UK network o2 send your number to every site you visit • Hacker News Board

Re: UK network o2 send your number to every site you visit

#101

Post by glenjamin » Wed, Jan 25, 2012, 10:43 AM UTC

cornet wrote: post #39

Firstly I don't work for O2 but I work in the mobile industry. O2 should only be passing your number to trusted sites (and to get on that list is pretty hard). We have reported it to them via various internal contacts we have. Hopefully they will fix this soon!

The same thing could be acheived using a one-way hashed version of the mobile number, which removes the personal information and still allows the carrier to identify the handset customer.

There's no good reason to include the actual mobile number in the headers, internal or not.

Re: UK network o2 send your number to every site you visit

#102

Post by richardburton » Wed, Jan 25, 2012, 10:46 AM UTC

samarudge wrote: post #97

richardburton wrote: post #83

As bad as this may seem, SMS spoofing is way, way worse. http://www.bbc.co.uk/blogs/watchdog/2010/04/mobile_spoofing.... Nothing has been done about it.

When using Skype messaging to a mobile number, you can enter your real mobile number as the 'from' address (In Skype settings). To do this Skype first sends you a confirmation message to the number you want to send from. I'm going to assume the confirmation message is Skype being curious, and that the same technology could be used without confirmation. Or is this an agreement with the mobile operators?

That is right: http://news.ycombinator.com/item?id=3509228

Re: UK network o2 send your number to every site you visit

#103

Post by jiggy2011 » Wed, Jan 25, 2012, 10:47 AM UTC

Torn wrote: post #54

I'm filing a Data Protection complaint now. I'd encourage other UK HNers to do the same: http://www.ico.gov.uk/complaints/data_protection.aspx

I'm trying to do this but I downloaded the .doc complaint form off their website but it appears to be read only?

Re: UK network o2 send your number to every site you visit

#104

Post by bjnortier_hn » Wed, Jan 25, 2012, 10:49 AM UTC

They have a twitter bot that responds to everyone who tweets about the issue - "we are investigating these reports and will provide more information as soon as we can.'

Their twitter account is a disaster zone: https://twitter.com/#!/o2

Re: UK network o2 send your number to every site you visit

#105

Post by otoburb » Wed, Jan 25, 2012, 10:49 AM UTC

jiggy2011 wrote: post #99

Wow, just tried this and my number is right there in plain text within the HTTP header. I would never have signed the contract if I was aware that this would be happening. Does anybody know if this is a new development or been happening forever? Hopefully they fix this pronto, if not I'm not quite sure what to do since I'm really not comfortable using the service if this is happening and it's something I'm already si…

It's quite unlikely that this has been going on forever. More likely that this was a gaffe or misconfiguration during some sort of operational maintenance.

Re: UK network o2 send your number to every site you visit

#106

Post by lewispb » Wed, Jan 25, 2012, 10:53 AM UTC

peterclary wrote: post #95

Torn wrote: post #54

I'm filing a Data Protection complaint now. I'd encourage other UK HNers to do the same: http://www.ico.gov.uk/complaints/data_protection.aspx

That page suggests you can only complain if you've been personally affected. Although I've been on O2 in the past, I don't have any evidence that the problem occurred during that time. I'm on Orange now, which appears to be unaffected. It's a pain, because I'd been thinking about switching back to O2 to get Visual Voicemail, which no other UK provider appears to be able to support.

I use hullomail which provides free visual voicemail for iPhone and android. It works well, so definitely worth a try.

Re: UK network o2 send your number to every site you visit

#107

Post by mattmanser » Wed, Jan 25, 2012, 10:55 AM UTC

jarofgreen wrote: post #6

jarofgreen wrote: post #3

Confirmed on a Google Nexus. In his webpage he also says "They downgrade all images and insert a javascript link into the HTML of each page." The image downgrading has been know about for ages, the JS I have not heard about before. I have asked for more info on Twitter but will investigate myself if I can find time today.

https://twitter.com/#!/O2/status/161872584634408960 says "@lewispeckover Hi Lewis. The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru" As Lewis replies, "@O2 User-agent header ID's the device. Passing mobile number to third party sites is not ok! Seems like a data protection act breach to me?" Being charitable, that could be clueless support rather than…

Their twitter has now exploded with a flurry of tweets like '@user we are investigating these reports and will provide more information as soon as we can.'

Re: UK network o2 send your number to every site you visit

#108

Post by alexchamberlain » Wed, Jan 25, 2012, 10:55 AM UTC

jiggy2011 wrote: post #103

Torn wrote: post #54

I'm filing a Data Protection complaint now. I'd encourage other UK HNers to do the same: http://www.ico.gov.uk/complaints/data_protection.aspx

I'm trying to do this but I downloaded the .doc complaint form off their website but it appears to be read only?

You have to save it before you can edit.

Re: UK network o2 send your number to every site you visit

#109

Post by mike-cardwell » Wed, Jan 25, 2012, 11:02 AM UTC

Mobile networks seem to do all sorts of horrendous shit to peoples Internet connections. I found out this morning that T-Mobile UK's transparent web proxy breaks web sockets. They also break some websites by minifying javascript badly.

This is exactly why my phone has a VPN to my Linode server and routes out all Internet traffic over it. Mobile phone companies don't provide a clean Internet connection.

Re: UK network o2 send your number to every site you visit

#110

Post by nandemo » Wed, Jan 25, 2012, 11:06 AM UTC

Torn wrote: post #89

alexchamberlain wrote: post #66

Earlier quoted context omitted.

Can you post what you send and then we can all forward it?

Adjust as needed, here's roughly what I put: ------------------------- SECTION 4: Name: Telefonica O2 UK Address: 260 Bath Road Postcode: SL1 4DX Phone: 0800 089 0202 email: peter.erksine@o2.com website: http://www.o2.co.uk SECTION 6: When users of their network visit a site O2 inject the mobile phone number of the user into the request. This is then available to the website host, which raises obvious data protection…

The tweet:

> "Hi Lewis. The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru"

Wow.