6 ms·

> If it's just on a website, that could be easily corrupted. Back in the day we had things called "telephone directories" (I'm showing my age somewhat) Is it

> If it's just on a website, that could be easily corrupted. Back in the day we had things called "telephone directories" (I'm showing my age somewhat) Is it beyond the wit of man to have the CIA/FBI/NSA/$TLA publish a "list of places to phone" when you receive an Emergency Data Request? If the source isn't on the list, you can ignore it. If it is on the list, phone the number on the list to verify it? This really isn't rocket science. At least not for those of use who grew up in an age where you could step into a phone box and open up a printed directory and look up someone's phone number...

giantg2 5y ago
That is a possibility. It would likely need to be digital, not printed, to avoid stale data. The identity verification will still be less than what you could do with something certificates or RSA tokens since there's nothing guaranteeing the person on the other end is who they say they are (numbers change, area could be unsecured/unmanned, call redirected, etc).
- logifail 5y ago
  > It would likely need to be digital, not printed, to avoid stale data Q: Would one expect police departments to be the kind of places which would change their main telephone number regularly? Consumers change providers often. Institutions? Maybe not so much. (As an aside, I've just checked, and my old university's phone number is exactly the same as it was 30-odd years ago when I enrolled). To be frank, I'd prefer a printed version for something like this. Harder to hack a directory that's hard copy and whose entries really ought not to be changing very often. If ever.
  - giantg2 5y ago
    "Harder to hack a directory that's hard copy and whose entries really ought not to be changing very often." Phreaks often dumpster dove for this info. How does it not change often? There are constantly new departments starting, departments/precincts merging, and departments shutting down.
    - logifail 5y ago
      > Phreaks often dumpster dove for this info For the telephone number of their local police department? Is it supposed to be secret? My point is that it should be public! > How does it not change often? There are constantly new departments starting, departments/precincts merging, and departments shutting down There is simply no reason for a newly-started/merged police department to be able to unilaterally issue an Emergency Data Request, and I say this as a father of three young kids. For $deity's sake, some new and/or newly-merged and/or micro police force must surely have their local, regional and national-level police forces on speed dial on all their phones. If someone is missing and needs to be found quickly, all they need to do is pick up the phone and reach out to "higher authority" (who can be quickly authenticated, because they definitely have been around for decades), not start acting like the local heroes. This isn't a technical problem, folks :(
      - giantg2 5y ago
        "Is it supposed to be secret? My point is that it should be public!" If I have a list of all the agency numbers, then I can look for organizations that disbanded and use those numbers. Since they could still exist in the book (because it wasn't updated instantly), the other party could think you're legitimate. "There is simply no reason for a newly-started/merged police department to be able to unilaterally issue an Emergency Data Request, and I say this as a father of three young kids." How so? For the first year of existence they can't issue anything because they have to wait for the next book to be publish. That's sounds dumb. There's no reason they shouldn't be able to issue anything they have the lawful authority to do so. Have any support/logic for your claim that they have no reason? "some new and/or newly-merged and/or micro police force must surely have their local, regional and national-level police forces on speed dial on all their phones. If someone is missing and needs to be found quickly, all they need to do is pick up the phone and reach out to "higher authority" (who can be quickly authenticated, because they definitely have been around for decades), not start acting like the local heroes." Um... so how does this higher level authority authenticate this lower level authority if they aren't in the book we are using for authentication? In some cases, jurisdiction can get in the way of the scenario you just described. And again, how long are you going to prevent a department from doing what they are lawfully allowed to do? "This isn't a technical problem, folks" Ok, then how do you solve the authentication issues in my previous comment? So far your system hasn't addressed them.
verve_rat 5y ago
Yeah, I'm baffled by the idea that the internet is the only possible way to convey information about phone numbers. It's not even that we are old enough to have experienced looking up a number in a phone book and some people here are to young to have that experience. The obvious solution to this seemingly unsolvable problem is to print some numbers on a piece of paper and post it to each company you want to get data from in the future.
- rosndo 5y ago
  This is a solution that can only be implemented by the legislative branch of the federal government. (Very unlikely to happen) The problem is indeed unsolvable by the recipients.
- giantg2 5y ago
  So are they issuing a new book every time a department/precinct is created, merged, disbanded, or the number is otherwise changed? This still doesn't solve the issue of authentication of the issuing party since the phone location could be unsecured, or the call rerouted.

giantg2 5y ago

That is a possibility. It would likely need to be digital, not printed, to avoid stale data. The identity verification will still be less than what you could do with something certificates or RSA tokens since there's nothing guaranteeing the person on the other end is who they say they are (numbers change, area could be unsecured/unmanned, call redirected, etc).

logifail 5y ago
> It would likely need to be digital, not printed, to avoid stale data Q: Would one expect police departments to be the kind of places which would change their main telephone number regularly? Consumers change providers often. Institutions? Maybe not so much. (As an aside, I've just checked, and my old university's phone number is exactly the same as it was 30-odd years ago when I enrolled). To be frank, I'd prefer a printed version for something like this. Harder to hack a directory that's hard copy and whose entries really ought not to be changing very often. If ever.
- giantg2 5y ago
  "Harder to hack a directory that's hard copy and whose entries really ought not to be changing very often." Phreaks often dumpster dove for this info. How does it not change often? There are constantly new departments starting, departments/precincts merging, and departments shutting down.
  - logifail 5y ago
    > Phreaks often dumpster dove for this info For the telephone number of their local police department? Is it supposed to be secret? My point is that it should be public! > How does it not change often? There are constantly new departments starting, departments/precincts merging, and departments shutting down There is simply no reason for a newly-started/merged police department to be able to unilaterally issue an Emergency Data Request, and I say this as a father of three young kids. For $deity's sake, some new and/or newly-merged and/or micro police force must surely have their local, regional and national-level police forces on speed dial on all their phones. If someone is missing and needs to be found quickly, all they need to do is pick up the phone and reach out to "higher authority" (who can be quickly authenticated, because they definitely have been around for decades), not start acting like the local heroes. This isn't a technical problem, folks :(
    - giantg2 5y ago
      "Is it supposed to be secret? My point is that it should be public!" If I have a list of all the agency numbers, then I can look for organizations that disbanded and use those numbers. Since they could still exist in the book (because it wasn't updated instantly), the other party could think you're legitimate. "There is simply no reason for a newly-started/merged police department to be able to unilaterally issue an Emergency Data Request, and I say this as a father of three young kids." How so? For the first year of existence they can't issue anything because they have to wait for the next book to be publish. That's sounds dumb. There's no reason they shouldn't be able to issue anything they have the lawful authority to do so. Have any support/logic for your claim that they have no reason? "some new and/or newly-merged and/or micro police force must surely have their local, regional and national-level police forces on speed dial on all their phones. If someone is missing and needs to be found quickly, all they need to do is pick up the phone and reach out to "higher authority" (who can be quickly authenticated, because they definitely have been around for decades), not start acting like the local heroes." Um... so how does this higher level authority authenticate this lower level authority if they aren't in the book we are using for authentication? In some cases, jurisdiction can get in the way of the scenario you just described. And again, how long are you going to prevent a department from doing what they are lawfully allowed to do? "This isn't a technical problem, folks" Ok, then how do you solve the authentication issues in my previous comment? So far your system hasn't addressed them.

verve_rat 5y ago

Yeah, I'm baffled by the idea that the internet is the only possible way to convey information about phone numbers. It's not even that we are old enough to have experienced looking up a number in a phone book and some people here are to young to have that experience. The obvious solution to this seemingly unsolvable problem is to print some numbers on a piece of paper and post it to each company you want to get data from in the future.

rosndo 5y ago
This is a solution that can only be implemented by the legislative branch of the federal government. (Very unlikely to happen) The problem is indeed unsolvable by the recipients.
giantg2 5y ago
So are they issuing a new book every time a department/precinct is created, merged, disbanded, or the number is otherwise changed? This still doesn't solve the issue of authentication of the issuing party since the phone location could be unsecured, or the call rerouted.