Hacker News Reader

Comment by nahikoa | Hacker News Reader

The technology behind STIR/SHAKEN is relatively interesting, integrating certificate authorities into the SIP protocol:

https://www.atis.org/sti-ga/resources/docs/shaken-faqs.pdf

As the article mentions, there are some shortcomings. Caller ID spoofing is necessary for some services, as in the VOIP world calls are broken up into termination (dialout) and origination (dialin). If STIR/SHAKEN takes hold, the CID phone number for termination will have to be signed by the origination carrier. It should be fun to watch the carriers handle it. (There are 3 levels of attestation, but that's the gist.)

Bandwidth.com also has a good overview:

https://www.bandwidth.com/glossary/stir-shaken/

View on HN

I just implemented this at a telecom. To expand a bit, the three levels are A, B, and C. There is also of course empty (no attestation). Three levels of attestation are roughly:

A = I know the customer, they own this number.

B = I know the customer, can't confirm they own this number.

C = I'm sending this call out, but I know nothing of the customer or this number.

Carriers sometimes don't want to receive anything other than A, because its probably useless to them. By that I mean, if it's not A, they don't want to be sent the attestation level or identity header at all.

Do you see any/some/most/all carriers implementing STIR/SHAKEN for termination soon?

As someone who works with multiple carriers, I doubt anyone outside of the wireless carriers and Inteliquent will implement STIR/SHAKEN soon in the USA.

Inteliquent (aka Neutral Tandem, Onvoy, Exiant, Vitelity, plus 20 other sub-brands) is the only provider implementing this protocol outside the cellular industry, and most of the CLECs they work with are not capable of maintaining SIP with a TLS certificate, let alone their own PKI as STIR/SHAKEN would entail.

Yeah, it's mostly wireless carriers at least for now. Already T-Mobile and I think ATT are rolling this out to consumers, called Certified Caller ID I think. However, the FCC is coming down hard on all carriers for this. I don't know if there's any fines for not having it implemented, but I know Chairman Pai said he expected it to be implemented this year. Obviously, telecom moves slow and it's not possible for all carriers. Even some SBCs I'm sure don't support it (specialized call handling hardware). It will be interesting what kind of legal requirements they put in place with regards to this. I think they will try to strong arm all carriers soon.

I might be mistaken but I believe Windstream, a rural legacy carrier, is planning to implement STIR/SHAKEN.

Do you know how this will actually solve the problem? Like will they actually let customers block calls without the desired level of attestation?

On cellphones, no/C attestation can show up with "suspected spam". I believe T-Mobile does this today somehow, possibly a line under the caller ID.

Whether or not it's a premium service will probably depend on the carrier.

As for your original question (blocking), I'm not sure. It's certainly in the realm of possibilities and carriers' fraud departments will have to decide what to do with it.

Reply on news.ycombinator.com