Hacker News Reader

Comment by paultopia | Hacker News Reader

But also, how have we not figured out how to stop caller ID spoofing yet? What the fuck?

It's not as easy as it sounds. The POTS network was not built with this sort of authentication in mind. Though every major carrier has converted to all-digital backhaul (which still leaves a number of last-mile exceptions here and there), every evolutionary step was built around backwards compatibility. What was never there can't be magicked into existence, though of course it can be strongly encouraged with incentives.

Even though mobile-to-mobile and VoIP-to-VoIP calls carry subscriber information under the hood, other call pathways don't or require translation of the information. STIR/SHAKEN are designed to carry this information end-to-end but the need for backwards compatibility and the usual slowness of cross-vendor cooperation leave some gaps.

> It's not as easy as it sounds.

It is. Stop Caller ID.

Plenty of identifiers can be spoofed (email addresses, for example). This doesn't mean they are not useful. 911 operators for example can use caller ID to locate someone who couldn't disclose their identity or was disconnected too early.

Getting rid of something useful just because it doesn't work perfectly is dumb. It's replacing infrastructure maintenance and improvement with demolition.

It's not a technical problem, it's a market capitalism problem.

Legislate that callers receiving a call without a valid caller ID will be allowed at least one month of bill payments returned and they'd make damn sure that they never routed calls without a caller ID. "Valid" would have to encompass things like 'foreign country of origin', I imagine. So, a call from a scam call center, that the local company allows to be routed, might only have "City, Country". But that would be enough to auto-block all non-domestic calls. Your home country's supplier can decide whether to route calls from a foreign peer, but I imagine that not being able to charge customers would be sufficient impetus?

A company routing more than X% of non-IDed calls could be subject to penalties against it's directors (a fine equal to a years income, and/or 5% of all assets, would probably be enough), just to sweeten things.

Why aren't we more militant with companies that enable antisocial/scam activities?

No, it's a technical problem. These weaknesses exist because legacy systems had them and the entire telephony network is nothing but backwards compatibility and technical debt.

So in your view well regulated telephone networks could not feasibly ensure every call has origin data? Not even to the level of upstream origin to the suppliers network?

In other words, they have no idea where calls enter their network from; a corollary of which is they don't know which company to bill for any of the calls they terminate.

Companies purposefully allow false origins for call centres, and purposefully carry calls from spammers for financial reasons (they get paid). It's not a technical problem.

What you describe is an historic problem, not a technical inability to act.

Traditional regulatory authority has been moderately effective at getting changes made already, but being too aggressive risks network fragmentation. Even the USA is just one participant in the NANP, never mind the global telephony network.

We also don't live in the days of AT&T having a monopoly anymore. Any change requires cooperation between different vendors, and ensuring a smooth rollout means allowing for a slow rollout. This is the telephone system after all, not some startup's barely-used product.

Plus the government has multiple arms and some of them don't want the changes to be made or not too quickly (surveillance, stings, etc.).

Reply on news.ycombinator.com