7 ms·
"At the telelphony-infrastructure level, it’s a supremely difficult problem that lacks a short-term fix because the underlying protocol is hopelessly insecure."
by awakeasleep 8y ago
"At the telelphony-infrastructure level, it’s a supremely difficult problem that lacks a short-term fix because the underlying protocol is hopelessly insecure."
This is only partly true. Technologically the solution is difficult, but it's easy from the social side as carriers can blacklist the smaller carriers that allow this fraud to take place.
The real problem is that everyone except the consumer benefits from this. Every phone company in the chain from the scammer to you takes a penny out of the scammer's profits.
At this point these scam phone calls may be nearing the majority of the phone calls placed in the USA, so it's going to be a huge financial disruption to the carriers when they have to give up their game.
- tdeck 8y agoWhy hasn't there been a class action against carriers for failing to do anything about this problem?
- nradov 8y agoWhich law or contact term have the carriers broken?
- tdeck 8y agoNot sure. But they provide a service called Caller ID that purports to identity callers but can be trivially spoofed by people scamming their customers. Moreover, caller ID used to actually work (IE couldn't be trivially spoofed), so customers might have a reasonable expectation that it still does work. It's the telco's responsibility to present accurate caller information to customers.
- nradov 8y agoCaller ID could always be trivially spoofed. It's just that most scammers didn't previously bother to do it. Telcos currently have no legal responsibility to present accurate caller information to customers. That would require a new law.
- sixothree 8y agoWe could start by adding one.
- spenvo 8y agoI agree there’s a lot the carriers could be accomplishing in flagging “inauthentic” behavior of network participants, the root cause of SS7’s lack of authentication and encryption will remain and the problem will fester. Yes, carriers are definitely on the hook for making things better too. That said, the decisions in Apple's client side software are atrocious for the considerations of 2019. Aside: No idea why my post went from #1 on HN to the third page in under 30 minutes, I thought we were having a fruitful discussion here
- sofaofthedamned 8y agoI used to work in the mobile space for 7 years and i'm still amazed nobody has proposed and monetized a solution to SS7 being unfit for purpose. The reason it's not happened is nobody wants to spend money on even talking about the fix, never mind implementing it. The sheer number of scammers and nation state actors that have taken advantage of this is mind-blowing, but we still use SMS as a 2FA. If we have telephony providers responsible for these breaches the problem will disappear in 6 months.
- awakeasleep 8y agoI worry you're missing my point! It's not "spending money on the fix"... it's "killing our largest revenue stream"!
- sofaofthedamned 8y agoWasn't missing your point, we're on the same page, hence my point about personal responsibility being the solution. It's anologous to the web but that is on the way of being fixed - csrf, cors etc.
- gnicholas 8y agoThanks for posting! If I had to guess, the post dropped down because it tripped the flame war sensor, which I understand to be based on a ratio of comments/upvotes. When this happens inadvertently (not a true flame war), you can email the mods (hn@ycombinator.com) and ask them to look into it. They're very responsive!
- ac29 8y agoThere already is a proposed technological solution to this: https://transnexus.com/whitepapers/stir-and-shaken-overview/ https://transnexus.com/whitepapers/stir-and-shaken-overview/ The FCC has recently "demanded" US telecoms to implement this [0], but at this point I don't believe there is actually a regulatory requirement to do so. [0] https://docs.fcc.gov/public/attachments/DOC-354933A1.pdf https://docs.fcc.gov/public/attachments/DOC-354933A1.pdf
- StudentStuff 8y agoUntil there is a regulation requiring stir & shaken to be implemented, you won't be able to trust your caller ID. Most of the telecom industry is stuck on legacy tech stacks that they actively resist upgrading, thus why calls are slung bareback over the web with no encryption on the metadata or the audio stream for nearly all providers.
- amluto 8y agoI prefer an economic solution. Currently, you can sue a robocaller under the TCPA, but good luck collecting. Make each carrier liable for judgments against robocallers routed through their network. So, if I sue John Doe for robocalling me and I can’t collect, and I’m a Verizon customer, the make Verizon liable for those damages. This should come with some limits, but they should be large (say 10% of nationwide annual revenue, and there could plausibly be a limit per carrier that routes to Verizon). This liability should be unaffected by any terms in Verizon’s contracts with its customers (e.g. arbitration clauses), and telcos should not be able to penalize their customers in any way for collecting. I bet that a law like this would get the problem fixed fast.
- AJ007 8y agoThe phone companies don’t benefit, because they are nearing a situation where people stop communicating with phone numbers. Probably there is nothing that can reverse that at this point, the telephone has fewer features and is less secure than alternatives.
- nikanj 8y agoI’d be happy to have a SPF like framework for calls. The phone number blocks are allocated to companies, and it should be trivial to ensure the incoming call comes from the legitimate holder of the block. Add an authorized user api so you can still use your number in outgoing calls with Skype etc. After number faking is fixed, I can safely ignore all calls from foreign countries and weird area codes.
- Rjevski 8y agoI thought about a similar system but based on cryptography. The telecoms regulators for each country would act as a CA and have their root key capable of signing anything for that particular country code, and phones would have all of them in their trust store (it could be all managed by the GSMA or something). They would in turn issue certificates to any telecoms company that has number ranges allocated - those certs allow signing of calls for any of the number ranges the cert is for, as well as signing further certs. The telecoms company will in turn issue certificates for their customers for their assigned number only. It could be placed on the SIM card or distributed by email (perfect security isn’t needed here - “good enough” is all that’s required). When a phone places a call it signs it with its certificate and the current date & time (to avoid replay attacks), and any equipment in the call path can verify the chain of trust all the way back to a trusted CA before relaying the call. As the user still holds the end certificate, legitimate caller ID spoofing is still possible by them, but not anyone else.
- oh_sigh 8y agoHow do you handle number portability?
- grecy 8y agoThere are so many simple solutions to this it's not even a challenge. Here's some simple ones: 1. If you want to make more than ~5k calls per month from a number, you must deposit $50,000 for every 10k calls you wish to make. If your number gets reported more than some cutoff number of times, you forfeit this bond money. 2. Call throttling. As a certain number (or customer) makes more calls, the interval between calls is increase. Let's say something like after 5k calls per month you must wait 5 seconds between calls, with the interval increasing. Full disclosure, I worked at a telco for 4 years, but didn't do a lot with basic telephony.
- lsc 8y agoThe problem with both those suggestions is that it's trivial to fake the "from" phone number, as evidenced by the number of spam calls that share my area code and exchange numbers. (Last time I setup asterisk with a T1, this was also trivial, but that was like a decade and a half back. I couldn't tell you how to fake your number today.. it's just clear that it's easy for the scammers to do.) The first problem we need to solve is to make it hard to fake your number.
- geocar 8y agoIt's easy to fake the "caller-ID" field, but this doesn't fake the ANI: If it did, you could call 1-900 numbers and bill the White House. You're right about there being a lot of little legacy problems though; The issue I see is that the carriers aren't on the hook for it: They've made it so cheap to call someone these scammers simply need to find people whose time is worth less than mine.
- lsc 8y ago>This is only partly true. Technologically the solution is difficult, but it's easy from the social side as carriers can blacklist the smaller carriers that allow this fraud to take place. So, the MAPS RBL (and most of the following dns-based blacklists) did this for spam; and it helped a lot - I mean, I think it's the primary reason that ISPs don't actively serve spammers (spammers as defined by the RBL) On the other hand, it didn't solve the problem; if your mailbox isn't behind serious spamfilters, an address that has been on the internet for any period of time still gets hundreds of spam mails a day.
- notatcomputer68 8y ago>at this point these scam phone calls may be nearing the majority of the phone calls placed in the USA, so it's going to be a huge financial disruption to the carriers when they have to give up their game. That's a shortsighted perspective. phone numbers will only survive if they solve the spam problem. Many people don't pick up from unknown numbers anymore. It's just a matter of time before legitimate people stop trying to call as no one responds anyway.