5 ms·

Years ago I heard that SHAKEN/STIR were being implemented and would allow robocall blocking. I still get tons of robocalls. I've had this explained as "SHAKEN/S

Years ago I heard that SHAKEN/STIR were being implemented and would allow robocall blocking. I still get tons of robocalls. I've had this explained as "SHAKEN/STIR were the crypto that will eventually allow blocking, but the blocking will happen later." Is it later? Is this the start of the actual blocking?

i_am_jl 3y ago
It has started. SHAKEN/STIR are what gives the FCC the ability to trace the source of these calls backwards and hold responsible the gateways acting in bad faith.
- lotsofpulp 3y ago
  I stopped getting spam phone calls months ago. Something definitely changed in the last year, or maybe 2 years. It was ridiculously often in 2020/2021/sometime in 2022 maybe?
  - mustacheemperor 3y ago
    Hasn’t changed for me. I am constantly pestered by spoofed-local-number spam calls at both my personal number and my work number, in two different area codes. My job requires me to be available on the phone so it’s particularly frustrating because of how often I have to pick them up just to hear about a warranty on yet another car I’ve never owned.
    - lotsofpulp 3y ago
      That’s a bummer. I am using ATT’s mobile service, on an iPhone. Maybe different carriers/phones have different implementations?
      - mustacheemperor 3y ago
        Also ATT/iPhone. I think Google Voice (my work line) routes through a different network and I do think I get more spam calls there.
  - sq_ 3y ago
    Similar experience here. I got absolutely ridiculous numbers of spam calls up until maybe early 2022? Now I get almost none in comparison. Like 2-3 a month as opposed to tons every week before.
  - squeaky-clean 3y ago
    I've gotten 6 spam calls so far today.
- costco 3y ago
  The traceback rules are really what did that but I think those were in the same bill that mandated STIR/SHAKEN. STIR/SHAKEN just makes spoofing caller ID more difficult.
  - i_am_jl 3y ago
    Are the provisions of STIR not necessary for the traceback rules to be applicable? My understanding is that without STIR a gateway acting in good faith can't definitively identify malicious traffic, and a gateway acting in bad faith can claim any malicious traffic they forward appeared legitimate.
shrubble 3y ago
This method basically has not yet been used much, but it is in place. The dangerous issue is that if a spam operator has 33% legit traffic, do you kill the spam operator and the good traffic with it, or what? Kill the traffic... innocent people harmed, or leave the traffic, spam continues.
- barney54 3y ago
  Kill the traffic. The operator has to do a better job to stay in business.
  - proto_lambda 3y ago
    The operator's business is not the concern here.
    - genmud 3y ago
      If a bank is comprised of 66% of their customers being narcos, the bank gets shut down. You don’t get to facilitate in illegal shit and hide behind your legitimate customers. Likewise, if you are a customer of theirs and know they heavily transact with illegal services, it’s on you for getting blocked.
      - virtue3 3y ago
        Naw they just get a slap on the wrists from the Feds and move on. No jail time even. Now if you and I laundered money to the Mexican drug cartels... "too big to jail because they are too big to fail" https://www.investopedia.com/stock-analysis/2013/investing-news-for-jan-29-hsbcs-money-laundering-scandal-hbc-scbff-ing-cs-rbs0129.aspx https://www.investopedia.com/stock-analysis/2013/investing-n...
    - jfengel 3y ago
      Their legitimate customers are. If that means getting the operator to clean up their act, so much the better. If they won't, then at some point their legitimate customers will suffer. And will probably have to jump to a more expensive provider who isn't subsidizing them with spammer revenue.
gorkish 3y ago
SHAKEN/STIR are implemented but the providers have given no tools to the end users to actually do anything actionable with it. Heck, they haven't even exposed it unless you are a megacorp. The telcos might be a common carrier, but as the end user I sure as shit should be able to block calls originating from providers I see abuse from constantly. I'm looking RIGHT AT YOU, TxtNow.
- tjohns 3y ago
  > Heck, they haven't even exposed it unless you are a megacorp. Cell phones surface the SHAKEN/STIR attestation status to the user via a checkmark in the telephone UI. If you want to programmatically act on that data to filter calls... Android provides access to the attestation level via the android.telecom.CallScreeningService API. (I can't speak to what iOS provides.) For VoIP, many providers will also either pass along the attestation level in the SIP headers or by appending some text to the Caller ID string.
  - AdrianEGraphene 3y ago
    Neat. Sounds like I gotta explore what's available there now. The parent comment's issue sounds like a pretty good feature to add to an app... thx.
  - gorkish 3y ago
    IMO the attestation level isn't really actionable data though. A legitimate call may come through missing attestation for reasons that are not malicious. Similarly for things like B2B, the calls themselves may be attested and legal, but I'd still want to block them. We really need to be able to get the entire payload. If end users could directly and simply block carriers that waste their time by delivering shit calls, this entire issue would have worked itself out years ago. I just don't think that the current strategy of having the FCC yell big numbers at foreigners is really doing all that much...
m463 3y ago
I get calls nowadays with caller id telemarketer or suspected spam or similar, is this what it does?
- chaorace 3y ago
  A little yes, a little no. Your phone knows when it's receiving a call from an unauthenticated number, but it would be very unreliable to use this metric alone to decide when a call is untrustworthy. My understanding is that carrier telemetry is what drives the final yes/no verdict.
deleted 3y ago
[deleted]
supertrope 3y ago
We're still very early in the process. 1) Deploy caller ID signing. <--We are here. 2) Deploy policies to make inter-telco tracebacks easier and increase liability for carrying too much spam. 3) Drop unsigned traffic and shutdown spam friendly portions of the PSTN (analogous to open email relays). 4) Use the tracebacks and KYC to deter robocalling operations from getting onboarded and ban current customers who are robocalling. And keep them banned when they open new sockpuppet accounts. It'll never be completely eliminated. 5) See 4. Two-thirds of PSTN traffic is unsigned. https://transnexus.com/blog/2023/shaken-statistics-july/ https://transnexus.com/blog/2023/shaken-statistics-july/
- costco 3y ago
  You can get local phone numbers for a trivial amount of money - no caller ID spoofing required! Robocall operators have realized this which is why a substantial amount of robocalls are attested: https://commsrisk.com/calls-with-stir-shaken-c-attestation-now-5-times-more-likely-to-be-robocalls-than-unsigned-calls/ https://commsrisk.com/calls-with-stir-shaken-c-attestation-n... Even if there is thorough, mandatory KYC for VOIP services, we will just have robocalls being routed through simboxes filled with prepaid SIM cards. The whack-a-mole game will move there and the carriers will lose just like they do in Africa and the Middle East where people use them on a giant scale to arbitrage termination rates.
  - hinata08 3y ago
    >we will just have robocalls being routed through simboxes filled with prepaid SIM cards. it would cost a lot of money, especially if carriers limit the number of numbers you can call each month before an additional charge (100-200 numbers / month then extra fee ?) > You can get local phone numbers for a trivial amount of money and companies that provides phone numbers them can also monitor suspicious traffic. I remember that when I first opened an account at Callcentric, they froze it until their support could reach me to ask a few questions. Now, I've had it for a few year, did just a few calls, and I no longer have to go through that to subscribe to more services. On a slightly different topic, cloud providers have learned to keep their IPs clean, even if you can get some for cheap. They just check what you're doing. So it can be done !
pkaye 3y ago
Personally I've seen very few robocalls these day. I think all the IP based providers in the US have implemented SHAKEN/STIR. There is still a small amount of non IP based systems which FCC is looking for solutions. And international calls will take some time as other countries look into implementing similar methods.

i_am_jl 3y ago

It has started. SHAKEN/STIR are what gives the FCC the ability to trace the source of these calls backwards and hold responsible the gateways acting in bad faith.

lotsofpulp 3y ago
I stopped getting spam phone calls months ago. Something definitely changed in the last year, or maybe 2 years. It was ridiculously often in 2020/2021/sometime in 2022 maybe?
- mustacheemperor 3y ago
  Hasn’t changed for me. I am constantly pestered by spoofed-local-number spam calls at both my personal number and my work number, in two different area codes. My job requires me to be available on the phone so it’s particularly frustrating because of how often I have to pick them up just to hear about a warranty on yet another car I’ve never owned.
  - lotsofpulp 3y ago
    That’s a bummer. I am using ATT’s mobile service, on an iPhone. Maybe different carriers/phones have different implementations?
    - mustacheemperor 3y ago
      Also ATT/iPhone. I think Google Voice (my work line) routes through a different network and I do think I get more spam calls there.
- sq_ 3y ago
  Similar experience here. I got absolutely ridiculous numbers of spam calls up until maybe early 2022? Now I get almost none in comparison. Like 2-3 a month as opposed to tons every week before.
- squeaky-clean 3y ago
  I've gotten 6 spam calls so far today.
costco 3y ago
The traceback rules are really what did that but I think those were in the same bill that mandated STIR/SHAKEN. STIR/SHAKEN just makes spoofing caller ID more difficult.
- i_am_jl 3y ago
  Are the provisions of STIR not necessary for the traceback rules to be applicable? My understanding is that without STIR a gateway acting in good faith can't definitively identify malicious traffic, and a gateway acting in bad faith can claim any malicious traffic they forward appeared legitimate.

shrubble 3y ago

This method basically has not yet been used much, but it is in place. The dangerous issue is that if a spam operator has 33% legit traffic, do you kill the spam operator and the good traffic with it, or what? Kill the traffic... innocent people harmed, or leave the traffic, spam continues.

barney54 3y ago
Kill the traffic. The operator has to do a better job to stay in business.
- proto_lambda 3y ago
  The operator's business is not the concern here.
  - genmud 3y ago
    If a bank is comprised of 66% of their customers being narcos, the bank gets shut down. You don’t get to facilitate in illegal shit and hide behind your legitimate customers. Likewise, if you are a customer of theirs and know they heavily transact with illegal services, it’s on you for getting blocked.
    - virtue3 3y ago
      Naw they just get a slap on the wrists from the Feds and move on. No jail time even. Now if you and I laundered money to the Mexican drug cartels... "too big to jail because they are too big to fail" https://www.investopedia.com/stock-analysis/2013/investing-news-for-jan-29-hsbcs-money-laundering-scandal-hbc-scbff-ing-cs-rbs0129.aspx https://www.investopedia.com/stock-analysis/2013/investing-n...
  - jfengel 3y ago
    Their legitimate customers are. If that means getting the operator to clean up their act, so much the better. If they won't, then at some point their legitimate customers will suffer. And will probably have to jump to a more expensive provider who isn't subsidizing them with spammer revenue.

gorkish 3y ago

SHAKEN/STIR are implemented but the providers have given no tools to the end users to actually do anything actionable with it. Heck, they haven't even exposed it unless you are a megacorp. The telcos might be a common carrier, but as the end user I sure as shit should be able to block calls originating from providers I see abuse from constantly. I'm looking RIGHT AT YOU, TxtNow.

tjohns 3y ago
> Heck, they haven't even exposed it unless you are a megacorp. Cell phones surface the SHAKEN/STIR attestation status to the user via a checkmark in the telephone UI. If you want to programmatically act on that data to filter calls... Android provides access to the attestation level via the android.telecom.CallScreeningService API. (I can't speak to what iOS provides.) For VoIP, many providers will also either pass along the attestation level in the SIP headers or by appending some text to the Caller ID string.
- AdrianEGraphene 3y ago
  Neat. Sounds like I gotta explore what's available there now. The parent comment's issue sounds like a pretty good feature to add to an app... thx.
- gorkish 3y ago
  IMO the attestation level isn't really actionable data though. A legitimate call may come through missing attestation for reasons that are not malicious. Similarly for things like B2B, the calls themselves may be attested and legal, but I'd still want to block them. We really need to be able to get the entire payload. If end users could directly and simply block carriers that waste their time by delivering shit calls, this entire issue would have worked itself out years ago. I just don't think that the current strategy of having the FCC yell big numbers at foreigners is really doing all that much...

m463 3y ago

I get calls nowadays with caller id telemarketer or suspected spam or similar, is this what it does?

chaorace 3y ago
A little yes, a little no. Your phone knows when it's receiving a call from an unauthenticated number, but it would be very unreliable to use this metric alone to decide when a call is untrustworthy. My understanding is that carrier telemetry is what drives the final yes/no verdict.

deleted 3y ago

[deleted]

supertrope 3y ago

We're still very early in the process. 1) Deploy caller ID signing. <--We are here. 2) Deploy policies to make inter-telco tracebacks easier and increase liability for carrying too much spam. 3) Drop unsigned traffic and shutdown spam friendly portions of the PSTN (analogous to open email relays). 4) Use the tracebacks and KYC to deter robocalling operations from getting onboarded and ban current customers who are robocalling. And keep them banned when they open new sockpuppet accounts. It'll never be completely eliminated. 5) See 4. Two-thirds of PSTN traffic is unsigned. https://transnexus.com/blog/2023/shaken-statistics-july/ https://transnexus.com/blog/2023/shaken-statistics-july/

costco 3y ago
You can get local phone numbers for a trivial amount of money - no caller ID spoofing required! Robocall operators have realized this which is why a substantial amount of robocalls are attested: https://commsrisk.com/calls-with-stir-shaken-c-attestation-now-5-times-more-likely-to-be-robocalls-than-unsigned-calls/ https://commsrisk.com/calls-with-stir-shaken-c-attestation-n... Even if there is thorough, mandatory KYC for VOIP services, we will just have robocalls being routed through simboxes filled with prepaid SIM cards. The whack-a-mole game will move there and the carriers will lose just like they do in Africa and the Middle East where people use them on a giant scale to arbitrage termination rates.
- hinata08 3y ago
  >we will just have robocalls being routed through simboxes filled with prepaid SIM cards. it would cost a lot of money, especially if carriers limit the number of numbers you can call each month before an additional charge (100-200 numbers / month then extra fee ?) > You can get local phone numbers for a trivial amount of money and companies that provides phone numbers them can also monitor suspicious traffic. I remember that when I first opened an account at Callcentric, they froze it until their support could reach me to ask a few questions. Now, I've had it for a few year, did just a few calls, and I no longer have to go through that to subscribe to more services. On a slightly different topic, cloud providers have learned to keep their IPs clean, even if you can get some for cheap. They just check what you're doing. So it can be done !

pkaye 3y ago

Personally I've seen very few robocalls these day. I think all the IP based providers in the US have implemented SHAKEN/STIR. There is still a small amount of non IP based systems which FCC is looking for solutions. And international calls will take some time as other countries look into implementing similar methods.