3 ms·

The US does not do enough in this space to punish companies. It feels like such low hanging fruit too that would significantly help the elderly population. Rep

The US does not do enough in this space to punish companies. It feels like such low hanging fruit too that would significantly help the elderly population. Reported to Vercel a bank phishing site weeks ago, no response still. It’s amazing how little companies care.

rawgabbit 1y ago
Until we put people in prison, the cyber crimes will continue. Declaring states that do nothing about these criminals as harboring terror is a good start. This is the same legal principle that resulted in the https://en.wikipedia.org/wiki/Barbary_Wars https://en.wikipedia.org/wiki/Barbary_Wars which stopped Barbary pirates enslaving US sailors.
Workaccount2 1y ago
Forcing telecos to authenticate phone calls would probably be the single most important change. But instead of forcing them, we have been letting them drag their feet while while regular people are losing billions to scams. The whole phone system is ancient and long deprecated. When I get a call from my bank I should see their name and a badge of authentication. Not a random phone number. Imagine you could register irs.gov and start sending e-mails from that domain. That is pretty much the current state of the phone system. Un-fucking-believable no one is forcing change here.
- BLKNSLVR 1y ago
  Telcos have systems in place that are specifically to allow international phone calls to appear as if they're local calls. This is to "facilitate business". They have these services and continue to offer them because they get paid for having them, despite the double decker bus sized hole this provides for scammers. I agree 100% that there should be much tighter regulation on telcos. What I'm not sure of is actually whether it's possible without having to rebuild a lot of their networks almost from scratch.
  - Workaccount2 1y ago
    Phone numbers should just be deprecated and move towards a DNS like system.
    - BLKNSLVR 1y ago
      The older I get the more I realise how much of an anchor legacy systems are, so the more I appreciate forward planning in many contexts. I like to do things in a modular fashion; sectioning off related parts.
    - ianburrell 1y ago
      Phone numbers have nothing to do with the spoofing problem. Hierarchical identifiers would have the exact same problem. The problem is that VOIP callers can set whatever phone number they want. Email is also vulnerable to spoofing. The solution is to roll out signing for phone numbers. The owner of each phone number is known. It could even be published in DNS with ENUM. Most phone calls are from big companies like telcos and mobile providers. The VOIP callers would be harder to update, but could be restricted so can't spoof known numbers. If going to roll out new identity system, easier to use existing phone numbers than make a whole new identifier system.
      - BenjiWiebe 1y ago
        Afaik, VoIP is just the easiest onramp to spoofing numbers. Anyone with BGP-equivalent access to the phone network can spoof numbers, even if they're coming from a landline. Might even be able to when you have a business landline terminated in a PBX. i.e. the phone network backend is built on trust.
  - jonathantf2 1y ago
    I admin the phone system for my phone company, for any user I can change the outgoing CLI to be literally any number in the world, I can even call out as "1" if I want to.
    - BLKNSLVR 1y ago
- larrik 1y ago
  It's worse than that. I got a call with the caller id of my (credit union) credit card company. They had my name and address, knew I had a card, and were claiming they were investigating fraudulent charges. It sounded more official than my actual credit card company. The only real things to tip me off was that the list of fraudulent charges kept changing, and they were super keen on me reading the entire credit card number back to them. There were never any fraudulent charges, and the actual fraud department didn't seem to care. I'm guessing it was due to the Experian leak.
Joker_vD 1y ago
But this would interfere with freedom of entrepreneurship! And since no amount of government regulation can reduce fraud to zero anyhow, the current amount of it is economically optimal. Besides, every person has the unalienable right to ruin their life, gosh darn it. /s
barbazoo 1y ago
Same with captcha providers (google et al) that these scams often hide behind. They don’t care, they just want money just like the scammers.
omarmung 1y ago
(I work at Vercel) Send me an email at dustin @ vercel dot com and I'll dig in here. Sorry about that.

rawgabbit 1y ago

Until we put people in prison, the cyber crimes will continue. Declaring states that do nothing about these criminals as harboring terror is a good start. This is the same legal principle that resulted in the https://en.wikipedia.org/wiki/Barbary_Wars https://en.wikipedia.org/wiki/Barbary_Wars which stopped Barbary pirates enslaving US sailors.

Workaccount2 1y ago

Forcing telecos to authenticate phone calls would probably be the single most important change. But instead of forcing them, we have been letting them drag their feet while while regular people are losing billions to scams. The whole phone system is ancient and long deprecated. When I get a call from my bank I should see their name and a badge of authentication. Not a random phone number. Imagine you could register irs.gov and start sending e-mails from that domain. That is pretty much the current state of the phone system. Un-fucking-believable no one is forcing change here.

BLKNSLVR 1y ago
Telcos have systems in place that are specifically to allow international phone calls to appear as if they're local calls. This is to "facilitate business". They have these services and continue to offer them because they get paid for having them, despite the double decker bus sized hole this provides for scammers. I agree 100% that there should be much tighter regulation on telcos. What I'm not sure of is actually whether it's possible without having to rebuild a lot of their networks almost from scratch.
- Workaccount2 1y ago
  Phone numbers should just be deprecated and move towards a DNS like system.
  - BLKNSLVR 1y ago
    The older I get the more I realise how much of an anchor legacy systems are, so the more I appreciate forward planning in many contexts. I like to do things in a modular fashion; sectioning off related parts.
  - ianburrell 1y ago
    Phone numbers have nothing to do with the spoofing problem. Hierarchical identifiers would have the exact same problem. The problem is that VOIP callers can set whatever phone number they want. Email is also vulnerable to spoofing. The solution is to roll out signing for phone numbers. The owner of each phone number is known. It could even be published in DNS with ENUM. Most phone calls are from big companies like telcos and mobile providers. The VOIP callers would be harder to update, but could be restricted so can't spoof known numbers. If going to roll out new identity system, easier to use existing phone numbers than make a whole new identifier system.
    - BenjiWiebe 1y ago
      Afaik, VoIP is just the easiest onramp to spoofing numbers. Anyone with BGP-equivalent access to the phone network can spoof numbers, even if they're coming from a landline. Might even be able to when you have a business landline terminated in a PBX. i.e. the phone network backend is built on trust.
- jonathantf2 1y ago
  I admin the phone system for my phone company, for any user I can change the outgoing CLI to be literally any number in the world, I can even call out as "1" if I want to.
  - BLKNSLVR 1y ago
larrik 1y ago
It's worse than that. I got a call with the caller id of my (credit union) credit card company. They had my name and address, knew I had a card, and were claiming they were investigating fraudulent charges. It sounded more official than my actual credit card company. The only real things to tip me off was that the list of fraudulent charges kept changing, and they were super keen on me reading the entire credit card number back to them. There were never any fraudulent charges, and the actual fraud department didn't seem to care. I'm guessing it was due to the Experian leak.

Joker_vD 1y ago

But this would interfere with freedom of entrepreneurship! And since no amount of government regulation can reduce fraud to zero anyhow, the current amount of it is economically optimal. Besides, every person has the unalienable right to ruin their life, gosh darn it. /s

barbazoo 1y ago

Same with captcha providers (google et al) that these scams often hide behind. They don’t care, they just want money just like the scammers.

omarmung 1y ago

(I work at Vercel) Send me an email at dustin @ vercel dot com and I'll dig in here. Sorry about that.