4 ms·

So the article doesn't seem to mention any of the ongoing efforts to stop or reduce caller ID spoofing, such as SHAKEN/STIR. I'm not clear if that will do anyth

So the article doesn't seem to mention any of the ongoing efforts to stop or reduce caller ID spoofing, such as SHAKEN/STIR. I'm not clear if that will do anything, and it's certainly far too little too late, but the industry is doing something. On that note, does anyone know how SHAKEN/STIR is supposed to work? I understand that it basically sets up a PKI with JWTs in SIP headers, but from what I can tell there needs to be some sort of trusted CA which creates and signs these things, but I can't tell who that CA is or if there even is an agreed upon central CA. I'd also be interested in any corrections/expansion on any of the things I said above, I really don't know much about it and would like to. edit: after making this comment I did a bit more research, and it looks like[0] there will be per-country CAs that can issue certificates to owners of phone numbers within that country. I'm specifically curious about which CAs will be trusted in the United States. [0]: https://tools.ietf.org/id/draft-burger-stir-iana-cert-00.html https://tools.ietf.org/id/draft-burger-stir-iana-cert-00.htm...

thwythwy 8y ago
Quick correction, I don't think "doing something" (italics omitted) is the legal standard for regulatory intervention
- markovbot 8y ago
  Right, I didn't mean to imply that this action by the FCC was in any way wrong. The fact that caller ID is completely unauthenticated in 2019 is horrifying, and regulation is long over due.
deleted 8y ago
[deleted]
toast0 8y ago
Authority for the North American Numbering plan currently falls to the FCC, after the breakup of AT&T; they contract out administration, Ericsson got a 5 year contract in 2017, previously it was administered by Neustar (and Lockheed Martin, before Neustar was spun out). I'd imagine Ericsson would spin up a new CA instance just for this. As the administratior, they keep the records of who phone numbers are assigned to, and where they've been ported. My understanding is once a +1 area code is allocated to a country, that country's telecoms regulator manages further allocations (or contracts it out).
- markovbot 8y ago
  Cool, thanks for the info. Any idea what the timeline on creating that CA is?
  - toast0 8y ago
    No idea. I wasn't aware of this proposal (STIR), I just am aware of a lot of number allocation stuff. Does STIR have any support from telecoms companies and/or ITU? Or is it IANA only? I see Neustar has a page that seems related: https://www.home.neustar/atis-testbed/index.php https://www.home.neustar/atis-testbed/index.php ?
    - markovbot 8y ago
      From what I can tell, the telcos are implementing it, or at least say they are: * "Caller Verified is T-Mobile’s implementation of the STIR and SHAKEN standards" [0] * "Verizon reiterates both our commitment to deploying the STIR/SHAKEN call authentication technology" [1] * "Sprint supports efforts to build the SHAKEN/STIR call authentication system" [2] * AT&T doesn't seem to mention STIR or SHAKEN by name on their robocall page [3] but the FCC sent them a letter thanking them for their "commitment to implement a robust call authentication framework in 2019" [4] * "Comcast is proud to be at the forefront of efforts to address the scourge of illegal spoofed robocalls in this country, including the development of the end-to-end call authentication protocol known as SHAKEN and STIR" [5] etc [0]: https://www.t-mobile.com/news/caller-verified-note9 https://www.t-mobile.com/news/caller-verified-note9 [1]: https://ecfsapi.fcc.gov/file/1119062987519/2018%2011%2019%20Verizon%20Call%20Authentication%20Framework%20WC%20Docket%20No.%2017-97.pdf https://ecfsapi.fcc.gov/file/1119062987519/2018%2011%2019%20... [2]: https://ecfsapi.fcc.gov/file/1091391175368/Sprint%20Call%20Authentication%20Comments.pdf https://ecfsapi.fcc.gov/file/1091391175368/Sprint%20Call%20A... [3]: https://about.att.com/sites/cyberaware/ae/robocall https://about.att.com/sites/cyberaware/ae/robocall [4]: https://docs.fcc.gov/public/attachments/DOC-354933A2.pdf https://docs.fcc.gov/public/attachments/DOC-354933A2.pdf [5]: https://ecfsapi.fcc.gov/file/111974588343/Comcast%20Resp%20to%20Chmn%20Pai%20re%20SHAKEN%20STIR%20(11-19-18).pdf https://ecfsapi.fcc.gov/file/111974588343/Comcast%20Resp%20t...
rhizome 8y ago
That's a nice effort, but I think the phone company should be required to itemize each call's billing information by default. Perhaps the billing number (the number obscured by spoofing) on every bill, with the rest available by request or on the website (to save paper). But all in all, the problem is that the phone company will refuse to help unless required by law. They make good money from shitty robocallers.
jzl 8y ago
More info on SHAKEN/STIR: https://transnexus.com/whitepapers/understanding-stir-shaken/ https://transnexus.com/whitepapers/understanding-stir-shaken... http://nymag.com/intelligencer/2018/05/how-to-stop-spam-robocalls-with-stir-shaken.html http://nymag.com/intelligencer/2018/05/how-to-stop-spam-robo...

thwythwy 8y ago

Quick correction, I don't think "doing something" (italics omitted) is the legal standard for regulatory intervention

markovbot 8y ago
Right, I didn't mean to imply that this action by the FCC was in any way wrong. The fact that caller ID is completely unauthenticated in 2019 is horrifying, and regulation is long over due.

deleted 8y ago

[deleted]

toast0 8y ago

Authority for the North American Numbering plan currently falls to the FCC, after the breakup of AT&T; they contract out administration, Ericsson got a 5 year contract in 2017, previously it was administered by Neustar (and Lockheed Martin, before Neustar was spun out). I'd imagine Ericsson would spin up a new CA instance just for this. As the administratior, they keep the records of who phone numbers are assigned to, and where they've been ported. My understanding is once a +1 area code is allocated to a country, that country's telecoms regulator manages further allocations (or contracts it out).

markovbot 8y ago
Cool, thanks for the info. Any idea what the timeline on creating that CA is?
- toast0 8y ago
  No idea. I wasn't aware of this proposal (STIR), I just am aware of a lot of number allocation stuff. Does STIR have any support from telecoms companies and/or ITU? Or is it IANA only? I see Neustar has a page that seems related: https://www.home.neustar/atis-testbed/index.php https://www.home.neustar/atis-testbed/index.php ?
  - markovbot 8y ago
    From what I can tell, the telcos are implementing it, or at least say they are: * "Caller Verified is T-Mobile’s implementation of the STIR and SHAKEN standards" [0] * "Verizon reiterates both our commitment to deploying the STIR/SHAKEN call authentication technology" [1] * "Sprint supports efforts to build the SHAKEN/STIR call authentication system" [2] * AT&T doesn't seem to mention STIR or SHAKEN by name on their robocall page [3] but the FCC sent them a letter thanking them for their "commitment to implement a robust call authentication framework in 2019" [4] * "Comcast is proud to be at the forefront of efforts to address the scourge of illegal spoofed robocalls in this country, including the development of the end-to-end call authentication protocol known as SHAKEN and STIR" [5] etc [0]: https://www.t-mobile.com/news/caller-verified-note9 https://www.t-mobile.com/news/caller-verified-note9 [1]: https://ecfsapi.fcc.gov/file/1119062987519/2018%2011%2019%20Verizon%20Call%20Authentication%20Framework%20WC%20Docket%20No.%2017-97.pdf https://ecfsapi.fcc.gov/file/1119062987519/2018%2011%2019%20... [2]: https://ecfsapi.fcc.gov/file/1091391175368/Sprint%20Call%20Authentication%20Comments.pdf https://ecfsapi.fcc.gov/file/1091391175368/Sprint%20Call%20A... [3]: https://about.att.com/sites/cyberaware/ae/robocall https://about.att.com/sites/cyberaware/ae/robocall [4]: https://docs.fcc.gov/public/attachments/DOC-354933A2.pdf https://docs.fcc.gov/public/attachments/DOC-354933A2.pdf [5]: https://ecfsapi.fcc.gov/file/111974588343/Comcast%20Resp%20to%20Chmn%20Pai%20re%20SHAKEN%20STIR%20(11-19-18).pdf https://ecfsapi.fcc.gov/file/111974588343/Comcast%20Resp%20t...

rhizome 8y ago

That's a nice effort, but I think the phone company should be required to itemize each call's billing information by default. Perhaps the billing number (the number obscured by spoofing) on every bill, with the rest available by request or on the website (to save paper). But all in all, the problem is that the phone company will refuse to help unless required by law. They make good money from shitty robocallers.

jzl 8y ago

More info on SHAKEN/STIR: https://transnexus.com/whitepapers/understanding-stir-shaken/ https://transnexus.com/whitepapers/understanding-stir-shaken... http://nymag.com/intelligencer/2018/05/how-to-stop-spam-robocalls-with-stir-shaken.html http://nymag.com/intelligencer/2018/05/how-to-stop-spam-robo...