Slashdot Mirror
Aussie Telco Caught Handing Over User Mobile Numbers To Websites Without Consent
AlbanX writes: Australian telco Optus has been nabbed passing its customers' mobile phone numbers to third-party websites without the customers' knowledge or consent. The practice, known as HTTP header enrichment, aims to streamline the process of direct billing for customers, but they're not happy. The discovery was made by a user on the telco forum Whirlpool, and Optus confirmed it. They said, "Optus adds our customers' mobile number to the information in select circumstances where we have a commercial relationship with owners of particular websites."
Why is it that telcos feel entitled to meddle in customers' data packets at all? "Adding headers"? I Think Not.
Just heard a rumor that some (unspecified) carriers do the same here in Russia, and there are even rogue sites that bill unsuspecting users via the carrier account for visiting them. No idea if it's true or even possible technically/legally, but how do I protect myself from a carrier sending my account data to the site?
...a crime was committed, or at minimum that we're going to actually do something to them.
Of course, we all know nothing will come of this, or at best a slap-on-the-wrist fine, which they've probably already calculated as a standard business expense.
Might as well just stop putting stories out like this until consumers are actually willing to act upon it. I'm willing to be there isn't enough consumer give-a-shit left in the world to tackle even this single issue, let alone tackle the mass arrogance that corporations pull off today at the expense of the customer.
What does it matter if you label someone as "caught" if the reaction is nothing.
See, this is exactly why I want a HTTPS web.
I do think Let's Encrypt is on the right track. When they show their protocol and open source software works. I'm pretty sure other CA's will follow.
Automating HTTPS deployment is a good thing.
Yes, the CA-system isn't a perfect system at all, but at least we are seeing some improvements in use of HTTPS:
- https://en.wikipedia.org/wiki/... (better revocation of certificates and faster loading of sites and better privacy)
- https://blog.mozilla.org/secur... (better revocation of certificates)
- https://en.wikipedia.org/wiki/... (old browser finally dying)
- HTTP/2 is faster than HTTP and sort of depends on HTTPS for backward compatibility for old proxy servers and public websites
- finally we are getting rid of all the old protocols like SSLv3 and get our server configurations cleaned up
Especially for regular visitors of a site things are improving:
https://developer.mozilla.org/... (a CA can NOT issue a cert for a fake certificate - works in Firefox and Chrome)
https://en.wikipedia.org/wiki/... (always HTTPS, no HTTP on the second visit)
New things are always on the horizon
I don't think we should cede the rhetorical battle by letting them call it "header enrichment."
I say we call it "tracking injection."
They can talk about 'trusted partners' and 'optimising websites' all they want, but the main point here is that they are sending your phone number over HTTP. Anyone on a hop along the way or of course the end website and their 'trusted partners' can now link an IP address to a phone number. Via other cookies they can tie that IP address to your previous ones and suddenly they have a Phone Number to go with the previously anonymous browsing history and customer profile.
Just imagine if that irritating banner ad could actually call you! It really is a phenomenal breach of privacy and security.
Dammit! I had a good one.
> "Optus adds our customers' mobile number to the information in select circumstances where we have a commercial relationship with owners of particular websites."
Someone needs to tell the weasel at Optus pushing this excuse that they have a COMMERCIAL RELATIONSHIP WITH THEIR CUSTOMERS TOO.
This is worse than even just tracking cookie injection. A tracking cookie may be used to trace traffic back to a particular user, but there's generally nothing overly special about the cookie data.
In this case, the Telco is not only providing the ability to track you to the third party, but giving away your phone #. As if people don't get enough calls from phone scams and malvertisors already.
I'm sure they provide an opt-out so its not their fault, its the customers fault 100% they didn't opt-out.......
Jack of all trades,master of none
Mobile telcos have been doing this for years (at least a decade). But let me tell you right now, it's NOWHERE near as bad as it's being made out. Simply because the requirements to get on deck were so onerous, only a few people would bother with it at all.
For webmasters who would like to figure out how to serve/bill stuff to users on mobile websites, you've got to have some way of passing some kind of UID for the user connecting. For magazine/media sites trying to actually run a business, being able to serve stuff to users with the ability and inclination to pay for content was pretty important.
Back in the day before the iPhone (and I believe this was more common in the US than elsewhere), users on web-capable phones issued by carriers would start their browsers, and land on the carrier's home page or "home deck" (think WAP). I remember getting "on deck" (linked off the website at a carrier), was a massive pain in the arse, because you'd have to make sure the website work on their top 10 devices (a nuisance, because Netfront (and the phones it ran on) was a bigger piece of shit than Netscape 4 and IE6 combined), and then after all was said and done, you'd have to give the cellco a huge cut of any revenue you generated.
(Note that I'm limiting the discussion to websites linked off the cellco's front page; not 'off deck' stuff, like those old magazine ads flogging rubbish ringtones off premium rate phone numbers. That's a different story and the billing works a bit differently.)
Naturally, once you managed to get 'on deck', you'd get access to the cellco's billing infrastructure, which'd let you sell subscriptions and flog pay-per-event stuff like wallpapers and ringtones (which, back in the day, a rubbish poly ringtone costing £2.99, was HUGELY lucrative if you sold a few, and made SMSs seem like good value). But only after you managed to make it on deck (otherwise there's no traffic, and thus, no revenue). And then you still had to deal with a completely, utterly different billing interface for each carrier (some using transparent proxies, some using redirects, some using web services, etc). And of course, the dubious pleasure of dealing with the cockheads at the telcos themselves.
Naturally, to keep this going, the cellco would only flip the big switch to pass through your phone number to that particular website in very specific circumstances (like, a tiny number of very well known websites owned by very well-known companies (like Disney)). It's a whitelist -- and a small one. Hardly the scale of threat being implied by the lede.
This may be slightly off topic but I'm very careful whom I give my number to. I do get human calls from certain businesses like car servicing/hotel/insurance surveys and I'm comfortable with that as I gave them my contact number.
What gets me is I also receive calls from charities, solar sellers, telco sellers etc, so someone is trading my ph number. I have blocked these (many are voip) and currently I get none of them. However every time I'm asked for my number, I ask why and often refuse to give it to them as there are other ways they can contact me.
So you can be proactive here and not share your number especially if it is not required. Otherwise block, block, block!
Don't be apathetic. Procrastinate!