Be Excellent To Each Other

So, it appears that O2, when you use their mobile data service, add in an HTTP header to all your outgoing http traffic. It identifies as 'x-up-calling-line-id', and contains your mobile phone number. So what they are effectively doing is providing your mobile phone number to every website you visit. Nice, huh?

So, I'd be interested to see what you get if you're on other carriers - the link below should list what HTTP headers you're handing out:

http://pgl.yoyo.org/http/browser-headers.php

Nothing unusual on t-mobile (tethered)

As I said on Twitter, I see nothing unusual on Three.

Orange is fine, no number sent.

Popular suspicion seems to be that this is a screw-up, rather than anything malicious.

That's pretty fucking poor. I've just verified it on my phone and it does indeed do what Craster says.

I'm on O2 data, tested on my phone, and no phone number in sight.

EDIT: No, I'm blind. See further down.

Interesting. Just to check - you weren't on a wifi connection, right?

Russell -- are you PAYG or contract?

Circle data.

Also verified with someone here in work who's with Tesco which uses O2's network.

Oops, no. My mistake. There is a field further down listing it. How unusual.

This may be why I got onto the 3 promotions call list when I visited their site then.

From a quick Google it looks like it's more of a valid header when doing WAP/MMS stuff (which makes a certain sort of sense) and the APN I'm going through is wap.02.co.uk. So maybe O2 just kept using the same configuration from back in the days when WAP was mobile internet so they're still broadcasting this parameter in the header even though it's not relevant now. Not that that's an excuse of course.

Note: I've no real idea what I'm talking about here and am making ridiculous assumptions from two seconds Googling something I only vaguely understand.

Oof. Glad that I've left O2 and that I hardly ever used data when with them, then.

Yes, that's pretty fucking poor.

I have actually ordered a 3 SIM card after trying to buy one in their shop and they refusing to sell me a micro SIM on PAYG.

Could it be in any way connected to the O2 adult content block? I'm not sure whether any other providers joined in after O2 set up the age verification with a credit card system for network traffic.

I've ran into that thing on Three, I'm sure.

Can't see how. I'd have expected O2 to implement that by blocking requests to third parties that contain age restricted content within their own network. There's no real reason to pass anything in the HTTP headers related to any kind of verification, not least because the content of those headers is trivial to spoof.

A source has suggested it's to do with O2 wanting partner sites to be able to identify who the user is and that they are eligable for O2-specific deals. Even if that's the case, it's a shocking way to implement it.

O2 on twitter:

LewieP just retweeted this from O2:-



It may be from a guru, but they need to learn the difference between your and you're.

In one of their original Twitter responses they tried to claim that the mobile number in the header was so that sites could identify that you were browsing from a mobile, which is bollocks obviously, and only when the guy pushed back at them did they go and investigate. Somehow I find that more aggravating than someone accidentally misconfiguring a proxy server or whatever in the first place.

Edit: beaten to the punch again!

I can't believe they let someone tweet that when it's such transparent bollocks.

Devs going ape-shit in my Twitter feed. Even just the raw text is enough for unscrupulous people to harvest, to get a list of active mobile numbers to spam. Ugh. Hoping O2 responds swiftly and effectively and also issues a frank apology, not some "we would like to apologies if any inconvenience occurred" bollocks.

Series of tweets from my good friend @UKCougar

I just tried this and it doesn't seem to have worked.

Actually I didn't reboot my phone (although I did enable and then disable flight mode) so let me try that...

Nah, I rebooted with an APN of mobile.o2.co.uk and it hasn't made any difference. I'm not going to try the bypass thing as it sounds a bit too shady.

Be veeeery careful about randomly changing APNs. Bypass in particular is an APN that rips off all network level optimisation. I very much expect O2 will block access to it, especially if lots of people switch over to it.

Things like inclusive data rates and the like are often pinned to the APN you connect through, too.

Fine on Vodafone. So glad I left O2 now.

mobile.o2.co.uk is for contract access
payandgo.o2.co.uk is for those on PAYG.

And mine was already set to the second.

I think the default is idata.o2.co.uk or similar.

There is no default. It depends entirely what contract you're on. idata is specifically for iOS tariffs.

Oh, each SIM I've ever had from them put that as the default.

With a new SIM free Android phone it'll ask you what operator you're on and then install APN settings automatically from somewhere; is it pulling these from O2 at the time somehow? It's always set me up on wap.o2.co.uk and I'm on an older SIM free contract that I've just let run for years.

Also, and this is a bit off-topic, what's the justification for having separate tariffs for iPhones? Functionally surely they're just the same as any other smart phone. Is it just gouging by the operators because they think they can get away with charge more for iPhone contracts or something?

Yeah, I think the carriers have a setup where they push a default APN down in response to a request from the device. Where you get the tariff-specific ones tends to be when they ship you a preconfigured device or SIM on contract.

In O2's case, it was just that it was the first device they sold en masse that there was a real demand for all-you-can-eat data for. They had a standard data bolt-on for £7 a month or something, but with an iPhone you had to get a specific data tariff for around twice the price.

I've just had a look on their site and, interestingly, the data part of their packages are now the same for iPhone vs other smartphone but the voice/minutes part is consistently higher e.g. 200 minutes + unlimited texts + 500MB data on 24 month contract is £27 for an iPhone but £21.50 for another smartphone. That seems even more bullshit than charging extra for data (not that that's justifiable either) and if I was an iPhone customer I'd be demanding an explanation as to why it's apparently more expensive for me to talk and send texts than it is for someone else running different hardware.

Originally, wasn't it because Apple's terms were different to those companies were already providing, and so the likes of O2 had no option but to create specific tariffs?

I believe that was the case, yes.

Fixed now, apparently.

Tested, seems fixed. Explanation now, please.

"We will no longer do testing on a live server".

It's O2. I'd like a believable response, ideally.

What so Apple actually dictated the amount that O2 charged to some extent? Bloody hell. Not that that's an excuse to still be screwing iPhone owners to this day.

Also, my phone number isn't appearing on that test site any more so it looks fixed from my end.

O2 response:
http://blog.o2.co.uk/home/2012/01/o2-mo ... wsing.html

Huh. APoD was (somewhat) correct then.

I would have thought you'd have learnt this by now.