Hacker News Reader

Comment by jarofgreen | Hacker News Reader

Confirmed on a Google Nexus.

In his webpage he also says "They downgrade all images and insert a javascript link into the HTML of each page."

The image downgrading has been know about for ages, the JS I have not heard about before. I have asked for more info on Twitter but will investigate myself if I can find time today.

View on HN

We got aware of that problem in October 2011 during relaunch of our website and we faced it also with t-mobile in germany. After digging around helpful sources have been

http://stackoverflow.com/questions/4113268/how-to-stop-javas...

Besides injecting the bmi.js they also do their own javascript compression. At that time we had our own minified version of jquery, which got corrupted by their compression. They assume that /* always denotes a starting comment. This is wrong for the jquery lib, which contains some strings containing /* to denote mime type patterns. Anyways, we solved those compression issues with cache-control:no-transform. Also gzip compressing the HTTP responses worked.

Yes- we were stung by this one.

Our boss saw errors loading the site on his iPad, but whenever we brought him into the office to try and replicate it, the problems disappeared.

We finally figured out it only happened when he was out the office, so on 3G not WiFi, and then managed to find the stackoverflow post you mention.

https://twitter.com/#!/O2/status/161872584634408960 says "@lewispeckover Hi Lewis. The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru"

As Lewis replies, "@O2 User-agent header ID's the device. Passing mobile number to third party sites is not ok! Seems like a data protection act breach to me?"

Being charitable, that could be clueless support rather than official policy response but hopefully the storm coming their way will get an official response soon.

From the oracle (Wikipedia), Data must not be disclosed to other parties without the consent of the individual whom it is about, unless there is legislation or other overriding legitimate reason to share the information (for example, the prevention or detection of crime). It is an offence for Other Parties to obtain this personal data without authorisation.

It is in fact illegal for the website to obtain this information... Lew, you're going down... Only joking.

The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru"

...and for people using iPod Touches or similar?

Their twitter has now exploded with a flurry of tweets like '@user we are investigating these reports and will provide more information as soon as we can.'

While waiting for an upload, I had a look.

This tag is inserted in the head:

This is inserted at the end:

</script>

The external JS is here: http://pastebin.com/rv3k4meX

Analysis please. At an initial glance it seems to just be about the image compression.

Here is a un-minified version: http://pastebin.com/t0FhS2Z7

My quick glace at it agrees with you, it looks like it replaces the URLs of the images, presumably to load compressed versions.

The javascript changes all image URL's to lower quality versions from O2's servers, it also provides a helpful little function which lets you use a hotkey (Alt+D I believe) to download all the images in full quality. The javascript comes from the domain //1.2.3.4/bmi-int-js/bmi.js (Not a real domain, only works behind O2's proxy)

Reply on news.ycombinator.com