Comment by markovbot | Hacker News Reader

Comment by markovbot | Hacker News Reader

So the article doesn't seem to mention any of the ongoing efforts to stop or reduce caller ID spoofing, such as SHAKEN/STIR. I'm not clear if that will do anything, and it's certainly far too little too late, but the industry is doing something.

On that note, does anyone know how SHAKEN/STIR is supposed to work? I understand that it basically sets up a PKI with JWTs in SIP headers, but from what I can tell there needs to be some sort of trusted CA which creates and signs these things, but I can't tell who that CA is or if there even is an agreed upon central CA.

I'd also be interested in any corrections/expansion on any of the things I said above, I really don't know much about it and would like to.

edit: after making this comment I did a bit more research, and it looks like[0] there will be per-country CAs that can issue certificates to owners of phone numbers within that country. I'm specifically curious about which CAs will be trusted in the United States.

[0]: https://tools.ietf.org/id/draft-burger-stir-iana-cert-00.htm...

Authority for the North American Numbering plan currently falls to the FCC, after the breakup of AT&T; they contract out administration, Ericsson got a 5 year contract in 2017, previously it was administered by Neustar (and Lockheed Martin, before Neustar was spun out).

I'd imagine Ericsson would spin up a new CA instance just for this. As the administratior, they keep the records of who phone numbers are assigned to, and where they've been ported.

My understanding is once a +1 area code is allocated to a country, that country's telecoms regulator manages further allocations (or contracts it out).

Cool, thanks for the info. Any idea what the timeline on creating that CA is?

No idea. I wasn't aware of this proposal (STIR), I just am aware of a lot of number allocation stuff. Does STIR have any support from telecoms companies and/or ITU? Or is it IANA only?

I see Neustar has a page that seems related: https://www.home.neustar/atis-testbed/index.php ?

From what I can tell, the telcos are implementing it, or at least say they are:

* "Caller Verified is T-Mobile’s implementation of the STIR and SHAKEN standards" [0]

* "Verizon reiterates both our commitment to deploying the STIR/SHAKEN call authentication technology" [1]

* "Sprint supports efforts to build the SHAKEN/STIR call authentication system" [2]

* AT&T doesn't seem to mention STIR or SHAKEN by name on their robocall page [3] but the FCC sent them a letter thanking them for their "commitment to implement a robust call authentication framework in 2019" [4]

* "Comcast is proud to be at the forefront of efforts to address the scourge of illegal spoofed robocalls in this country, including the development of the end-to-end call authentication protocol known as SHAKEN and STIR" [5]

etc

[0]: https://www.t-mobile.com/news/caller-verified-note9

[1]: https://ecfsapi.fcc.gov/file/1119062987519/2018%2011%2019%20...

[2]: https://ecfsapi.fcc.gov/file/1091391175368/Sprint%20Call%20A...

[3]: https://about.att.com/sites/cyberaware/ae/robocall

[4]: https://docs.fcc.gov/public/attachments/DOC-354933A2.pdf

[5]: https://ecfsapi.fcc.gov/file/111974588343/Comcast%20Resp%20t...

That's a nice effort, but I think the phone company should be required to itemize each call's billing information by default. Perhaps the billing number (the number obscured by spoofing) on every bill, with the rest available by request or on the website (to save paper).

But all in all, the problem is that the phone company will refuse to help unless required by law. They make good money from shitty robocallers.

More info on SHAKEN/STIR:

https://transnexus.com/whitepapers/understanding-stir-shaken...

http://nymag.com/intelligencer/2018/05/how-to-stop-spam-robo...

Quick correction, I don't think "doing something" (italics omitted) is the legal standard for regulatory intervention

Right, I didn't mean to imply that this action by the FCC was in any way wrong. The fact that caller ID is completely unauthenticated in 2019 is horrifying, and regulation is long over due.

Reply on news.ycombinator.com