3 ms·

>First of all I think it's a bad idea to jump on the (valid!) privacy complaint against O2 in the UK with this unrelated thing. It's not unrelated. Take a for

>First of all I think it's a bad idea to jump on the (valid!) privacy complaint against O2 in the UK with this unrelated thing. It's not unrelated. Take a forum where you've registered your details - many people are more than happy to give out real name, mother's maiden name etc, but won't give out their mobile number. The forum can capture that number without you knowing and use that along with the info you've chosen to provide to send a valid looking SMS, both in terms of sender and content. Text From O2 - Dear Mr Smith. We need to update your profile. Please go to http://reallyo2.com/logon.html http://reallyo2.com/logon.html and log on.

darklajid 15y ago
You try really hard to find a way to mix these (still unrelated) things in my opinion.. What would be the sender number of O2 here to make it look authentic? And if 'I can send you a text message spoofing to be O2 to collect your number' is related, should we now bash all mail providers (or - any particular?) because the very same connection can be artificially created for 'I can send you a mail spoofing to be from O2 to collect your number'? One issue is a real privacy breach, is currently looked into according to the company and will hopefully be fixed. The other thing is a problem of a technology that wasn't designed with this problem in mind and that grew beyond anyone's expectations. One is a bug, one is (for now and in most of this thread) a communication problem that obviously surprises a number of people.
- richardburton 15y ago
  It is a big bug that evil people can use to their evil advantage too easily.
- prof_hobart 15y ago
  I didn't try particularly hard at all. It's a pretty obvious consequence of the two. It is already a problem for email, but most people are getting much more savvy with this and are mostly at least aware of the risk. With SMS, it's not so common. So people are less likely to expec it, and (certainly in my experience) they are more trusting of an SMS that looks like it comes from a legit source, especially if it contains personal info about you. This is partly because people are usually more wary of giving out their mobile number - I know that I've given it out to very few places, and most of them are ones that I trust. The O2 issue massively impacts this, as there's thousands of sites who now potentially have my number (and many of those will be linked to some personal info about me). But it's also partly because most people don't realise that you can spoof SMS headers this way - if you get a text message that claims to be from a particular number, most people assume that it came from that number. I'm not making any comment on the cause of it (whether it's a bug or a design feature), or whether there's anyone to "blame" (and if so, who). I'm simply pointing out that there is quite a significant overap between the two, as the combination creates a potential spammers' paradise.

darklajid 15y ago

You try really hard to find a way to mix these (still unrelated) things in my opinion.. What would be the sender number of O2 here to make it look authentic? And if 'I can send you a text message spoofing to be O2 to collect your number' is related, should we now bash all mail providers (or - any particular?) because the very same connection can be artificially created for 'I can send you a mail spoofing to be from O2 to collect your number'? One issue is a real privacy breach, is currently looked into according to the company and will hopefully be fixed. The other thing is a problem of a technology that wasn't designed with this problem in mind and that grew beyond anyone's expectations. One is a bug, one is (for now and in most of this thread) a communication problem that obviously surprises a number of people.

richardburton 15y ago
It is a big bug that evil people can use to their evil advantage too easily.
prof_hobart 15y ago
I didn't try particularly hard at all. It's a pretty obvious consequence of the two. It is already a problem for email, but most people are getting much more savvy with this and are mostly at least aware of the risk. With SMS, it's not so common. So people are less likely to expec it, and (certainly in my experience) they are more trusting of an SMS that looks like it comes from a legit source, especially if it contains personal info about you. This is partly because people are usually more wary of giving out their mobile number - I know that I've given it out to very few places, and most of them are ones that I trust. The O2 issue massively impacts this, as there's thousands of sites who now potentially have my number (and many of those will be linked to some personal info about me). But it's also partly because most people don't realise that you can spoof SMS headers this way - if you get a text message that claims to be from a particular number, most people assume that it came from that number. I'm not making any comment on the cause of it (whether it's a bug or a design feature), or whether there's anyone to "blame" (and if so, who). I'm simply pointing out that there is quite a significant overap between the two, as the combination creates a potential spammers' paradise.