3 ms·

Can you post what you send and then we can all forward it?

Torn 15y ago
Adjust as needed, here's roughly what I put: ------------------------- SECTION 4: Name: Telefonica O2 UK Address: 260 Bath Road Postcode: SL1 4DX Phone: 0800 089 0202 email: peter.erksine@o2.com website: http://www.o2.co.uk http://www.o2.co.uk SECTION 6: When users of their network visit a site O2 inject the mobile phone number of the user into the request. This is then available to the website host, which raises obvious data protection issues. O2 does this by modifying the HTTP request and inserting the number in the 'x-up-calling-line-id' HTTP header. Alarmingly, it does this to all unencrypted site visits (i.e. 'http' not 'https'), and these end-sites can trivially harvest the mobile numbers of visitors and link these to content visited. This can be verified by visiting http://lew.io/headers.php http://lew.io/headers.php on an O2 mobile device. The site serves as a tool to show the visitor the HTTP headers received by the server when the user requests that particular page. SECTION 10: Online utility that will show you the headers sent in your page request: http://lew.io/headers.php http://lew.io/headers.php Discussion on technical forum 'hacker news': http://news.ycombinator.org/item?id=3508857 http://news.ycombinator.org/item?id=3508857 Official O2 Twitter responding to (and misunderstanding/misrepresenting) the problem: https://twitter.com/#!/O2/status/161872584634408960 https://twitter.com/#!/O2/status/161872584634408960 ------------------------- COVERING LETTER WITH EMAIL TO casework@ico.gsi.gov.uk: To whom it may concern, Please find attached my complaint against O2 under the Data Protection Act. When users of their network visits a site O2 inject the mobile phone number of the user into the request. This is then available to the website host, which raises obvious data protection issues. Regards,
- nandemo 15y ago
  The tweet: > "Hi Lewis. The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru" Wow.
  - rmc 15y ago
    Their Twitter account ( https://twitter.com/#!/O2 https://twitter.com/#!/O2 ) has a burst of new activity. Looks like this has been passed up from Tier 1 support.
jiggy2011 15y ago
What are you guys sending as "supporting evidence"?
- Torn 15y ago
  I put links to the lew.io tool, this thread and O2's official twitter response. They seem to have taken down the header now though.
  - urbanjunkie 15y ago
    O2 have responded, admitting the issue existed, and stating they've now fixed it. http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-browsing.html http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-...

Torn 15y ago

Adjust as needed, here's roughly what I put: ------------------------- SECTION 4: Name: Telefonica O2 UK Address: 260 Bath Road Postcode: SL1 4DX Phone: 0800 089 0202 email: peter.erksine@o2.com website: http://www.o2.co.uk http://www.o2.co.uk SECTION 6: When users of their network visit a site O2 inject the mobile phone number of the user into the request. This is then available to the website host, which raises obvious data protection issues. O2 does this by modifying the HTTP request and inserting the number in the 'x-up-calling-line-id' HTTP header. Alarmingly, it does this to all unencrypted site visits (i.e. 'http' not 'https'), and these end-sites can trivially harvest the mobile numbers of visitors and link these to content visited. This can be verified by visiting http://lew.io/headers.php http://lew.io/headers.php on an O2 mobile device. The site serves as a tool to show the visitor the HTTP headers received by the server when the user requests that particular page. SECTION 10: Online utility that will show you the headers sent in your page request: http://lew.io/headers.php http://lew.io/headers.php Discussion on technical forum 'hacker news': http://news.ycombinator.org/item?id=3508857 http://news.ycombinator.org/item?id=3508857 Official O2 Twitter responding to (and misunderstanding/misrepresenting) the problem: https://twitter.com/#!/O2/status/161872584634408960 https://twitter.com/#!/O2/status/161872584634408960 ------------------------- COVERING LETTER WITH EMAIL TO casework@ico.gsi.gov.uk: To whom it may concern, Please find attached my complaint against O2 under the Data Protection Act. When users of their network visits a site O2 inject the mobile phone number of the user into the request. This is then available to the website host, which raises obvious data protection issues. Regards,

nandemo 15y ago
The tweet: > "Hi Lewis. The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru" Wow.
- rmc 15y ago
  Their Twitter account ( https://twitter.com/#!/O2 https://twitter.com/#!/O2 ) has a burst of new activity. Looks like this has been passed up from Tier 1 support.

jiggy2011 15y ago

What are you guys sending as "supporting evidence"?

Torn 15y ago
I put links to the lew.io tool, this thread and O2's official twitter response. They seem to have taken down the header now though.
- urbanjunkie 15y ago
  O2 have responded, admitting the issue existed, and stating they've now fixed it. http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-browsing.html http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-...