46 ms·

FCC will require phone carriers to authenticate calls by June 2021 [pdf]

929 points by hbcondo714 7y ago

webkike 7y ago
If you’re wondering if STIR/SHAKEN was a James Bond reference, the answer is yes, and SHAKEN stands for “Signature-based Handling of Asserted information using toKENs”
- nsxwolf 7y ago
  Backronym writing is a real gift.
  - deleted 7y ago
    [deleted]
- aasasd 7y ago
  I vaguely wonder sometimes as to what's the origin of the extreme US cheesiness with these names. Like, it's elementary-school level kitsch. So far my guess is ‘the forties’. Or maybe the fifties, with all the ‘atomic’ ridiculousness.
  - aasasd 7y ago
    However, I gotta say I like the semantics where the more emotionally positive the title, the worse the actual bill is. Other countries tend to hide that behind uninformative titles or just numbers, so you have to read the actual bill to figure out if it's good or bad. With the US, you can be sure that a ‘GOODTHING’ bill would be something from 4chan. The name in the post seems pretty emotionally neutral.
- plandis 7y ago
  Really missed out on the opportunity to have STIR/SHAT
mulmen 7y ago
Does this mean I can start answering my phone again? Are there other vectors for spam calling which are not addressed by this solution?
- gjs278 7y ago
  you can start answering your phone now
- PunksATawnyFill 7y ago
  Good question. I recently started getting Internet-originated SMS spam on AT&T, which Verizon gave consumers the means to block a decade ago. When confronted with it, AT&T whined that they can't block it... which is absolute bullshit. Not only does Verizon let you block it, but it isn't even shown as coming from a phone number, but rather a GMail address or other non-numeric source. So obviously this pattern could be used to filter it. AT&T also pummels customers with multiple texts for several days a month to tell them that there's nothing wrong with their accounts. No exaggeration: They badger you to tell you that your monthly auto-pay is going to happen, and then WHOA it DID happen! They wake you up for this, and insist on sending these idiotic notices via TEXT and not E-mail. Again, when confronted on it, AT&T whined that they can't do anything, and that customers should put themselves on the Do Not Call list... which expressly ALLOWS companies you DO BUSINESS WITH to communicate with you. AT&T: hating its own customers.
- 0xff00ffee 7y ago
  After 15 years of cell phone spam, anything that shows up as a number on my personal phone, and not a contact, is reflexively ignored. I don't think I'll ever shake this habit: if it is important, they will leave a message.
  - SketchySeaBeast 7y ago
    I'm struggling with the decision of whether to automatically block anyone not in my contact list and leave a message in my voicemail explaining why. Don't want to be unfriendly, but it's only getting more ridiculous.
ilamont 7y ago
Kind of curious why it took so long. Spoofed calls for fraud, swatting, etc. have been around for at least ten years.
- nsxwolf 7y ago
  Longer than that. As long as ISDN/T1 PRI lines have been around. A completely unhindered spoofing playground.
- closeparen 7y ago
  Why it took so long to get all the participants in a federated network to adopt a new protocol? If that were easy we would have solved email spam too, 20 years ago.
  - user5994461 7y ago
    and indeed gmail has fixed email spam for almost 20 years.
    - unishark 7y ago
      Spam filtering is based on the content of email. To translate this (partial) success to phones, we'd have to let a private 3rd party monitor phone conversations, record them on its server indefinitely for training their AI, and screen them for us based on what the caller is actually saying to us.
- deadmutex 7y ago
  The problem had gotten worse due to easily available tools used to automate the calls.
- tommoor 7y ago
  Only in recent years has the FCC been inundated with complaints about it. Seems like there was a tipping point in volume the last couple of years
- gnopgnip 7y ago
nsxwolf 7y ago
Is this going to impact PBX systems that use ANI Information Elements to route calls and provide caller information to customer service applications, etc? Spoofing is kind of at the heart of those things.
- annoyingnoob 7y ago
  I guess you are not spoofing when you are using your assigned DIDs and not just making up any old number.
- skrtskrt 7y ago
  ANIs will still get "spoofed" as there are many legitimate use cases, but you have to "have permission" to use the number you're spoofing, meaning either you own the number or your underlying service provider owns it on your behalf. The legitimate use case is basically: I am placing this outbound call over VOIP or a different phone line, but I want this ANI to show up on the callee's phone, so when they call back they go to the correct line (dentist's desk, software sales line, whatever)
  - deleted 7y ago
    [deleted]
  - phs2501 7y ago
    The issue is when I have a automated answering system (asterisk, for a museum). It rattles off some prerecorded info, possibly with prompting. To talk to a human, I need to forward the caller (I.e. call and set up a voice bridge since the caller is already connected to me) to one of our volunteers, which will be to their cell phone (we are a railway museum and we don't have a staffed office on weekdays). I want to forward the call with the original caller's phone as the caller ID so that if they miss the call our volunteer can call back easily rather than trying some awful game of tag via calling back the PBX.
    - skrtskrt 7y ago
      This should still be available, though it will likely take some work from the underlying software provider to be compliant. The goal of the regulation is to cut down spam/scam calling, not legitimate uses, and the telecom providers know these uses and lobby heavily to make sure they'll still be allowed to work. The telecom providers don't like scam calls either, or more specifically they don't like short calls. All the work and compute power in telecom is used to set up the call, then the cost of keeping it going is minimal so the longer the call goes on, the more economical it is for the provider
0xff00ffee 7y ago
Google Voice impact?
- kirykl 7y ago
  Maybe a registry of parties trusted to spoof
  - deleted 7y ago
    [deleted]
  - markovbot 7y ago
    What parties are trusted to spoof? Having a telecom industry group play favorites with who is and isn't allowed to spoof anyone's phone number sounds like it would be bad.
- markovbot 7y ago
  are you asking if this will impact Google Voice? If so, I would imagine the answer is almost certainly that it will not at all impact Google Voice. Google Voice works by acting as a proxy for outbound calls. You dial your friend's number, your phone dials Google, who in turn dials your friend with your Google Voice number displayed. Since Google is the legitimate carrier for your Google Voice number, I can think of no reason why they wouldn't be able to correctly sign the call. Additionally, Google is listed as one of the companies that the 14 companies that the FCC appears to be working with (see the table towards the bottom of https://www.fcc.gov/call-authentication https://www.fcc.gov/call-authentication), so I assume they are planning to use it for Fi and hopefully Voice as well.
  - pandaman 7y ago
    Google voice also acts as a proxy for inbound calls. Your friend dials your GV number, GV dials your other phone number, which does not belong to Google and uses your friend's number (which may or may not belong to Google) as the caller ID. From the point of view of your telco, who services your phone number, Google is spoofing your friend's number unless your friend happened to call using another GV number.
annoyingnoob 7y ago
There is something else that recently reduced the spam calls I get, enforcement: https://arstechnica.com/tech-policy/2020/02/fcc-accuses-carriers-of-being-gateways-for-foreign-robocallers/ https://arstechnica.com/tech-policy/2020/02/fcc-accuses-carr... Knowing a number is legitimate is great, going after scammers and those that support them is better.
ronack 7y ago
Will this also prevent spoofed text messages?
- RKearney 7y ago
  I have never received a spoofed SMS message so I already thought this was impossible.
  - ronack 7y ago
    It's definitely a thing and prevent some SMS use cases due to this security hole. This new FCC doc only references tracing the original sender. "The FCC has also called on the industry to “trace back” illegal spoofed calls and text messages to their original sources."
- DaniloDias 7y ago
  It will not. These concepts could be applied towards that purpose if the MNOs wanted to rejigger messaging within their networks & for inter-carrier connectivity- but pursuing that solution would likely be more challenging to implement than this solution.
zubi 7y ago
For those who don't live in the US, this entertaining video by John Oliver might give some context: https://www.youtube.com/watch?v=FO0iG_P0P6M https://www.youtube.com/watch?v=FO0iG_P0P6M
- 7ewis 7y ago
  Ironically, the video is only available in the US. Had to hop onto my VPN to view. Edit: Ok, at least not viewable in the UK!
  - zubi 7y ago
    Interesting. I was able to watch it from somewhere not in the US before posting.
  - selectnull 7y ago
    I'm not in the US and I'm able to watch it. Maybe it's not available in your country, but it is available in at least one other country than US.
g_p 7y ago
Sounds like a good first step to solve the problem of how the legacy telecoms systems were designed in a world of trusted peers federating. End result of course being spoofed caller ID spam. Unless I'm missing something though, these measures don't do anything to address the gaping security hole in mobile networks around roaming interconnects. That seems to still be a pretty good way to do SMS and call interception, which are increasingly valuable as phones become the de-facto 2FA channel for access to banking, cryptocurrency services and more.
Negitivefrags 7y ago
Why is this problem unique to the USA? I'm not saying I never get spam calls, but I certainly have to scroll back quite a bit in my phone call history to see the last one. Also, on the rare occasion I do get a spam call it's always from some random international country like South Sudan or Oman that I would never expect a phone call from. What makes this problem uniquely hard to solve for the USA as opposed to anywhere else?
- devonbleak 7y ago
  Embedded corporate interests and lobbies fighting against solutions because it'll cost them money to implement or lower their revenue once implemented. The usual.
  - throwaway894345 7y ago
    What solutions does Europe, etc have that the US doesn't? Genuine question.
    - michaelbuckbee 7y ago
      A working legislature?
      - throwaway894345 7y ago
        Clever. What solutions has said legislature come up?
        throwaway894345 7y ago
        *come up with? (apparently I missed the edit window)
    - thomasfortes 7y ago
      Don't know about Europe, in Brazil spam calls are common but you can register your number in a consumer protection organ to say that you do not want unwanted commercial calls and if you keep receiving them the companies can be fined, for me it works "ok", there still companies that don't give a shit but at least the amount of calls I receive was reduced a lot...
hirundo 7y ago
90% of my phone calls are from the same outfit informing me that this is my last chance to renew the extended warranty on my car. Based on my call history that recording is officially my best friend. And a very forgiving one given that it has been my last chance hundreds of times over the past several years. I hope this regulation won't interfere with our relationship.
- JumpCrisscross 7y ago
  > the same outfit informing me that this is my last chance to renew the extended warranty on my car I get this too. Which is great, my being a New Yorker who hasn’t had a driver’s license for close to a decade.
  - pathseeker 7y ago
    What do you use for an ID? Passport card? State issued ID?
    - JumpCrisscross 7y ago
      > State issued ID? This.
    - mumblemumble 7y ago
      A non-driver's state ID works for everything you'd use a driver's license for except operating a motor vehicle. Even though people typically say, "Driver's license" when they really mean either kind of state-issued ID card.
      - koheripbal 7y ago
        Isn't a driver's license nearly as easy to renew as a non-driving state ID? I don't see the point, even if you only need to rent a car on rare instances.
        II2II 7y ago
throwaway55554 7y ago
Not soon enough.
megavolcano 7y ago
I swear to god the number of times I've hung up on people threatening visits from the FBI because I'm behind on my taxes (spoiler: i'm not) has been driving me literally insane. Maybe I can actually turn my ringer on my phone off of silent mode one day.
imajoo 7y ago
You can see various carriers responses here: https://www.fcc.gov/call-authentication https://www.fcc.gov/call-authentication Some have provided timelines (such as AT&T), others skirt around it basically saying that they offer call SPAM protection already but that they will go along.
hammock 7y ago
What are the privacy implications of this requirement?
- DaniloDias 7y ago
  None. You are already in a weak non-repudiation environment with cell phones. This solution will reduce some spoofing, but I doubt it will eliminate it. It will be interesting to see who will be running the CA for these connections.
- actionowl 7y ago
  I was wondering the same thing, then remembered that I have no expectation of privacy when using a phone anyways... that's where we are today. bleh.
bigbird-media 7y ago
Summary: The Federal Communications Commission adopted new rules requiring caller ID authentication using technical standards known as “STIR/SHAKEN.” These rules will further the FCC’s efforts to protect consumers against malicious caller ID “spoofing,” which is often used during robocall scam campaigns.
- dmurray 7y ago
  This made me check the date, but it's still March 31 in the US.
hkiely 7y ago
Is this now just a problem on mobile phones in the USA now that we have the no call list legislation?
- reaperducer 7y ago
  Is this now just a problem on mobile phones in the USA now that we have the no call list legislation? The Do Not Call list has been around for almost 30 years. https://en.wikipedia.org/wiki/Do_not_call_list https://en.wikipedia.org/wiki/Do_not_call_list
davidajackson 7y ago
I don't think SHAKEN/STIR will stop robocalls, because the economics won't change. It's too easy for foreign robocalls to cycle numbers once one gets blocked. It will help with impersonation, but I don't believe it will significantly decrease robocall volume. I think the telecommunications world will need to adopt whitelisting instead of blacklisting. I run a whitelist-based robocall blocking service called CallStop and a lot of customers have straight up given up using their landline, or their personal number with unknown numbers. People who claim that whitelisting is a bad solution because it could block an emergency call don't realize that many people don't answer unknown calls anymore--and I don't think SHAKEN/STIR will change that.
- ehsankia 7y ago
  Can you extend a bit on that, maybe I'm not understanding the problem right. Isn't having calls being authenticated the first step before you have whitelist/blacklist? Once every call can be definitively attached to a given source, then you can ban any foreign provider that let's these proliferate completely, no?
  - davidajackson 7y ago
    SHAKEN/STIR + Whitelisting is the best solution. SHAKEN/STIR by itself isn't going to change things too much I think. But it is a step in the right direction. Whitelisting without SHAKEN/STIR is still extremely functional. There are billions of unique American numbers possible, and with 250-500 average contacts per random dial, contact spoofing is not statistically significant.
    - fortran77 7y ago
      Not when you can contact spoof banks, major drug store chains, AppleCare, etc.
      - davidajackson 7y ago
        Good point, if they're calling from a specific number. I see of lot of complaints about companies like FedEx though, where the calls come from random numbers.
Cymen 7y ago
Any ideas on how this will be implemented? I use voip.ms and I can put in my cell phone number as my caller ID so I don't need to pay for a DID (basically, rent a phone number) and calls come back to my cell. I've thought about some potential SaaS products that would leverage a similar approach. But I would authenticate the number back to the customer before allowing it to be used to avoid spam/malicious use. Based on this: https://www.zdnet.com/article/at-t-comcast-successfully-test-shakenstir-protocol-for-fighting-robocalls/ https://www.zdnet.com/article/at-t-comcast-successfully-test... I'm guessing this is down a layer at the provider level. So in my case, voip.ms would verify the number I'm using as my caller ID is actually a number that comes back to me. Right now, I just tested by swapping my wife's cell number in, they do not validate this. Now I understand how people are spoofing numbers so easily. Obvious approach is to voice call or text the number and require the confirmation code to be entered on the website. Just curious though if there are other requirements or if this is up to the provider.
cryptonector 7y ago
About time. How will SS7 get fixed though?
wbsun 7y ago
Finally, although there are still more than a year to wait. Hope there won't be any extension to this deadline. Before that, I'll keep allowing calls from my contacts only, and bear the miserable inconvenience that sometime my packages may take a month to arrive because of denials of calls from the delivery guy.
- devindotcom 7y ago
  There is in fact an extension for small providers who say they need more time.
negus 7y ago
It is bad news for the US citizens indeed. Unauthenticated phone number is the last island of privacy in our modern world. Think about it: from some point all citizens will carry a geolocation tracking device that is directly linked with their ID. The internet access will also be bound to your ID and so on. There are better ways to fight spam that do not pose a treat to privacy -- think about email or Facebook. There were tons of spammers, but there are commercial spam filters that do well now. I live in a country where cellphone carriers are legally forced to authenticate users. And this data is used against political opposition and journalists.
- VectorLock 7y ago
  Does this mandate do that? It seems like it just enforcing STIR/SHAKEN to prevent spoofed numbers. It doesn't, at least from what I can see, mandate any tying of identity to number. Your 7-11 burner phone and prepaid AT&T number should be fine.
- jeremyjh 7y ago
  No. Per TFA: STIR/SHAKEN enables phone companies to verify that the caller ID information transmitted with a call matches the caller’s phone number.
  - negus 7y ago
    Well, I misunderstood the point. Thanks for the clarification
- beervirus 7y ago
  No one except robocallers uses this “feature” anyway.
mehrdadn 7y ago
Can someone explain what this will translate into in terms of the end-user experience? For one thing, authentication will be next to useless (at least to me) if my phone is still going to ring. So does that mean it's not going to ring for a spoofed number? Also, if it results in tons of voicemail then that's still going to be quite annoying. (How) is the actual end-user experience going to be addressed?
- r00fus 7y ago
  Maybe I'm missing something but if authentication is allowed, it will allow the client or carrier to block calls based on authenticated ID accurately. RN that's effectively impossible.
  - mehrdadn 7y ago
    Yeah I get that, but I'm asking what a user should expect to actually happen by that time, not what a user should expect to be theoretically no longer impossible by that time.
- g_p 7y ago
  From my understanding, spoofed calls won’t get onto your carrier’a network under this model, let alone ring your phone. All this assumes that sorting out spoofing resolves the problem, which isn’t guaranteed.
  - mehrdadn 7y ago
    I thought they still go through to the carrier? Just under a different attestation level: https://www.bandwidth.com/glossary/stir-shaken/ https://www.bandwidth.com/glossary/stir-shaken/
    - g_p 7y ago
      Thanks, that link is a much better overview. It seems the calls will still reach the destination network, and the phone then, but with potential for the operator to signal the likelihood of it being an unwanted or spoofed call. I imagine we will see a tickbox in the operators apps and web settings portals to block or send such calls straight to voicemail (or similar), as they'd be able to be distinguished via the reduced attestation level.
ugh123 7y ago
I didn't see anything in there about penalties for carriers not enforcing this. Also willing to bet they beg for extensions claiming they're not ready - or too costly to implement.
- ableal 7y ago
  Good point. I suspect carriers tolerate scammers because they're good for the bottom line.
  - rhizome 7y ago
    If my mom's bill is any indication, the telco's getting ~$40 for each landline. Not sure what a voice T1 goes for these days.
  - jazzyjackson 7y ago
    The same way USPS is funded by junk mail, a large volume of Telecoms' voice calls is likely robo-caller spam. Still I would have thought either Verizon or AT&T could come up with a competitive advantage of, you know, "the number that comes up on caller ID is authenticated to actually be the person paying for that phone number" The spoofed caller ID to match your local area code has landed on people in my contact list, and it was extremely jarring to think "why is my best friend's mom calling me out of the blue" and get offered a discount cruise by a robot.
    - Simon_says 7y ago
      Telecoms have no problem figuring out who to bill.
  - 0x00000000 7y ago
    When I got a new phone, I got a text saying that I was on a free trial of Verizon’s spam call blocking service. Needless to say they have every reason to remain complicit
- equalsione 7y ago
  New legisation is being enacted around this on an ongoing basise: e.g H.R. 4998 was introduced about two weeks ago All the major carriers are implementing a STIR/SHAKEN strategy that should be in effect by next year. But it is complicated to do and there may still be problems when they do - as others have explained here it's not as simple as it first appears. I don't have any sympathy for the operators in this. They've profited from this for long enough and ignored the problem. There's a lot of pressure on them to solve it and the impression I have is that there's no appetite for "the dog ate my homework" excuses from regulators so let's see.
cletus 7y ago
Good. But really, why did this take this long? It should be relatively easy to identify the bad actors here and I don't mean the spammers, I mean the telcos that make this possible, deliberately so, by essentially "laundering" spam calls. My response to picking up a number is to answer the call and say nothing. Auto-dial systems will route the call to a person when they get a "live" response. I don't know the criteria but I'm pretty sure it's them detecting noise on the call (which could be voicemail). A human calling will wonder what is happening and fill the silence by saying something. A machine will not. I hang up within 6 seconds of this in the hopes that it affects some metric somewhere of this being a low-quality or spam call. I don't know if it does. I think I read somewhere once that it did. I could be wrong. If a real human is on the other end and does say nothing in this window, they'll generally just call right back. You get the exact same number again then this time I'll answer it. It is nice to filter contacts vs non-contacts but there are too many things on non-contacts. Businesses you deal with, primarily. In the email world where obviously spam is a huge problem zombie relays that allow this (which I believe is the primary source?) can get blacklisted. Why don't telcos who do this also get blacklisted? Or at least identified? This isn't AT&T or Verizon. It's the little telcos that connect to them. But is this all too little too late? I think we've discovered over the last 20 years that we're all pretty much over open networks. It's all opt-in now with the likes of Whatsapp, FB Messenger and so forth. Oh and while we're at it, can we get rid of this stupid exemption to robocalling restrictions for political campaigning? It's defended as "political free speech". To me, this is nonsensical. Free speech doesn't mean that I should be forced to listen to it. EDIT: Found an example [1] of the bad actors I'm talking about. [1]: https://www.theverge.com/2020/1/31/21117477/justice-department-telecom-scams-robocalls https://www.theverge.com/2020/1/31/21117477/justice-departme...
- kbuck 7y ago
  Regarding robocalls from political campaigns: I removed my phone number from my voter registration, because honestly I don't want any calls or texts from campaigns. I left my email address in case they want to spam that. I recommend doing the same (although at least with Gmail I find that several of the political emails end up in the spam folder...)
- throwanem 7y ago
aalebel33 7y ago
and all it took was a pandemic
- markovbot 7y ago
  is there any reason to believe this is anything other than the next step in a long, slow-moving process? SHAKEN/STIR has been being rolled out for a few years now, IIRC most major players said they were going to have it deployed by the end 2019 (see response column of table towards the bottom of https://www.fcc.gov/call-authentication https://www.fcc.gov/call-authentication), now they're just setting a deadline of June 2021 to start authenticating calls.
jccooper 7y ago
Good. That'll solve a lot of problems. Spoofers are about the only thing that gets through my spam filters now.
tiffanyh 7y ago
How do services like Twilio stay compliant with this regulation?
- davidajackson 7y ago
  I'm guessing they talk with the carriers regularly about being complaint. I asked them about it recently and they said in a response ticket they were following along with progressions in authentication. There may be someone who works for Twilio on this thread that has more info though.
bryanmgreen 7y ago
Right now I use Apple's "Send Unknown Numbers To Voicemail" feature and dear lord it has saved my life. Will be nice to go a step further.
anonymousiam 7y ago
I've got a FreePBX/Asterisk VoIP PBX and I've thought about running TeleCrapper2000 (https://hackaday.com/2005/09/08/telecrapper-2000/ https://hackaday.com/2005/09/08/telecrapper-2000/), but a better solution is to just put Google Voice in front of it and turn on "Screen Calls". It does a very effective (although not 100%) job of eliminating most robo/sales calls.
- ulkesh 7y ago
  The audio delay on Google Voice is too horrible for an impatient person like myself. I’d love this feature baked into phones. Odd that it’s not yet.
YokoZar 7y ago
I answered my phone today, since maybe people are calling due to everything that's happening Turns out they're still doing that robocall scam where they say you won a free cruise
peter_d_sherman 7y ago
I think this is a great idea on the one hand... ...But it will equal-and-oppositely create a market, perhaps a black market, for anonymous voice calls on the other... Perhaps these would be delivered by an open source Voice-over-IP program which uses an anonymizing P2P network as its backbone... Also... will it make any difference for phone calls that originate outside of our country? Now, those small observations aside, I think that hard authentication of the source of phone calls, is a great idea to help combat scammers and robocalls... I'd use this service myself, and I know other people that would be immensely benefitted from it...
adelHBN 7y ago
Wait, wasn't this already done? Seriously! We are doing this now. Why has it taken so long!
tgsovlerkhgsel 7y ago
How will delegation be handled? Right now, I guess I'm "spoofing" my caller ID by using a VoIP service unrelated to my actual phone provider to make outbound calls. My phone provider has every incentive to sabotage this, since this alternative provider allows me to pay probably something like 1% of the rates I'd be paying to my regular provider. The VoIP provider verifies that I own the number before letting me use it as caller ID, but towards the network it still relies on the ability to send arbitrary caller IDs. Will this remain possible/will providers controlling someone's phone number be required to somehow enable this? How will this work for call centers that want to send a central well-publicized inbound number from multiple locations? Edit: So I read up on the protocol The SIP provider will provide a claim, signed with their key, confirming that they checked my number. This leaves the possibility of providers having bypassable checks (I think mine e.g. let you set an arbitrary caller ID if you edited a HTML dropdown client-side) and "how to identify which provider is trustworthy", but that seems a lot easier to solve than the original problem.
imprettycool 7y ago
Because of robo calls I forward all my calls to a disabled voicemail box. My phone hasn't rung in over 2 years
harumph 7y ago
Great, maybe after so many dead, the US government will start to actually do its job for a change. I'm not hopeful.
leowoo91 7y ago
Wait, caller-id was not authenticated all the time?
- JdeBP 7y ago
  It's a widespread incorrect belief. * http://jdebp.uk./FGA/truths-about-telephones.html#CallerID http://jdebp.uk./FGA/truths-about-telephones.html#CallerID
dayaz36 7y ago
Hold up...does this mean all voip calls need to be authenticated too? Why is no one talking about the privacy implications of this?
mikorym 7y ago
Do robocallers spoof the number that gets displayed? I haven't personally seen that.
david_w 7y ago
A robot built to strike back at IP telephony spammers. https://jollyrogertelephone.com/ https://jollyrogertelephone.com/
tomcooks 7y ago
If you get phonespam whisper at increasingly lower volumes, then out of the blue shout I HAVE ALREADY TOLD TO YOUR MANAGER TO BLACKLIST MY NUMBER WHAT IS YOUR SURNAME AND CUSTOMER SUPPORT ID They usually hang up at 'blacklist'.
Commodore_64 7y ago
Nice

929 points by hbcondo714 7y ago

If you’re wondering if STIR/SHAKEN was a James Bond reference, the answer is yes, and SHAKEN stands for “Signature-based Handling of Asserted information using toKENs”

nsxwolf 7y ago
Backronym writing is a real gift.
- deleted 7y ago
  [deleted]
aasasd 7y ago
I vaguely wonder sometimes as to what's the origin of the extreme US cheesiness with these names. Like, it's elementary-school level kitsch. So far my guess is ‘the forties’. Or maybe the fifties, with all the ‘atomic’ ridiculousness.
- aasasd 7y ago
  However, I gotta say I like the semantics where the more emotionally positive the title, the worse the actual bill is. Other countries tend to hide that behind uninformative titles or just numbers, so you have to read the actual bill to figure out if it's good or bad. With the US, you can be sure that a ‘GOODTHING’ bill would be something from 4chan. The name in the post seems pretty emotionally neutral.
plandis 7y ago
Really missed out on the opportunity to have STIR/SHAT

mulmen 7y ago

Does this mean I can start answering my phone again? Are there other vectors for spam calling which are not addressed by this solution?

gjs278 7y ago
you can start answering your phone now
PunksATawnyFill 7y ago
Good question. I recently started getting Internet-originated SMS spam on AT&T, which Verizon gave consumers the means to block a decade ago. When confronted with it, AT&T whined that they can't block it... which is absolute bullshit. Not only does Verizon let you block it, but it isn't even shown as coming from a phone number, but rather a GMail address or other non-numeric source. So obviously this pattern could be used to filter it. AT&T also pummels customers with multiple texts for several days a month to tell them that there's nothing wrong with their accounts. No exaggeration: They badger you to tell you that your monthly auto-pay is going to happen, and then WHOA it DID happen! They wake you up for this, and insist on sending these idiotic notices via TEXT and not E-mail. Again, when confronted on it, AT&T whined that they can't do anything, and that customers should put themselves on the Do Not Call list... which expressly ALLOWS companies you DO BUSINESS WITH to communicate with you. AT&T: hating its own customers.
0xff00ffee 7y ago
After 15 years of cell phone spam, anything that shows up as a number on my personal phone, and not a contact, is reflexively ignored. I don't think I'll ever shake this habit: if it is important, they will leave a message.
- SketchySeaBeast 7y ago
  I'm struggling with the decision of whether to automatically block anyone not in my contact list and leave a message in my voicemail explaining why. Don't want to be unfriendly, but it's only getting more ridiculous.

ilamont 7y ago

Kind of curious why it took so long. Spoofed calls for fraud, swatting, etc. have been around for at least ten years.

nsxwolf 7y ago
Longer than that. As long as ISDN/T1 PRI lines have been around. A completely unhindered spoofing playground.
closeparen 7y ago
Why it took so long to get all the participants in a federated network to adopt a new protocol? If that were easy we would have solved email spam too, 20 years ago.
- user5994461 7y ago
  and indeed gmail has fixed email spam for almost 20 years.
  - unishark 7y ago
    Spam filtering is based on the content of email. To translate this (partial) success to phones, we'd have to let a private 3rd party monitor phone conversations, record them on its server indefinitely for training their AI, and screen them for us based on what the caller is actually saying to us.
deadmutex 7y ago
The problem had gotten worse due to easily available tools used to automate the calls.
tommoor 7y ago
Only in recent years has the FCC been inundated with complaints about it. Seems like there was a tipping point in volume the last couple of years
gnopgnip 7y ago

nsxwolf 7y ago

Is this going to impact PBX systems that use ANI Information Elements to route calls and provide caller information to customer service applications, etc? Spoofing is kind of at the heart of those things.

annoyingnoob 7y ago
I guess you are not spoofing when you are using your assigned DIDs and not just making up any old number.
skrtskrt 7y ago
ANIs will still get "spoofed" as there are many legitimate use cases, but you have to "have permission" to use the number you're spoofing, meaning either you own the number or your underlying service provider owns it on your behalf. The legitimate use case is basically: I am placing this outbound call over VOIP or a different phone line, but I want this ANI to show up on the callee's phone, so when they call back they go to the correct line (dentist's desk, software sales line, whatever)
- deleted 7y ago
  [deleted]
- phs2501 7y ago
  The issue is when I have a automated answering system (asterisk, for a museum). It rattles off some prerecorded info, possibly with prompting. To talk to a human, I need to forward the caller (I.e. call and set up a voice bridge since the caller is already connected to me) to one of our volunteers, which will be to their cell phone (we are a railway museum and we don't have a staffed office on weekdays). I want to forward the call with the original caller's phone as the caller ID so that if they miss the call our volunteer can call back easily rather than trying some awful game of tag via calling back the PBX.
  - skrtskrt 7y ago
    This should still be available, though it will likely take some work from the underlying software provider to be compliant. The goal of the regulation is to cut down spam/scam calling, not legitimate uses, and the telecom providers know these uses and lobby heavily to make sure they'll still be allowed to work. The telecom providers don't like scam calls either, or more specifically they don't like short calls. All the work and compute power in telecom is used to set up the call, then the cost of keeping it going is minimal so the longer the call goes on, the more economical it is for the provider

0xff00ffee 7y ago

Google Voice impact?

kirykl 7y ago
Maybe a registry of parties trusted to spoof
- deleted 7y ago
  [deleted]
- markovbot 7y ago
  What parties are trusted to spoof? Having a telecom industry group play favorites with who is and isn't allowed to spoof anyone's phone number sounds like it would be bad.
markovbot 7y ago
are you asking if this will impact Google Voice? If so, I would imagine the answer is almost certainly that it will not at all impact Google Voice. Google Voice works by acting as a proxy for outbound calls. You dial your friend's number, your phone dials Google, who in turn dials your friend with your Google Voice number displayed. Since Google is the legitimate carrier for your Google Voice number, I can think of no reason why they wouldn't be able to correctly sign the call. Additionally, Google is listed as one of the companies that the 14 companies that the FCC appears to be working with (see the table towards the bottom of https://www.fcc.gov/call-authentication https://www.fcc.gov/call-authentication), so I assume they are planning to use it for Fi and hopefully Voice as well.
- pandaman 7y ago
  Google voice also acts as a proxy for inbound calls. Your friend dials your GV number, GV dials your other phone number, which does not belong to Google and uses your friend's number (which may or may not belong to Google) as the caller ID. From the point of view of your telco, who services your phone number, Google is spoofing your friend's number unless your friend happened to call using another GV number.

annoyingnoob 7y ago

There is something else that recently reduced the spam calls I get, enforcement: https://arstechnica.com/tech-policy/2020/02/fcc-accuses-carriers-of-being-gateways-for-foreign-robocallers/ https://arstechnica.com/tech-policy/2020/02/fcc-accuses-carr... Knowing a number is legitimate is great, going after scammers and those that support them is better.

ronack 7y ago

Will this also prevent spoofed text messages?

RKearney 7y ago
I have never received a spoofed SMS message so I already thought this was impossible.
- ronack 7y ago
  It's definitely a thing and prevent some SMS use cases due to this security hole. This new FCC doc only references tracing the original sender. "The FCC has also called on the industry to “trace back” illegal spoofed calls and text messages to their original sources."
DaniloDias 7y ago
It will not. These concepts could be applied towards that purpose if the MNOs wanted to rejigger messaging within their networks & for inter-carrier connectivity- but pursuing that solution would likely be more challenging to implement than this solution.

zubi 7y ago

For those who don't live in the US, this entertaining video by John Oliver might give some context: https://www.youtube.com/watch?v=FO0iG_P0P6M https://www.youtube.com/watch?v=FO0iG_P0P6M

7ewis 7y ago
Ironically, the video is only available in the US. Had to hop onto my VPN to view. Edit: Ok, at least not viewable in the UK!
- zubi 7y ago
  Interesting. I was able to watch it from somewhere not in the US before posting.
- selectnull 7y ago
  I'm not in the US and I'm able to watch it. Maybe it's not available in your country, but it is available in at least one other country than US.

g_p 7y ago

Sounds like a good first step to solve the problem of how the legacy telecoms systems were designed in a world of trusted peers federating. End result of course being spoofed caller ID spam. Unless I'm missing something though, these measures don't do anything to address the gaping security hole in mobile networks around roaming interconnects. That seems to still be a pretty good way to do SMS and call interception, which are increasingly valuable as phones become the de-facto 2FA channel for access to banking, cryptocurrency services and more.

Negitivefrags 7y ago

Why is this problem unique to the USA? I'm not saying I never get spam calls, but I certainly have to scroll back quite a bit in my phone call history to see the last one. Also, on the rare occasion I do get a spam call it's always from some random international country like South Sudan or Oman that I would never expect a phone call from. What makes this problem uniquely hard to solve for the USA as opposed to anywhere else?

devonbleak 7y ago
Embedded corporate interests and lobbies fighting against solutions because it'll cost them money to implement or lower their revenue once implemented. The usual.
- throwaway894345 7y ago
  What solutions does Europe, etc have that the US doesn't? Genuine question.
  - michaelbuckbee 7y ago
    A working legislature?
    - throwaway894345 7y ago
      Clever. What solutions has said legislature come up?
      - throwaway894345 7y ago
        *come up with? (apparently I missed the edit window)
  - thomasfortes 7y ago
    Don't know about Europe, in Brazil spam calls are common but you can register your number in a consumer protection organ to say that you do not want unwanted commercial calls and if you keep receiving them the companies can be fined, for me it works "ok", there still companies that don't give a shit but at least the amount of calls I receive was reduced a lot...

hirundo 7y ago

90% of my phone calls are from the same outfit informing me that this is my last chance to renew the extended warranty on my car. Based on my call history that recording is officially my best friend. And a very forgiving one given that it has been my last chance hundreds of times over the past several years. I hope this regulation won't interfere with our relationship.

JumpCrisscross 7y ago
> the same outfit informing me that this is my last chance to renew the extended warranty on my car I get this too. Which is great, my being a New Yorker who hasn’t had a driver’s license for close to a decade.
- pathseeker 7y ago
  What do you use for an ID? Passport card? State issued ID?
  - JumpCrisscross 7y ago
    > State issued ID? This.
  - mumblemumble 7y ago
    A non-driver's state ID works for everything you'd use a driver's license for except operating a motor vehicle. Even though people typically say, "Driver's license" when they really mean either kind of state-issued ID card.
    - koheripbal 7y ago
      Isn't a driver's license nearly as easy to renew as a non-driving state ID? I don't see the point, even if you only need to rent a car on rare instances.
      - II2II 7y ago

throwaway55554 7y ago

Not soon enough.

megavolcano 7y ago

I swear to god the number of times I've hung up on people threatening visits from the FBI because I'm behind on my taxes (spoiler: i'm not) has been driving me literally insane. Maybe I can actually turn my ringer on my phone off of silent mode one day.

imajoo 7y ago

You can see various carriers responses here: https://www.fcc.gov/call-authentication https://www.fcc.gov/call-authentication Some have provided timelines (such as AT&T), others skirt around it basically saying that they offer call SPAM protection already but that they will go along.

hammock 7y ago

What are the privacy implications of this requirement?

DaniloDias 7y ago
None. You are already in a weak non-repudiation environment with cell phones. This solution will reduce some spoofing, but I doubt it will eliminate it. It will be interesting to see who will be running the CA for these connections.
actionowl 7y ago
I was wondering the same thing, then remembered that I have no expectation of privacy when using a phone anyways... that's where we are today. bleh.

bigbird-media 7y ago

Summary: The Federal Communications Commission adopted new rules requiring caller ID authentication using technical standards known as “STIR/SHAKEN.” These rules will further the FCC’s efforts to protect consumers against malicious caller ID “spoofing,” which is often used during robocall scam campaigns.

dmurray 7y ago
This made me check the date, but it's still March 31 in the US.

hkiely 7y ago

Is this now just a problem on mobile phones in the USA now that we have the no call list legislation?

reaperducer 7y ago
Is this now just a problem on mobile phones in the USA now that we have the no call list legislation? The Do Not Call list has been around for almost 30 years. https://en.wikipedia.org/wiki/Do_not_call_list https://en.wikipedia.org/wiki/Do_not_call_list

davidajackson 7y ago

I don't think SHAKEN/STIR will stop robocalls, because the economics won't change. It's too easy for foreign robocalls to cycle numbers once one gets blocked. It will help with impersonation, but I don't believe it will significantly decrease robocall volume. I think the telecommunications world will need to adopt whitelisting instead of blacklisting. I run a whitelist-based robocall blocking service called CallStop and a lot of customers have straight up given up using their landline, or their personal number with unknown numbers. People who claim that whitelisting is a bad solution because it could block an emergency call don't realize that many people don't answer unknown calls anymore--and I don't think SHAKEN/STIR will change that.

ehsankia 7y ago
Can you extend a bit on that, maybe I'm not understanding the problem right. Isn't having calls being authenticated the first step before you have whitelist/blacklist? Once every call can be definitively attached to a given source, then you can ban any foreign provider that let's these proliferate completely, no?
- davidajackson 7y ago
  SHAKEN/STIR + Whitelisting is the best solution. SHAKEN/STIR by itself isn't going to change things too much I think. But it is a step in the right direction. Whitelisting without SHAKEN/STIR is still extremely functional. There are billions of unique American numbers possible, and with 250-500 average contacts per random dial, contact spoofing is not statistically significant.
  - fortran77 7y ago
    Not when you can contact spoof banks, major drug store chains, AppleCare, etc.
    - davidajackson 7y ago
      Good point, if they're calling from a specific number. I see of lot of complaints about companies like FedEx though, where the calls come from random numbers.

Cymen 7y ago

Any ideas on how this will be implemented? I use voip.ms and I can put in my cell phone number as my caller ID so I don't need to pay for a DID (basically, rent a phone number) and calls come back to my cell. I've thought about some potential SaaS products that would leverage a similar approach. But I would authenticate the number back to the customer before allowing it to be used to avoid spam/malicious use. Based on this: https://www.zdnet.com/article/at-t-comcast-successfully-test-shakenstir-protocol-for-fighting-robocalls/ https://www.zdnet.com/article/at-t-comcast-successfully-test... I'm guessing this is down a layer at the provider level. So in my case, voip.ms would verify the number I'm using as my caller ID is actually a number that comes back to me. Right now, I just tested by swapping my wife's cell number in, they do not validate this. Now I understand how people are spoofing numbers so easily. Obvious approach is to voice call or text the number and require the confirmation code to be entered on the website. Just curious though if there are other requirements or if this is up to the provider.

cryptonector 7y ago

About time. How will SS7 get fixed though?

wbsun 7y ago

Finally, although there are still more than a year to wait. Hope there won't be any extension to this deadline. Before that, I'll keep allowing calls from my contacts only, and bear the miserable inconvenience that sometime my packages may take a month to arrive because of denials of calls from the delivery guy.

devindotcom 7y ago
There is in fact an extension for small providers who say they need more time.

negus 7y ago

It is bad news for the US citizens indeed. Unauthenticated phone number is the last island of privacy in our modern world. Think about it: from some point all citizens will carry a geolocation tracking device that is directly linked with their ID. The internet access will also be bound to your ID and so on. There are better ways to fight spam that do not pose a treat to privacy -- think about email or Facebook. There were tons of spammers, but there are commercial spam filters that do well now. I live in a country where cellphone carriers are legally forced to authenticate users. And this data is used against political opposition and journalists.

VectorLock 7y ago
Does this mandate do that? It seems like it just enforcing STIR/SHAKEN to prevent spoofed numbers. It doesn't, at least from what I can see, mandate any tying of identity to number. Your 7-11 burner phone and prepaid AT&T number should be fine.
jeremyjh 7y ago
No. Per TFA: STIR/SHAKEN enables phone companies to verify that the caller ID information transmitted with a call matches the caller’s phone number.
- negus 7y ago
  Well, I misunderstood the point. Thanks for the clarification
beervirus 7y ago
No one except robocallers uses this “feature” anyway.

mehrdadn 7y ago

Can someone explain what this will translate into in terms of the end-user experience? For one thing, authentication will be next to useless (at least to me) if my phone is still going to ring. So does that mean it's not going to ring for a spoofed number? Also, if it results in tons of voicemail then that's still going to be quite annoying. (How) is the actual end-user experience going to be addressed?

r00fus 7y ago
Maybe I'm missing something but if authentication is allowed, it will allow the client or carrier to block calls based on authenticated ID accurately. RN that's effectively impossible.
- mehrdadn 7y ago
  Yeah I get that, but I'm asking what a user should expect to actually happen by that time, not what a user should expect to be theoretically no longer impossible by that time.
g_p 7y ago
From my understanding, spoofed calls won’t get onto your carrier’a network under this model, let alone ring your phone. All this assumes that sorting out spoofing resolves the problem, which isn’t guaranteed.
- mehrdadn 7y ago
  I thought they still go through to the carrier? Just under a different attestation level: https://www.bandwidth.com/glossary/stir-shaken/ https://www.bandwidth.com/glossary/stir-shaken/
  - g_p 7y ago
    Thanks, that link is a much better overview. It seems the calls will still reach the destination network, and the phone then, but with potential for the operator to signal the likelihood of it being an unwanted or spoofed call. I imagine we will see a tickbox in the operators apps and web settings portals to block or send such calls straight to voicemail (or similar), as they'd be able to be distinguished via the reduced attestation level.

ugh123 7y ago

I didn't see anything in there about penalties for carriers not enforcing this. Also willing to bet they beg for extensions claiming they're not ready - or too costly to implement.

ableal 7y ago
Good point. I suspect carriers tolerate scammers because they're good for the bottom line.
- rhizome 7y ago
  If my mom's bill is any indication, the telco's getting ~$40 for each landline. Not sure what a voice T1 goes for these days.
- jazzyjackson 7y ago
  The same way USPS is funded by junk mail, a large volume of Telecoms' voice calls is likely robo-caller spam. Still I would have thought either Verizon or AT&T could come up with a competitive advantage of, you know, "the number that comes up on caller ID is authenticated to actually be the person paying for that phone number" The spoofed caller ID to match your local area code has landed on people in my contact list, and it was extremely jarring to think "why is my best friend's mom calling me out of the blue" and get offered a discount cruise by a robot.
  - Simon_says 7y ago
    Telecoms have no problem figuring out who to bill.
- 0x00000000 7y ago
  When I got a new phone, I got a text saying that I was on a free trial of Verizon’s spam call blocking service. Needless to say they have every reason to remain complicit
equalsione 7y ago
New legisation is being enacted around this on an ongoing basise: e.g H.R. 4998 was introduced about two weeks ago All the major carriers are implementing a STIR/SHAKEN strategy that should be in effect by next year. But it is complicated to do and there may still be problems when they do - as others have explained here it's not as simple as it first appears. I don't have any sympathy for the operators in this. They've profited from this for long enough and ignored the problem. There's a lot of pressure on them to solve it and the impression I have is that there's no appetite for "the dog ate my homework" excuses from regulators so let's see.

cletus 7y ago

Good. But really, why did this take this long? It should be relatively easy to identify the bad actors here and I don't mean the spammers, I mean the telcos that make this possible, deliberately so, by essentially "laundering" spam calls. My response to picking up a number is to answer the call and say nothing. Auto-dial systems will route the call to a person when they get a "live" response. I don't know the criteria but I'm pretty sure it's them detecting noise on the call (which could be voicemail). A human calling will wonder what is happening and fill the silence by saying something. A machine will not. I hang up within 6 seconds of this in the hopes that it affects some metric somewhere of this being a low-quality or spam call. I don't know if it does. I think I read somewhere once that it did. I could be wrong. If a real human is on the other end and does say nothing in this window, they'll generally just call right back. You get the exact same number again then this time I'll answer it. It is nice to filter contacts vs non-contacts but there are too many things on non-contacts. Businesses you deal with, primarily. In the email world where obviously spam is a huge problem zombie relays that allow this (which I believe is the primary source?) can get blacklisted. Why don't telcos who do this also get blacklisted? Or at least identified? This isn't AT&T or Verizon. It's the little telcos that connect to them. But is this all too little too late? I think we've discovered over the last 20 years that we're all pretty much over open networks. It's all opt-in now with the likes of Whatsapp, FB Messenger and so forth. Oh and while we're at it, can we get rid of this stupid exemption to robocalling restrictions for political campaigning? It's defended as "political free speech". To me, this is nonsensical. Free speech doesn't mean that I should be forced to listen to it. EDIT: Found an example [1] of the bad actors I'm talking about. [1]: https://www.theverge.com/2020/1/31/21117477/justice-department-telecom-scams-robocalls https://www.theverge.com/2020/1/31/21117477/justice-departme...

kbuck 7y ago
Regarding robocalls from political campaigns: I removed my phone number from my voter registration, because honestly I don't want any calls or texts from campaigns. I left my email address in case they want to spam that. I recommend doing the same (although at least with Gmail I find that several of the political emails end up in the spam folder...)
throwanem 7y ago

aalebel33 7y ago

and all it took was a pandemic

markovbot 7y ago
is there any reason to believe this is anything other than the next step in a long, slow-moving process? SHAKEN/STIR has been being rolled out for a few years now, IIRC most major players said they were going to have it deployed by the end 2019 (see response column of table towards the bottom of https://www.fcc.gov/call-authentication https://www.fcc.gov/call-authentication), now they're just setting a deadline of June 2021 to start authenticating calls.

jccooper 7y ago

Good. That'll solve a lot of problems. Spoofers are about the only thing that gets through my spam filters now.

tiffanyh 7y ago

How do services like Twilio stay compliant with this regulation?

davidajackson 7y ago
I'm guessing they talk with the carriers regularly about being complaint. I asked them about it recently and they said in a response ticket they were following along with progressions in authentication. There may be someone who works for Twilio on this thread that has more info though.

bryanmgreen 7y ago

Right now I use Apple's "Send Unknown Numbers To Voicemail" feature and dear lord it has saved my life. Will be nice to go a step further.

anonymousiam 7y ago

I've got a FreePBX/Asterisk VoIP PBX and I've thought about running TeleCrapper2000 (https://hackaday.com/2005/09/08/telecrapper-2000/ https://hackaday.com/2005/09/08/telecrapper-2000/), but a better solution is to just put Google Voice in front of it and turn on "Screen Calls". It does a very effective (although not 100%) job of eliminating most robo/sales calls.

ulkesh 7y ago
The audio delay on Google Voice is too horrible for an impatient person like myself. I’d love this feature baked into phones. Odd that it’s not yet.

YokoZar 7y ago

I answered my phone today, since maybe people are calling due to everything that's happening Turns out they're still doing that robocall scam where they say you won a free cruise

peter_d_sherman 7y ago

I think this is a great idea on the one hand... ...But it will equal-and-oppositely create a market, perhaps a black market, for anonymous voice calls on the other... Perhaps these would be delivered by an open source Voice-over-IP program which uses an anonymizing P2P network as its backbone... Also... will it make any difference for phone calls that originate outside of our country? Now, those small observations aside, I think that hard authentication of the source of phone calls, is a great idea to help combat scammers and robocalls... I'd use this service myself, and I know other people that would be immensely benefitted from it...

adelHBN 7y ago

Wait, wasn't this already done? Seriously! We are doing this now. Why has it taken so long!

tgsovlerkhgsel 7y ago

How will delegation be handled? Right now, I guess I'm "spoofing" my caller ID by using a VoIP service unrelated to my actual phone provider to make outbound calls. My phone provider has every incentive to sabotage this, since this alternative provider allows me to pay probably something like 1% of the rates I'd be paying to my regular provider. The VoIP provider verifies that I own the number before letting me use it as caller ID, but towards the network it still relies on the ability to send arbitrary caller IDs. Will this remain possible/will providers controlling someone's phone number be required to somehow enable this? How will this work for call centers that want to send a central well-publicized inbound number from multiple locations? Edit: So I read up on the protocol The SIP provider will provide a claim, signed with their key, confirming that they checked my number. This leaves the possibility of providers having bypassable checks (I think mine e.g. let you set an arbitrary caller ID if you edited a HTML dropdown client-side) and "how to identify which provider is trustworthy", but that seems a lot easier to solve than the original problem.

imprettycool 7y ago

Because of robo calls I forward all my calls to a disabled voicemail box. My phone hasn't rung in over 2 years

harumph 7y ago

Great, maybe after so many dead, the US government will start to actually do its job for a change. I'm not hopeful.

leowoo91 7y ago

Wait, caller-id was not authenticated all the time?

JdeBP 7y ago
It's a widespread incorrect belief. * http://jdebp.uk./FGA/truths-about-telephones.html#CallerID http://jdebp.uk./FGA/truths-about-telephones.html#CallerID

dayaz36 7y ago

Hold up...does this mean all voip calls need to be authenticated too? Why is no one talking about the privacy implications of this?

mikorym 7y ago

Do robocallers spoof the number that gets displayed? I haven't personally seen that.

david_w 7y ago

A robot built to strike back at IP telephony spammers. https://jollyrogertelephone.com/ https://jollyrogertelephone.com/

tomcooks 7y ago

If you get phonespam whisper at increasingly lower volumes, then out of the blue shout I HAVE ALREADY TOLD TO YOUR MANAGER TO BLACKLIST MY NUMBER WHAT IS YOUR SURNAME AND CUSTOMER SUPPORT ID They usually hang up at 'blacklist'.

Commodore_64 7y ago

Nice