Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UK network o2 send your number to every site you visit

lew.io

Post reply on HN
Print view View original

171–180 of 180 posts

Re: UK network o2 send your number to every site you visit

#171

Post by eps »

urbanjunkie wrote: post #167

O2 have responded http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-... Selected highlights: Q: How long has this been happening? A: In between the 10th of January and 1400 Wednesday 25th of January, in addition to the usual trusted partners, there has been the potential for disclosure of customers’ mobile phone numbers to further website owners. Q: Has it been fixed? A: Yes. It was fixed as of 1400 on Wedn…

When you browse from an O2 mobile, we add the user's mobile number to this technical information, but only with certain trusted partners. This is standard industry practice.

Re: UK network o2 send your number to every site you visit

#172

Post by c_mac »

I must say I am encouraged to see that some media coverage and, what seems to be an influx of emails to 02 by worried customers has managed to prompt a response from the company. Sadly, the concerns of who these nameless "trusted partners" are will no doubt have some people concerned.

Re: UK network o2 send your number to every site you visit

#173

Post by urbanjunkie »

eps wrote: post #171
urbanjunkie wrote: post #167

O2 have responded http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-... Selected highlights: Q: How long has this been happening? A: In between the 10th of January and 1400 Wednesday 25th of January, in addition to the usual trusted partners, there has been the potential for disclosure of customers’ mobile phone numbers to further website owners. Q: Has it been fixed? A: Yes. It was fixed as of 1400 on Wedn…

When you browse from an O2 mobile, we add the user's mobile number to this technical information, but only with certain trusted partners. This is standard industry practice.

It's more alarming that this is 'standard industry practice', implying all the UK mobile telcos are doing this.

Re: UK network o2 send your number to every site you visit

#174

Post by pmjordan »

mhw wrote: post #94
Leynos wrote: post #31

Using Opera Mini seems to disable this "feature". Of course, doing so means all of my web traffic goes via Oslo. And of course, any apps using an http API are presumably affected too. I'm rather disappointed to hear about this.

> Of course, doing so means all of my web traffic goes via Oslo. Which probably means that your phone number is going to Oslo instead. At least it's not being proxied onwards from there.

Opera Mini uses its own protocol to talk to the proxy. HTTP is quite chatty, so there's a lot of mileage in reducing the headers by simply omitting a lot of unneeded information and compressing the rest.

Re: UK network o2 send your number to every site you visit

#175

Post by mooism2 »

alexchamberlain wrote: post #56
mooism2 wrote: post #49

Earlier quoted context omitted.

It's like security through obscurity: on its own it's inadequate, but as an extra layer it can be helpful.

How is this helpful? We have proved it's inconsistent... Do you check IP addresses for security too?

I can imagine a bank fraud detection system being more suspicious of unusually large transactions if they originate from an unusual phone number or ip address, yes.

Re: UK network o2 send your number to every site you visit

#176

Post by biafra »

perspective wrote: post #143
kgutteridge wrote: post #19

A lot of mobile network operators wash this information about or have it hashed into some other form (which means it can still be used as a unique identifier) Some popular headers to check X-UP-CALLING-LINE-I X_NOKIA_MSISDN X_H3G_MSISDN MSISDN X_MSISDN X_NETWORK_INFO X-WAP-MSISDN X-UP-SUBNO

I'm on 3 w/Samsung Galaxy SII & Cyanogenmod and it's not sending any phone-specific headers.

It is not the phone that sends these headers. It is the internet gateway or proxy at the carrier that inserts it.

Re: UK network o2 send your number to every site you visit

#179

Post by kgutteridge »

[deleted] wrote: post #178

[deleted]

If you have ever used any payforit service to pay for goods, the intermediary you went through will at the very least have your MSISDN hashed and most likely in the clear (depends on your mobile network operator)

List of the Payforit intermediaries http://www.payforit.org/

Re: UK network o2 send your number to every site you visit

#180

Post by kgutteridge »

mpunaskar wrote: post #177

As per statement from O2 - They share data with their "trusted partners" for age verification purpose. Does that mean they share my birth date with their "trusted" partners?

Due to the code of practice in the UK the mobile network operators do at share "over 18 yes/no" with some sites

You can read more

http://www.aimelink.org/docs/UK_MNO_Age_Verification_Procedu...

Post reply on HN