4 ms·

I've yet to read a good explanation of why the telcos permit CLID faking and reinjection of apparently local CLID by overseas inputs. I'm assuming there's a te

by ggm 4mo ago

I've yet to read a good explanation of why the telcos permit CLID faking and reinjection of apparently local CLID by overseas inputs. I'm assuming there's a technical and/or willpower reason or some counterfactual like VOIP depends on it. Even just flagging it would help. Or, rejecting numbers they can know lie inside their own routing architecture, or asserts within their own number plan where the CLID does not match. Morally it's like BCP38 in the customer facing internet systems: reject customer input they don't pay you to assert.

bxk76 4mo ago
Cost. Cost to spam and scam tends to 0 at industrial scale. Meanwhile amount of time and resources telco want to spend on fighting it is Bounded by how much regulators are going to allow them to pass on to customers.
fowl2 4mo ago
Telco networks are sprawling and accurately defining the boundary might be harder than it sounds. Traditionally they have a bias towards "working"/delivering traffic. It's easier to issue a refund than answer a urgent support request. I can also imagine the biggest customers have all sorts of multi-vendor failover plans that may be affected.
edent 4mo ago
I used to work at two (UK) telcos. There's a historic reason and a modern reason. The historic reason was, just like the Internet, the international phone network was built on gentlemen agreements by engineers who largely trusted each other. A big national telco is unlikely to attack its peers, so there was little need for safety measures. As smaller telcos came in to the mix via deregulation, that understanding changed - but it was hard to retroactively fit controls. The more modern reason is outsourced call centres. You want outbound calls from your Philippines based staff to show as if they were calling from a local number. When large and reputable entities were doing this it was fine. Just like showing a different reply-to address on an email. If you were designing a modern network, it wouldn't be like this. But international telephony is over a hundred years old and has a huge amount of legacy technology and legal agreements.
- BLKNSLVR 4mo ago
  > You want outbound calls from your Philippines based staff to show as if they were calling from a local number. The company that has offshored it's support to the Philippines might want that, but I doubt any consumers want that. That shouldn't have happened, but regulation comes (20+ years?) after harmful business profit decisions have been made and implemented. But, thank you for the explanation. I have heard similar explanations before, and it has always sounded to me like a situation where the telcos are able to offer a service for a profit for the customers to hide the origin of their offshore call centres (that mostly nobody wants to speak to anyway). I think I just ranted twice, sorry. Thank you!
  - brainwad 4mo ago
    The consumers 'want' it because if they get disconnected and try to recall, by spoofing a local number it costs them nothing/little since it's a local number (maybe toll-free?) instead of a lot for an international call. Of course, they might want a local call centre even more, but spoofing a local number for overseas call centres does have a purpose.
    - realusername 4mo ago
      I've never seen an hotline where you can call back and resume the call you were doing.
      - orwin 4mo ago
        My electric company gave me a number (UID, not phone number) to resume a call if the issue wasn't fixed within 24 hours, and I'm pretty sure internet operators have the same protocol (at least used to).
        arethuza 4mo ago
        Is that to restart the call to the same person or a case id that gives details of your request and that could be passed to anyone?
stymaar 4mo ago
> Even just flagging it would help. That's what's mandated by ARCEP (the French regulator) since the beginning of this year, and now all faked numbers are marked as “hidden caller”, and indeed it helps a lot.
- orwin 4mo ago
  The Sitbon family didn't lobby hard enough to prevent this.
  - stymaar 4mo ago
    > The Sitbon family Who?
    - orwin 4mo ago
      https://warning-trading.com/enquetes-et-decryptages/karsyl-sitbon-yoni/ https://warning-trading.com/enquetes-et-decryptages/karsyl-s...
      - stymaar 4mo ago
        Thanks. From the articles looks more like a gang of grifters than people with the abilities to engage in lobbying.
dools 4mo ago
I rely on the ability to set the outbound caller ID but I would happily register it if required.
fmajid 4mo ago
That's why in 2020 the FCC belatedly mandated SHAKEN/STIR to authenticate Caller ID in the US using public-key cryptography. Deployment is still work in progress, and it does not cover SMS/MMS, however. A bigger problem is Russia or Saudi Arabia using the SS7 signalling network to track their dissidents in the US because those legacy telco protocols have basically no authentication whatsoever, and won't blink if a Saudi Telco sends Verizon a MAP message saying "what is the cell location of Jamal Khashoggi's phone?"
ale42 4mo ago
> I've yet to read a good explanation of why the telcos permit CLID faking and reinjection of apparently local CLID by overseas inputs. Actually, there are several legitimate use cases: • Call divert: Local number calls a number abroad and that one is diverted back a another local number. It's probably rare, but it's a totally legit use case. • 2G/3G roaming: I'm not an expert on this one, but as far as I understood it, roaming calls placed on 2G/3G networks are initiated in the visiting country, and use the local number of the caller. • Getting better rates using VoIP. Whether this is legit or not might be subject to discussion, however I was using a foreign VoIP provider (because they had better rates for local calls than any local providers, for my low call volume) sending out my own local number (had to be validated by them by callback, although that's their own security measure, not the network's one). Now in several EU countries and Switzerland this doesn't work any more, as calls bearing national IDs coming from abroad must be displayed as anonymous. And it's quite annoying that there isn't a way to "authentify" those numbers so the owner can use them as they wish.
pwg 4mo ago
> I've yet to read a good explanation of why the telcos permit ... They (the telcos) are paid for every message they deliver. So absent regulation forcing them to do otherwise, it is in their best interest (additional profit) to pass through every message with no filtering of any form. And, if the regulators had any technical knowledge at all, they would recognize that the billing system is the key to stopping the robo texts. Every text can be traced back to its origin through the billing system (because that's how the telco's collect their fees, so of course they know who to collect from for which messages they forwarded). So the regulators just need to force open the billing systems and trace the money back to the illicit senders, and then they know who to cut off (or to fine out of existence).

by ggm 4mo ago

bxk76 4mo ago

Cost. Cost to spam and scam tends to 0 at industrial scale. Meanwhile amount of time and resources telco want to spend on fighting it is Bounded by how much regulators are going to allow them to pass on to customers.

fowl2 4mo ago

Telco networks are sprawling and accurately defining the boundary might be harder than it sounds. Traditionally they have a bias towards "working"/delivering traffic. It's easier to issue a refund than answer a urgent support request. I can also imagine the biggest customers have all sorts of multi-vendor failover plans that may be affected.

edent 4mo ago

I used to work at two (UK) telcos. There's a historic reason and a modern reason. The historic reason was, just like the Internet, the international phone network was built on gentlemen agreements by engineers who largely trusted each other. A big national telco is unlikely to attack its peers, so there was little need for safety measures. As smaller telcos came in to the mix via deregulation, that understanding changed - but it was hard to retroactively fit controls. The more modern reason is outsourced call centres. You want outbound calls from your Philippines based staff to show as if they were calling from a local number. When large and reputable entities were doing this it was fine. Just like showing a different reply-to address on an email. If you were designing a modern network, it wouldn't be like this. But international telephony is over a hundred years old and has a huge amount of legacy technology and legal agreements.

BLKNSLVR 4mo ago
> You want outbound calls from your Philippines based staff to show as if they were calling from a local number. The company that has offshored it's support to the Philippines might want that, but I doubt any consumers want that. That shouldn't have happened, but regulation comes (20+ years?) after harmful business profit decisions have been made and implemented. But, thank you for the explanation. I have heard similar explanations before, and it has always sounded to me like a situation where the telcos are able to offer a service for a profit for the customers to hide the origin of their offshore call centres (that mostly nobody wants to speak to anyway). I think I just ranted twice, sorry. Thank you!
- brainwad 4mo ago
  The consumers 'want' it because if they get disconnected and try to recall, by spoofing a local number it costs them nothing/little since it's a local number (maybe toll-free?) instead of a lot for an international call. Of course, they might want a local call centre even more, but spoofing a local number for overseas call centres does have a purpose.
  - realusername 4mo ago
    I've never seen an hotline where you can call back and resume the call you were doing.
    - orwin 4mo ago
      My electric company gave me a number (UID, not phone number) to resume a call if the issue wasn't fixed within 24 hours, and I'm pretty sure internet operators have the same protocol (at least used to).
      - arethuza 4mo ago
        Is that to restart the call to the same person or a case id that gives details of your request and that could be passed to anyone?

stymaar 4mo ago

> Even just flagging it would help. That's what's mandated by ARCEP (the French regulator) since the beginning of this year, and now all faked numbers are marked as “hidden caller”, and indeed it helps a lot.

orwin 4mo ago
The Sitbon family didn't lobby hard enough to prevent this.
- stymaar 4mo ago
  > The Sitbon family Who?
  - orwin 4mo ago
    https://warning-trading.com/enquetes-et-decryptages/karsyl-sitbon-yoni/ https://warning-trading.com/enquetes-et-decryptages/karsyl-s...
    - stymaar 4mo ago
      Thanks. From the articles looks more like a gang of grifters than people with the abilities to engage in lobbying.

dools 4mo ago

I rely on the ability to set the outbound caller ID but I would happily register it if required.

fmajid 4mo ago

That's why in 2020 the FCC belatedly mandated SHAKEN/STIR to authenticate Caller ID in the US using public-key cryptography. Deployment is still work in progress, and it does not cover SMS/MMS, however. A bigger problem is Russia or Saudi Arabia using the SS7 signalling network to track their dissidents in the US because those legacy telco protocols have basically no authentication whatsoever, and won't blink if a Saudi Telco sends Verizon a MAP message saying "what is the cell location of Jamal Khashoggi's phone?"

ale42 4mo ago

> I've yet to read a good explanation of why the telcos permit CLID faking and reinjection of apparently local CLID by overseas inputs. Actually, there are several legitimate use cases: • Call divert: Local number calls a number abroad and that one is diverted back a another local number. It's probably rare, but it's a totally legit use case. • 2G/3G roaming: I'm not an expert on this one, but as far as I understood it, roaming calls placed on 2G/3G networks are initiated in the visiting country, and use the local number of the caller. • Getting better rates using VoIP. Whether this is legit or not might be subject to discussion, however I was using a foreign VoIP provider (because they had better rates for local calls than any local providers, for my low call volume) sending out my own local number (had to be validated by them by callback, although that's their own security measure, not the network's one). Now in several EU countries and Switzerland this doesn't work any more, as calls bearing national IDs coming from abroad must be displayed as anonymous. And it's quite annoying that there isn't a way to "authentify" those numbers so the owner can use them as they wish.

pwg 4mo ago

> I've yet to read a good explanation of why the telcos permit ... They (the telcos) are paid for every message they deliver. So absent regulation forcing them to do otherwise, it is in their best interest (additional profit) to pass through every message with no filtering of any form. And, if the regulators had any technical knowledge at all, they would recognize that the billing system is the key to stopping the robo texts. Every text can be traced back to its origin through the billing system (because that's how the telco's collect their fees, so of course they know who to collect from for which messages they forwarded). So the regulators just need to force open the billing systems and trace the money back to the illicit senders, and then they know who to cut off (or to fine out of existence).