Comment by corresation | Hacker News Reader

Comment by corresation | Hacker News Reader

Parent Full thread

It's the same as IP traffic, really. Calls can go through any number of providers. You can spoof phone traffic just as easily as IP traffic.

While this seems to get stated a lot, it isn't actually true at all: spoofed IP packets get no response (I should also add that most providers flag and drop packets that have no business originating from where they did, so spoofing IP is usually a completely non-starter to begin with), or rather the response goes to an entirely different place (as if you spoofed someone's number to call 9/11 but only the original number can actually hear what the operator is saying). There are a couple of examples of very large providers misusing BGP (usually accidentally), but it is immediately identifiable, completely tracked, and rejectable.

It's not even desirable, what you're asking.

What am I "asking", given that you've gone to such lengths to declare it? If someone has a phone on AT&T or Verizon or even Skype the provider should be able to essentially sign the call initiation. Much like TCP, the world phone system has a routable infrastructure (otherwise it would be impossible to call a number because where does it go?), and such a mechanism is hardly far flung when we're talking about emergency services.

Yeah, there are some services that can't abide by that, and they should properly be flagged as "completely anonymous, untraceable call" and get the credibility such deserves.

Spoofed telephone calls can't be called back either, exactly like IP.

You are asking that the originator of a call be identifiable somehow. That's not possible, given the number of resellers and levels. That would require even more trust, getting every provider to have a transitive trust relationship and show ID. A single call might go through 3, 4, even more resellers before ending up at the destination.

Spoofed telephone calls can't be called back either, exactly like IP.

These emergency phone calls are two-way communications, exactly unlike the IP spoofing situation (seriously you really want to stick with the wrong IP example?)

You are asking that the originator of a call be identifiable somehow

Wonder of wonders, yes I am. The world phone system is a completely routable system -- providers effective own prefixes or even individual numbers, which is exactly how one can call someone. The notion that if a call comes in that says "Hi I'm 555-5555 from Verizon @ 555 Blaxberry Lane" and it can actually be verified if not authenticated by Verizon is hardly some big technical marvel. It's actually TRIVIAL, and it's exactly how the world pay-phone system works (note that these people aren't spoofing numbers to call pay sex lines because the telcos actually care about that). This whole ball of nonsense is because telcos have zero obligation to give a crap, so they don't.

SMTP might be a better analogy, but I'll concede as it's irrelevant.

You're wrong about the compensation bit. It's entirely possible to send fake traffic and get compensation. Cutting that off is an entirely manual process; with someone noticing the fraud and reporting it. It's not some magic authentication that happens.

The reason things like sex lines (either premium rate numbers or just really high-rate areas) often do not work is because the costs are passed on through the various companies (so they'll clip anything over a few cents) or because they simply will not accept calls if they are not within the trusted system. If you have a VoIP line and try dialing a 1900 number, it won't work unless that VoIP provider has made a specific deal. It's not like they look at the calling number, then mail out bills to whoever they think the owner is.

Guess what: Folks don't accept limitations on dialing 911 (or the PSAP admin line, which is just a normal number). They're going to demand 911 be answered regardless of billing relationships.

At both 911 companies I've owned, the routing system depended on being able to "spoof" caller ID. We would have to accept whatever caller ID we were given, because there's it's essentially intractable to know who has the actual relationship with the end user. It's also not knowable if the connection handing me off this call is authorized to use that number. There's simply zero concept of that. Additionally, there's no such thing as a real master database correlating number-address. (That'd make things easy easier!)

Even if there was, it'd still be trivial to swat. Buy a number online, say your address is <target address>. Place a legitimate call that "authenticates". Change address, repeat. Worst case scenario (if you can't make an anonymous payment), hack someone else's VoIP account and change their address and place call.

You are right that this is a large problem. Some PSAPs have come under DoS attacks, getting a flood of fake calls. 9-1-1 is a critical piece of safety, and it's fairly unprotected. Funding is limited. Some of the vendors involved are laughably bad. And, at least a few years ago, there was a massive disconnect between technology/Internet and the emergency response side.

Verification really doesn't matter. Emergency responders aren't going to ignore a report like this where human lives are reported to be at stake just because it comes from an unverified number.

Reply on news.ycombinator.com