Comment by jgroome | Hacker News Reader

Comment by jgroome | Hacker News Reader

Firstly, hats off to O2 for going into crisis mode, responding to customer complaints directly, and then resolving the issue and putting out a complete statement on the same day the matter was brought up.

Secondly, however, this statement smells faintly of fluffy language and PR speak:

> When you browse from an O2 mobile, we add the user's mobile number to this technical information, but only with certain trusted partners. This is standard industry practice.

Is it really industry practice? Can anybody in this field confirm this? I can see why it would be useful for billing as they mention, but is this really an effective way to do age verification?

> in addition to the usual trusted partners, there has been the potential for disclosure of customers’ mobile phone numbers to further website owners.

Woah, there's nothing "potential" about it - this was right there in the HTTP headers. Saying "there has been the potential..." implies the website owner would have had to do some hacking to get hold of this information, which is not the case, right?

Yes this is industry standard practice. I worked on the official mobile appstore for AT&T Wireless (way back when it was known as Cingular) that handled ringtones/graphics/apps/games and we had access to that header as well for billing purposes. We used it to track purchase history on that site for recommendations/profiling and also used it for segmenting the mobile UI storefront.

> Is it really industry practice? Can anybody in this field confirm this? I can see why it would be useful for billing as they mention, but is this really an effective way to do age verification?

I'm in the field, and this is indeed standard industry practice. It is useful for many purposes, billing and age verification being just two, but the main root reason being that wireless carriers typically use the mobile number as the root identity for a subscriber profile that is shared across multiple backend systems.

It's an effective way to do age verification provided the carrier has implemented some type of process during sign-up or via some other (in)direct method, mainly by leveraging the identity of the subscriber and running a check against it.

A similar technique seems to be in use by at least one other UK network.

I'm with 3 (one of O2's rivals) and if I access my account information from my handset connected to their network, it takes me straight to the relevant info without a pesky login. (If I try the same via wi-fi, I get a page asking me to disconnect from the hotspot and go back online via 3G.)

I always did wonder how they achieved this--sending the mobile number in the HTTP headers is likely.

This seems like a possible security hole. I wonder what will happen if you forge the HTTP header to pretend your someone else.

It's possible that they set the header at their gateway so that it will override whatever you set from your device. It's also possible that the app is firewalled to only be accessible directly from their mobile network.

Of course, it's also possible that at least one operator isn't following appropriate measures to make this secure.

A few years ago Verizon included an XID variable in the headers (essentially a unique subscriber code), but I'm not sure what the SOP is today.

Granted, there are still several ad-testing companies that store a variety of mobile cookies for tracking impressions, but this is much different from permanent, header-based tracking that used to occur with Verizon and possibly others.

I presume most websites that weren't expecting to find an O2 number in the HTTP headers won't have looked for it, won't have logged it, etc.

If I send a secret to you in the post, and you put the envelope in the recycling unopened, have I disclosed a secret to you?

yes

It's quite straightforward to dump the entire header in a web log or database, and I'm sure some sites do.

They might have put the envelope in the recycling, but they never have it emptied and someone just told them it contains a £20 note.

It's quite straightforward to dump the entire header in a database, but most sites don't. None of my sites do. Apache, lighttpd, thttpd, etc don't (maybe they do with an appropriate plug-in).

People seemed to be reacting as if every website an O2 customer visited was going to add their phone number to their files, and that's not the case.

> If I send a secret to you in the post, and you put the envelope in the recycling unopened, have I disclosed a secret to you?

Yes. Intent and the fact you did it is what matters here.

O2 are saying the intent wasn't there.

"If I send a secret to you in the post, and you put the envelope in the recycling unopened, have I disclosed a secret to you?"

Oh god yes. Everyone who reads your comment is hoping you don't work with financial, personal, confidential or (eek) classified information.

Reply on news.ycombinator.com