3 ms·
> The problem with SS7 is that you extend your SMTP analogy, there is no way to implement the equivalent of SPF, DKIM and DMARC for verification of incoming tra
by zrm 8y ago
> The problem with SS7 is that you extend your SMTP analogy, there is no way to implement the equivalent of SPF, DKIM and DMARC for verification of incoming traffic without breaking SS7-to-SS7 links between the vast majority of installed phone switching gear out there on the PSTN.
Why not? That's how it was done for email. SPF doesn't prevent interoperability for sending domains that don't use it or recipients that don't verify it. What it does is inhibit forged messages from a domain that does use it to a recipient that does verify it.
Then the more senders who have an SPF record, the stronger a spam signal it is for a domain to not have one, and the stronger the incentive gets for senders to use it. It's already in the recipient's interest to verify it when it's used.
They could even use DNS for this exactly like email. Create a lookup zone equivalent to in-addr.arpa but for phone numbers.
- walrus01 8y agoBecause it's a huge installed base of non-upgradeable equipment that is 15, 20, 25 years old. People doing oldschool SS7 telco stuff are just not going to upgrade. They'll sue their upstream carriers if they suddenly cut them off because their new re-implementation of SS7 is incompatible with their old gear. I'm a senior network engineer for a mid sized regional ISP, and encounter this shit on a fairly regular basis. It is not as simple as getting everyone who runs public facing smtpd on the Internet to upgrade their software and practices. Telco and PSTN phone stuff is the very opposite of being up to date and continually evolving best practices for security.
- zrm 8y agoIt isn't the upstream forcing the upgrade. It isn't forced at all. You can keep using your old equipment as long as you want. But there would come a point that enough people are using the new protocol that recipients start auto-blocking calls from anyone who doesn't use it. You may not even have to upgrade the old equipment. For an out of band protocol, the upstream may be able to implement it for you.
- paulie_a 8y agoCut them off unless they upgrade, their upstream probably has that option in the agreement anyways. Ptsn should just die. The technicians and customer service are so incompetent that every day I had to call to get a line disabled at the switch because it got re-enabled. After a hundred days in a row I finally just shorted the damn line and problem solved.
- ubernostrum 8y agoWhen you get a scam call, you know that somewhere there is a company that got paid for that call, because telcos -- even and really especially scummy shady scam-enabling telcos -- don't offer access to their network for free out of the goodness of their hearts. Turning those companies into smoking holes in the ground doesn't require anyone to upgrade their equipment. All it takes is willingness on the part of lawmakers and regulators to track them down and make them regret their business practices.