Re:UK network o2 send your number to every site you visit
by naz on Wednesday January 25, 2012 @04:31AM
(#3509060)
No site served over unencrypted HTTP can be considered trusted. So there's no circumstance under which they should insert this header, since they can't modify HTTPS requests.
[ Parent
| on HN ]
Re:UK network o2 send your number to every site you visit
by otoburb on Wednesday January 25, 2012 @04:39AM
(#3509081)
Consider the circumstance where a carrier portal sits on subnets owned by the carrier. In this case, unencrypted HTTP requests to the portal originating from the carrier's proxy are usually considered trusted.
In such a circumstance, carriers may consider this "trusted".
Re:UK network o2 send your number to every site you visit
by naz on Wednesday January 25, 2012 @04:48AM
(#3509106)
That's true. I imagine they'll be considering some third-party sites trusted too.
Re:UK network o2 send your number to every site you visit
by mdpye on Wednesday January 25, 2012 @08:56AM
(#3509688)
I believe that in cases where the third party site lies outside the carrier infrastructure and the header is plain text (some carriers encrypt the value), a carrier<->site operator VPN is required.
People shouldn't really be surprised that ALL mobile web traffic is heavily proxied (and transformed, by default). You probably wouldn't want to experience a direct net connection as flaky as mobile ones actually are.