4 ms·

Nope, the problem is not what you thought of. The low level communication protocols did not consider security issues when they were designed as at which time ev

by mrjin 5y ago

Nope, the problem is not what you thought of. The low level communication protocols did not consider security issues when they were designed as at which time every peer could be trusted, and thus no Authentication & Authorization mechanisms were incorporated at all. That was not really a problem until VoIP became a thing. Before VoIP it would be extremely hard if not totally impossible to fake a caller id, but with VoIP there is no longer a physical port associated with a caller, so technically everyone can claim to be anyone as long as they have the service end point details as there is no way to validate if you really are who you claim to be, so don't be surprised when picking up a call from your own number. Doesn't look good, isn't it? Unfortunately, there is no easy fix without an overhaul of the telecom infrastructure by replacing all legacy equipment that does not support A&A. I'm wondering if that is ever going to happen. But you were right about one thing, telecoms do profit a lot from the robocalls.

heartbeats 5y ago
Can't you just impose chained liability? If I get a robocall, my carrier owes me $100. They can then collect $100 from the peer they got it from, etc. This will cause carriers to only peer with good carriers, not fly-by-night VoIP clown shows.
- tasty_freeze 5y ago
  OK, let's say your plan is put into effect. I will set up a front company, and create thousands of phone customers that are hard to track back to me. Then I'll have my front company call all of my 1000 fake customers repeatedly. Those customers collect $100 each for every call from the phone carrier, and when the phone carrier tries to collect from the originator, poof, they don't exist anymore.
  - supertrope 5y ago
    The carrier will soon require a security deposit or guarantor.
  - cogman10 5y ago
    Better make sure your front company can't be traced back to yourself and those fake customers can't be traced back to you otherwise you've just committed wirefraud. Very likely, if this $100 fine came into play, the first change telcoms would implement is verifying every single line in and out to make sure this exact situation can't happen. Will be cool to need a passport and birth certificate to get a new phone number.
    - nine_k 5y ago
      Have you tried to get a new mobile phone number without a passport or other such ID in the US? In many countries, it is impossible to get even a VoIP number without showing an ID, and in some (like Bulgaria) it should be a local ID.
      - lstodd 5y ago
        As long as you don't try the most obvious approach, that is just buying the sim straight from one of the official operators, the thing is quite simple. In Europe, esp eastern europe, like Bulgaria, there's a vast market of stolen phones, stolen or resold sims. You'll have to ditch them after several weeks of course. But it is not in any way impossible. I'd guess it's the same in Americas. It's been several years since I worked at an MVNO, so I can't say much about how do you get number capacity nowadays, but back then that was literally the least problem imaginable.
cogman10 5y ago
Funnily, the FCC rules around porting numbers has lead to a lot of this problem. Telephone numbers used to be handled pretty much like IPv4 addresses. A telecom would get a block of numbers and distribute those to their customers. It wasn't really possible for you to move your number from one carrier to the next. The 2003 rule change around number porting forced a bunch of upgrades to telecoms to make it possible for any phone operator to send out a call for any number.
- inetknght 5y ago
  > The 2003 rule change around number porting forced a bunch of upgrades to telecoms to make it possible for any phone operator to send out a call for any number. Are you trying to claim that's the reason that anyone can forge a number? Because I don't buy it. Just because you're forced to accept an inbound number doesn't mean you don't log where the number came from -- the peer service provider at the very least.
  - EricE 5y ago
    "Just because you're forced to accept an inbound number doesn't mean you don't log where the number came from -- the peer service provider at the very least." And then what are you supposed to do with the peer service provider data? How the heck does that help an operator? The whole point is VOIP and the porting rules broke the implicit trust relationships that used to exist, and the low level call routing protocols don't have a solution for that - because it could have never been a problem before VOIP and the new porting rules. Until the underlying call routing protocols for long distance get enhanced, this problem isn't going to be fixed any time soon. And I'm not holding my breath on an overhaul of what is fast becoming legacy infrastructure. And in a VOIP only world establishing trust will be no easier, maybe harder, than doing so with email today - so that's not the answer either :p
downWidOutaFite 5y ago
VoIP wasn't worth the destruction of the highly reliable trusted voice network.
adrr 5y ago
Carriers know who originated the call. There are reciprocal compensation deals between the carriers to terminate call on their networks. They know exactly who originated the call because someone is paying for it. Calls aren’t free. Rural areas are especially pricey to terminate calls too which is how freeconference.com exists.
- EricE 5y ago
  VOIP gateways upended that end to end accountability. I suppose the baby bells could just refuse all calls from VOIP gateways further relegating them to irrelevance. Good luck ever convincing a cell phone provider to do that. Actually if phone providers would prefix calls from VOIP gateways with an asterix then I could set up a rule to just force all of those to voicemail by default. Would probably kill 90% of the bogus calls. Hell I'd pay an extra $5 a month for that feature.
GoblinSlayer 5y ago
A whitelist works well for me. Call centers here have big randomized pools of phone numbers, so blacklisting them is impractical, and sometimes I do expect a call from a call center.

by mrjin 5y ago

heartbeats 5y ago

Can't you just impose chained liability? If I get a robocall, my carrier owes me $100. They can then collect $100 from the peer they got it from, etc. This will cause carriers to only peer with good carriers, not fly-by-night VoIP clown shows.

tasty_freeze 5y ago
OK, let's say your plan is put into effect. I will set up a front company, and create thousands of phone customers that are hard to track back to me. Then I'll have my front company call all of my 1000 fake customers repeatedly. Those customers collect $100 each for every call from the phone carrier, and when the phone carrier tries to collect from the originator, poof, they don't exist anymore.
- supertrope 5y ago
  The carrier will soon require a security deposit or guarantor.
- cogman10 5y ago
  Better make sure your front company can't be traced back to yourself and those fake customers can't be traced back to you otherwise you've just committed wirefraud. Very likely, if this $100 fine came into play, the first change telcoms would implement is verifying every single line in and out to make sure this exact situation can't happen. Will be cool to need a passport and birth certificate to get a new phone number.
  - nine_k 5y ago
    Have you tried to get a new mobile phone number without a passport or other such ID in the US? In many countries, it is impossible to get even a VoIP number without showing an ID, and in some (like Bulgaria) it should be a local ID.
    - lstodd 5y ago
      As long as you don't try the most obvious approach, that is just buying the sim straight from one of the official operators, the thing is quite simple. In Europe, esp eastern europe, like Bulgaria, there's a vast market of stolen phones, stolen or resold sims. You'll have to ditch them after several weeks of course. But it is not in any way impossible. I'd guess it's the same in Americas. It's been several years since I worked at an MVNO, so I can't say much about how do you get number capacity nowadays, but back then that was literally the least problem imaginable.

cogman10 5y ago

Funnily, the FCC rules around porting numbers has lead to a lot of this problem. Telephone numbers used to be handled pretty much like IPv4 addresses. A telecom would get a block of numbers and distribute those to their customers. It wasn't really possible for you to move your number from one carrier to the next. The 2003 rule change around number porting forced a bunch of upgrades to telecoms to make it possible for any phone operator to send out a call for any number.

inetknght 5y ago
> The 2003 rule change around number porting forced a bunch of upgrades to telecoms to make it possible for any phone operator to send out a call for any number. Are you trying to claim that's the reason that anyone can forge a number? Because I don't buy it. Just because you're forced to accept an inbound number doesn't mean you don't log where the number came from -- the peer service provider at the very least.
- EricE 5y ago
  "Just because you're forced to accept an inbound number doesn't mean you don't log where the number came from -- the peer service provider at the very least." And then what are you supposed to do with the peer service provider data? How the heck does that help an operator? The whole point is VOIP and the porting rules broke the implicit trust relationships that used to exist, and the low level call routing protocols don't have a solution for that - because it could have never been a problem before VOIP and the new porting rules. Until the underlying call routing protocols for long distance get enhanced, this problem isn't going to be fixed any time soon. And I'm not holding my breath on an overhaul of what is fast becoming legacy infrastructure. And in a VOIP only world establishing trust will be no easier, maybe harder, than doing so with email today - so that's not the answer either :p

downWidOutaFite 5y ago

VoIP wasn't worth the destruction of the highly reliable trusted voice network.

adrr 5y ago

Carriers know who originated the call. There are reciprocal compensation deals between the carriers to terminate call on their networks. They know exactly who originated the call because someone is paying for it. Calls aren’t free. Rural areas are especially pricey to terminate calls too which is how freeconference.com exists.

EricE 5y ago
VOIP gateways upended that end to end accountability. I suppose the baby bells could just refuse all calls from VOIP gateways further relegating them to irrelevance. Good luck ever convincing a cell phone provider to do that. Actually if phone providers would prefix calls from VOIP gateways with an asterix then I could set up a rule to just force all of those to voicemail by default. Would probably kill 90% of the bogus calls. Hell I'd pay an extra $5 a month for that feature.

GoblinSlayer 5y ago

A whitelist works well for me. Call centers here have big randomized pools of phone numbers, so blacklisting them is impractical, and sometimes I do expect a call from a call center.