Hacker News Reader

Comment by walrus01 | Hacker News Reader

There is no way to fix the ability to spoof caller ID with the way SS7 is built. Not without breaking functionality to something like 85% of the installed base of PBX and phone switch equipment, most of which is anywhere from 10 to 45 years old. The legacy telco SS7 phone system needs to be burnt to the ground and rebuilt, but it never will be, because people have moved on to friend-opt-in based message platforms like whatsapp, signal, telegram, facebook messenger, and the domestic chinese equivalents (wechat etc).

View on HN

Compelling telcos to do that is the regulator's job.

Not sure about the US, but in most of the rest of the world regulators come up with new rules and regulations requiring some form of network upgrade all the time – SLAs, connectivity and routing requirements, legal interception, data residency, etc.

And telcos have no other way but to spend billions to protect some monopoly or enable more surveillance power for the governments. It's a matter of priorities, really.

I just want the major cellphone companies numbers to show up correctly and everything else can be ???. That does not require fixing all these other systems.

Exactly, If your provider can't be certain that the number is real (i.e. they generated it themselves or it came from a trusted/liable source) then they shouldn't be charging for it and held liable if they allow a spoofed number for fraud. Maybe that would be the mean the end of caller-ID and associated fees, but if I'm not sure that it's useful today with the level of spam. If someone spoofs your ph# to make 5000 spam calls, I guarantee it's not useful to you.

Find another in/out of band way of providing caller-ID services.

How exactly could they do that for calls originating outside their network? Most spammers are using VoIP, not cell phones on major US companies.

they can't, because as things currently exist they have to trust the caller ID data in the SS7 links coming from other wholesale carriers where the calls are coming from. possibly several hops away from the grey market voip sip trunking providers.

They could not fix it. However, it would be a big value-add to me if, say, the big 4 US carriers could add an out-of-band security check and block calls to their networks from numbers they control but which are spoofed.

I get way too many calls from area codes and prefixes I recognize. This would help me get some of that back.

There are legitimate use cases like Google Voice for sending caller ID that another carrier owns. Despite that, a basic authorized users list would be an easy fix, doubt that'll ever happen though. Look at the mess that LRN and CNAM data are, providers will nickel and dime for access to data that doesn't cost much to maintain...

Google Voice could A join the system or B have ??? as their caller ID either one would be useful. Again, they can say whatever number they want as long as I can opt out and block unknown numbers.

However, the current system is largely useless when you get spoofed calls from numbers you recognize.

They know who to Bill for the call. Fix the rest. I don't care about excuses for this.

Yeah, it's hard not to think that basically rebuilding the entire phone system would be a massive case of fighting the last war. People won't stop needing the phone system entirely but it becomes a piece of quirky legacy technology.

And probably just have to live with the fact that there will be situations where people are harder to reach quickly than they are today.

Rebuilding SS7 with new modern features, and making it talk natively to all the existing 10 to 50 year old SS7 equipment deployed in the world would basically be polishing the brass doorknobs on the titanic.

Reply on news.ycombinator.com