4 ms·

Spoofed telephone calls can't be called back either, exactly like IP. These emergency phone calls are two-way communications, exactly unlike the IP spoofing si

Spoofed telephone calls can't be called back either, exactly like IP. These emergency phone calls are two-way communications, exactly unlike the IP spoofing situation (seriously you really want to stick with the wrong IP example?) You are asking that the originator of a call be identifiable somehow Wonder of wonders, yes I am. The world phone system is a completely routable system -- providers effective own prefixes or even individual numbers, which is exactly how one can call someone. The notion that if a call comes in that says "Hi I'm 555-5555 from Verizon @ 555 Blaxberry Lane" and it can actually be verified if not authenticated by Verizon is hardly some big technical marvel. It's actually TRIVIAL, and it's exactly how the world pay-phone system works (note that these people aren't spoofing numbers to call pay sex lines because the telcos actually care about that). This whole ball of nonsense is because telcos have zero obligation to give a crap, so they don't.

MichaelGG 14y ago
SMTP might be a better analogy, but I'll concede as it's irrelevant. You're wrong about the compensation bit. It's entirely possible to send fake traffic and get compensation. Cutting that off is an entirely manual process; with someone noticing the fraud and reporting it. It's not some magic authentication that happens. The reason things like sex lines (either premium rate numbers or just really high-rate areas) often do not work is because the costs are passed on through the various companies (so they'll clip anything over a few cents) or because they simply will not accept calls if they are not within the trusted system. If you have a VoIP line and try dialing a 1900 number, it won't work unless that VoIP provider has made a specific deal. It's not like they look at the calling number, then mail out bills to whoever they think the owner is. Guess what: Folks don't accept limitations on dialing 911 (or the PSAP admin line, which is just a normal number). They're going to demand 911 be answered regardless of billing relationships. At both 911 companies I've owned, the routing system depended on being able to "spoof" caller ID. We would have to accept whatever caller ID we were given, because there's it's essentially intractable to know who has the actual relationship with the end user. It's also not knowable if the connection handing me off this call is authorized to use that number. There's simply zero concept of that. Additionally, there's no such thing as a real master database correlating number-address. (That'd make things easy easier!) Even if there was, it'd still be trivial to swat. Buy a number online, say your address is <target address>. Place a legitimate call that "authenticates". Change address, repeat. Worst case scenario (if you can't make an anonymous payment), hack someone else's VoIP account and change their address and place call. You are right that this is a large problem. Some PSAPs have come under DoS attacks, getting a flood of fake calls. 9-1-1 is a critical piece of safety, and it's fairly unprotected. Funding is limited. Some of the vendors involved are laughably bad. And, at least a few years ago, there was a massive disconnect between technology/Internet and the emergency response side.
iy56 14y ago
Verification really doesn't matter. Emergency responders aren't going to ignore a report like this where human lives are reported to be at stake just because it comes from an unverified number.

MichaelGG 14y ago

SMTP might be a better analogy, but I'll concede as it's irrelevant. You're wrong about the compensation bit. It's entirely possible to send fake traffic and get compensation. Cutting that off is an entirely manual process; with someone noticing the fraud and reporting it. It's not some magic authentication that happens. The reason things like sex lines (either premium rate numbers or just really high-rate areas) often do not work is because the costs are passed on through the various companies (so they'll clip anything over a few cents) or because they simply will not accept calls if they are not within the trusted system. If you have a VoIP line and try dialing a 1900 number, it won't work unless that VoIP provider has made a specific deal. It's not like they look at the calling number, then mail out bills to whoever they think the owner is. Guess what: Folks don't accept limitations on dialing 911 (or the PSAP admin line, which is just a normal number). They're going to demand 911 be answered regardless of billing relationships. At both 911 companies I've owned, the routing system depended on being able to "spoof" caller ID. We would have to accept whatever caller ID we were given, because there's it's essentially intractable to know who has the actual relationship with the end user. It's also not knowable if the connection handing me off this call is authorized to use that number. There's simply zero concept of that. Additionally, there's no such thing as a real master database correlating number-address. (That'd make things easy easier!) Even if there was, it'd still be trivial to swat. Buy a number online, say your address is <target address>. Place a legitimate call that "authenticates". Change address, repeat. Worst case scenario (if you can't make an anonymous payment), hack someone else's VoIP account and change their address and place call. You are right that this is a large problem. Some PSAPs have come under DoS attacks, getting a flood of fake calls. 9-1-1 is a critical piece of safety, and it's fairly unprotected. Funding is limited. Some of the vendors involved are laughably bad. And, at least a few years ago, there was a massive disconnect between technology/Internet and the emergency response side.

iy56 14y ago

Verification really doesn't matter. Emergency responders aren't going to ignore a report like this where human lives are reported to be at stake just because it comes from an unverified number.