm just curious if that would really work.)

Re: UK network o2 send your number to every site you visit

#129

Post by samwilliams » Wed, Jan 25, 2012, 12:02 PM UTC

bravolima wrote: post #38

I'm not seeing the header - HTC Desire.

I am not seeing it on the HTC Sensation either.

This article seems to agree with us too: http://www.slashgear.com/o2-sharing-phone-numbers-for-mobile...

I wonder what the (de)selection criteria is then?

Re: UK network o2 send your number to every site you visit

#130

Post by J_Darnley » Wed, Jan 25, 2012, 12:02 PM UTC

Now that is how a web page should look! It uses my preferred font at the preferred size and fills the entire width of the page with text. Congratulations!