Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UK network o2 send your number to every site you visit

lew.io

Post reply on HN
Print view View original

151–160 of 180 posts

Re: UK network o2 send your number to every site you visit

#151

Post by corin_ »

richardburton wrote: post #83

As bad as this may seem, SMS spoofing is way, way worse. http://www.bbc.co.uk/blogs/watchdog/2010/04/mobile_spoofing.... Nothing has been done about it.

That article is actually hilarious in how bad it is.

Lines like this one:

"The message was so convincing that the iPhone Anita was using believed it was genuine and listed it directly underneath the real message from that bank."

Show a complete misunderstanding of how SMS works. SMS is like email in that who it comes from is simply a type of header, which when sending from a mobile phone isn't editable - when a message arrives your phone can't verify where it actually came from. In particular given banks don't send from an official number, they send from a text name.

Re: UK network o2 send your number to every site you visit

#152

Post by michaelfeathers »

The link insertion reminds me of an ISP in another country that was rewriting HTML before sending it. If we want to get very technical, if this happened in the US, couldn't an ISP be dinged for creating a "derived work" of a copyrighted page without permission?

Re: UK network o2 send your number to every site you visit

#154

Post by ukgent2 »

UK South Iphone 4s Headers in plain sight

Called o2 support, stating I believe this is a breach of contract and wish to cancel my contract. The guy on the phone was not really sure how to handle this. Does anyone had any luck forcing o2 to cancel their contract based on this information? I kinda like Orange, no headers, and orange wednesdays

Re: UK network o2 send your number to every site you visit

#155

Post by simonbrown »

rmc wrote: post #52
jarofgreen wrote: post #14

Earlier quoted context omitted.

I would sodding hope it's illegal in the UK to! Altho as IANAL I can't think of which law exactly would cover it. Anyone know? I'm envious, you Germans have great privacy laws.

you Germans have great privacy laws. A lot of these laws are from EU Directives, which the UK would have implemented aswell. Brussles isn't all bad! :P

Including the one which effectively bans analytics.

http://blog.silktide.com/2011/05/cookie-law-makes-most-uk-we...

Re: UK network o2 send your number to every site you visit

#156

Post by sahirh »

cornet wrote: post #39

Firstly I don't work for O2 but I work in the mobile industry. O2 should only be passing your number to trusted sites (and to get on that list is pretty hard). We have reported it to them via various internal contacts we have. Hopefully they will fix this soon!

Yes, where I am it's often used to direct-to-bill services such as purchasing ringtones. The user clicks on 'purchase ringtone / song etc' and doesn't have to enter any payment information. The partner site has access to the number that they have to bill to. Since this is not controlled for or re-checked, there have been incidents of billing fraud (just set the header yourself with someone else's number).

Re: UK network o2 send your number to every site you visit

#158

Post by justincormack »

JonnieCache wrote: post #142

Here's a statement from the Information Commissioner's Office: "When people visit a website via their mobile phone they would not expect their number to be made available to that website. "We will now speak to O2 to remind them of their data breach notification obligations, and to better understand what has happened, before we decide how to proceed." http://news.sky.com/home/technology/article/16156276 O2 are in trou…

Odd they said something different to the Guardian http://www.guardian.co.uk/technology/2012/jan/25/02-mobile-p...

"The Information Commissioner's Office said it is considering whether to investigate further, although a spokesman said there was no immediate breach of the Data Protection Act. A mobile phone number on its own is not classed as "personally identifying information" (PII), because it does not identify an individual on its own; but the spokesman said the office would consider whether other personal data was being processed at the same time."

I just google my phone number and found all my other details though, better fix that.

Re: UK network o2 send your number to every site you visit

#159

Post by Torn »

JonnieCache wrote: post #142

Here's a statement from the Information Commissioner's Office: "When people visit a website via their mobile phone they would not expect their number to be made available to that website. "We will now speak to O2 to remind them of their data breach notification obligations, and to better understand what has happened, before we decide how to proceed." http://news.sky.com/home/technology/article/16156276 O2 are in trou…

Update at 14:40: Looks like they've removed the header from being inserted, no doubt after pressure from the ICO and the media cover.

The system works!

Re: UK network o2 send your number to every site you visit

#160

Post by Torn »

jiggy2011 wrote: post #113
alexchamberlain wrote: post #66

Earlier quoted context omitted.

Can you post what you send and then we can all forward it?

What are you guys sending as "supporting evidence"?

I put links to the lew.io tool, this thread and O2's official twitter response.

They seem to have taken down the header now though.

Post reply on HN