>As the name fleetonline implies it is a service aimed at the corporate
>market and different conditions apply to our service which is aimed at
>parents.
Drivel. It is exactly the same service, but fleetonline offer a bit
more. The fleetonline system is marketed at companies, but it is
entirely suitable for monitoring families.
>Location based services aimed at the corporate market and
>location based services aimed at the parental market are subject to
>very different code of practice laid down by the UK mobile operators.
Oh, really? So yours is better because it is subject to a different
code of practice? Do tell how yours differs, and why it is suitable
for spamming here.
>For example, how are you going to validate the identity of the person
>using the service if he/she is using the service on a PAYG basis?
I can only assume that you have not used fleetonline. Their validation
system seems to work perfectly well.
> Do
>your want somebody to have access to a children tracking service where
>there is no way of knowing who the person is?
And do you have any way to ascertain the relationship between your
users and their targets? Remember that most child abuse is by
relatives: are you only accepting strangers, or do you make some other
value judgement?
>I am a parent and to be
>honest I can't believe you saying that there is no added safety in
>knowing where your child is.
Well, that's is exactly what I am not saying.
I am saying that there is no added safety in knowing where a child's
mobile phone is. that is most emphatically not the same as knowing
where the child is. A point you are repeatedly overlooking.
>You say the system is intrusive, well,
>as a parent, I have legal obligations on ensuring my child's safety
Do you? Can you cite the legislative basis for this statement?
>and if the child is under the age of 16 and I am the parent or legal
>guardian I decide on how much privacy is healthy for my child.
The courts take a different view. But we are not talking about you as
a parent, but you as a company ripping people off to the tune of £120
per year for a service that would be far cheaper from a competitor.
> You
>say it is a shitty deal but it does cost money to provide a safe
>system, and the measures we take far reach the measures some of the
>fleet tracking services take with regards to minimising the
>possibility that somebody will abuse the service.
So tell me: what, exactly, do you do to make sure that a parent,
uncle, or other relative (or non-relative) who will track a child is
not likely to abuse that information?
Fleetonline requires the explicit opt-in of the "person" being
tracked, and they can opt out at any time. Are you suggesting that you
do more?
The only difference I can discern is that you send "reminders" to the
target to say how to opt out. That'd be really handy if they have been
abducted, or (more likely) their phone has been stolen!
>I suggest you
>actively compare the services available before you jump to conclusion.
Not bloody likely. I have no intention of buying from a spamming
rip-off merchant.
I have, however, looked at the details you give on your web site. You
say that you confirm the applicant's address and credit card details.
Nothing about checking any other bona fides. I strongly suspect that
there are no checks made whatsoever.
The differences between you and fleetonline seem to be that they offer
it on a PAYG basis (more suitable for low usage) they charge less
(even for heavy use) and they don't spam newsgroups with their
product.
You offer every user a list of other users who have tracked the same
target through your system. This has some potential confidentiality
implications.
Unless you can point out one other feature that your service offers
that fleetonline does not, I shall draw my own conclusions about your
product.
Iain

Signature
Iain
the out-of-date hairydog guide to mobile phones
http://www.hairydog.co.uk/cell1.html
Browse now while stocks last!
> Location based services aimed at the corporate market and
>location based services aimed at the parental market are subject to
>very different code of practice laid down by the UK mobile operators.
>For example, how are you going to validate the identity of the person
>using the service if he/she is using the service on a PAYG basis?
The same woeful, insecure way you do now - spoofing the from address
on an SMS is too easy - bu that can still easily be done on a PAYG
basis - ie you just charge X pounds to set the service up, then Y
pounds per use. There's no more security implications than your
current behaviour
Since you've obviously missed my previous comments in the thread, how
do you ensure that the message sent from the childs mobile has
anything to do with coming from that phone?
Jim.
Matthew Haigh - 13 Oct 2003 08:46 GMT
>> Location based services aimed at the corporate market and
>>location based services aimed at the parental market are subject to
[quoted text clipped - 4 lines]
>The same woeful, insecure way you do now - spoofing the from address
>on an SMS is too easy
Whilst changing the origination address on an SMS is almost trivially
easy with the right access to the network (I should know!), the network
will know if that message originated on one of it's handsets or not.
Whether this knowledge is used in protecting against malicious sign-up
to a location service or not I don't know.
>Since you've obviously missed my previous comments in the thread, how
>do you ensure that the message sent from the childs mobile has
>anything to do with coming from that phone?
As above, it is visible to the network, but I don't know if that gets
passed on to people like childlocate. You would HOPE the networks are
security conscious about this so that 3rd party service providers don't
have to be fully up to speed to have a secure service.
Matt

Signature
Matthew Haigh --$matthaigh{News04}$@haigh.org--
GCRSoft, providing SMS solutions since 1996...
http://www.gcrsoft.com http://www.moretext.com