3 ms·

This is a good question. I think the problem lies in the fact you would have to include in your business decision to block roaming. Roaming is a money maker,

This is a good question. I think the problem lies in the fact you would have to include in your business decision to block roaming. Roaming is a money maker, so I think you would have a hard time convincing telcos to block that. There are laws around roaming as well that you would have to augment or remove internationally. If numbers were not portable and roaming did not exist; meaning, you have to acquire a local number through some form of authentication and your source country forwards the calls to that temporary number, then that might work. When you call people back, they won't see your number though. They would see the loaned local number. At this point we are reinventing the proposed shaken/stir but in a more cumbersome manor. all calls either originate from a network that is trusted That is also tricky. What does trusted mean? Does it mean that if someone on that network is abusing SS7, that they become untrusted? If so, every network would be untrusted within 10 minutes. Maybe a cost penalty to self regulate? You have to block your own reported abusers or lose peering? I like the idea, but I think that would put us back into that realm of legal and political quandaries. This would require a fairly significant addition in full time employees to police the abuse reports and entirely new reporting systems to log all the SS7 data, learn and report abuse patterns.

wtallis 6y ago
> I think the problem lies in the fact you would have to include in your business decision to block roaming. Does roaming involve my cell phone having the same kind of unrestricted SS7 access on the telco's network that enables spoofed robocalls? If so, what the hell are SIM cards for? > What does trusted mean? Does it mean that if someone on that network is abusing SS7, that they become untrusted? Trusted here would mean the network enforces ingress filtering on caller ID data; that calls being placed by end users on that network have accurate caller ID attached by the carrier, and calls coming in from another network either have trusted caller ID data or blank caller ID data. I don't know enough about how SS7 works to know how what degree of access to SS7 is used by various methods of placing calls, but it seems pretty likely that ordinary landline and cellular phones are not viable ingress vectors for spoofed robocalls, and filtering is only needed with more advanced services such as connecting your PBX to the carrier's network.
- LinuxBender 6y ago
  what the hell are SIM cards for? SIM cards are for binding IMSI/MSISDN/IMEI, to authenticate you to the mobile network and update the HLR with your location. This data also traverses the SS7 network but does contain some authentication data specific to the wireless provider. The landline telcos have no knowledge of what this data means beyond the ability to route it. The mobile switches will route your MSISDN to the other SS7 networks. accurate caller ID attached by the carrier This goes back to the suggested shaken/stir method of authentication. There is really no other way to determine what is valid and what is not. The carrier can attach nearly any number and that number can be entirely valid.
  - wtallis 6y ago
    Again, what the hell are SIM cards for? Skip the alphabet soup, please. On some level, a SIM card must authenticate you to the local tower operator as authorized to place calls, and identify what other carrier gets billed for that if you're roaming. They also identify (in an authenticated manner) what the phone number is for your cell phone, so that the local tower operator can start routing calls to that number to your handset. This seems sufficient for the local tower operator to ensure that you aren't using your smartphone to place tons of robocalls with spoofed numbers, using only infrastructure that is already universally implemented. I don't see where a landline telco on the receiving end of calls originating from your smartphone needs to know anything about any of that process; the mobile network operator that's connecting the first hop of your call can be and should be the one responsible for preventing you from abusing the network. I want my phone company to hold the mobile network to that standard before letting calls from that network make my phone ring. > This goes back to the suggested shaken/stir method of authentication. There is really no other way to determine what is valid and what is not. The carrier can attach nearly any number and that number can be entirely valid. This sounds again like you're deciding ahead of time that the problem can only be addressed by a technical solution that turns out to be basically intractable. You're saying that solving the spoofed robocall problem requires every telco to be able to fully validate in realtime who owns what number and is roaming where. I'm pointing out a relatively non-technical solution where each network is only responsible for restricting the bullshit the let into their network, at the boundaries where it seems practical to enforce without overhauling the entire protocol stack for the whole industry. And lax enforcement would get a carrier blacklisted, or at least make all calls originating from their network readily identifiable as suspicious and trivially blockable.
surgecoach 6y ago
Roaming is a concept in the mobile networks, that isnt really part of the problem here, that is robocalls. As LinuxBender says, the decision is to block the ingress link containing the robocalls. These calls generally dont come from mobile devices roaming abroad, but from voip switches that have access to the landline network and configure their own a-party afaik.

wtallis 6y ago

> I think the problem lies in the fact you would have to include in your business decision to block roaming. Does roaming involve my cell phone having the same kind of unrestricted SS7 access on the telco's network that enables spoofed robocalls? If so, what the hell are SIM cards for? > What does trusted mean? Does it mean that if someone on that network is abusing SS7, that they become untrusted? Trusted here would mean the network enforces ingress filtering on caller ID data; that calls being placed by end users on that network have accurate caller ID attached by the carrier, and calls coming in from another network either have trusted caller ID data or blank caller ID data. I don't know enough about how SS7 works to know how what degree of access to SS7 is used by various methods of placing calls, but it seems pretty likely that ordinary landline and cellular phones are not viable ingress vectors for spoofed robocalls, and filtering is only needed with more advanced services such as connecting your PBX to the carrier's network.

LinuxBender 6y ago
what the hell are SIM cards for? SIM cards are for binding IMSI/MSISDN/IMEI, to authenticate you to the mobile network and update the HLR with your location. This data also traverses the SS7 network but does contain some authentication data specific to the wireless provider. The landline telcos have no knowledge of what this data means beyond the ability to route it. The mobile switches will route your MSISDN to the other SS7 networks. accurate caller ID attached by the carrier This goes back to the suggested shaken/stir method of authentication. There is really no other way to determine what is valid and what is not. The carrier can attach nearly any number and that number can be entirely valid.
- wtallis 6y ago
  Again, what the hell are SIM cards for? Skip the alphabet soup, please. On some level, a SIM card must authenticate you to the local tower operator as authorized to place calls, and identify what other carrier gets billed for that if you're roaming. They also identify (in an authenticated manner) what the phone number is for your cell phone, so that the local tower operator can start routing calls to that number to your handset. This seems sufficient for the local tower operator to ensure that you aren't using your smartphone to place tons of robocalls with spoofed numbers, using only infrastructure that is already universally implemented. I don't see where a landline telco on the receiving end of calls originating from your smartphone needs to know anything about any of that process; the mobile network operator that's connecting the first hop of your call can be and should be the one responsible for preventing you from abusing the network. I want my phone company to hold the mobile network to that standard before letting calls from that network make my phone ring. > This goes back to the suggested shaken/stir method of authentication. There is really no other way to determine what is valid and what is not. The carrier can attach nearly any number and that number can be entirely valid. This sounds again like you're deciding ahead of time that the problem can only be addressed by a technical solution that turns out to be basically intractable. You're saying that solving the spoofed robocall problem requires every telco to be able to fully validate in realtime who owns what number and is roaming where. I'm pointing out a relatively non-technical solution where each network is only responsible for restricting the bullshit the let into their network, at the boundaries where it seems practical to enforce without overhauling the entire protocol stack for the whole industry. And lax enforcement would get a carrier blacklisted, or at least make all calls originating from their network readily identifiable as suspicious and trivially blockable.

surgecoach 6y ago

Roaming is a concept in the mobile networks, that isnt really part of the problem here, that is robocalls. As LinuxBender says, the decision is to block the ingress link containing the robocalls. These calls generally dont come from mobile devices roaming abroad, but from voip switches that have access to the landline network and configure their own a-party afaik.