[saltcured]

Sad times are coming for a lot of families and individuals. It isn't just that technology is upending our naive ideas of trust and authenticity. This is, essentially, the broad class of "confused deputy" attacks. And the robust mitigation is to disempower the easily confused deputy, rather than to think you can block confusing signals.

A looming problem with shifts in demographics and family structure is that many people will be slipping into cognitive decline without a formal transition to address their incompetence. Sadly, there is a point where the older person really needs to permanently delegate important decision-making to a trusted third party. They should no longer be legally empowered to authorize funds transfers, sign contracts, or even make medical decisions.

We're not really setup to handle this well. Not at the systemic level of protecting people from themselves, and not at the personal level of relinquishing control over our own lives. So we often have to let the sufferer fumble along and cause a lot of damage before the protections eventually kick in.

And, ironically, these protection mechanisms can also be corrupted into another scam and form of abuse. To totally de-risk would require some kind of time travel or perfect foresight. But in the real world, the damage is often not fully reversible when it is detected after the fact.

[Perseids]

I'm usually not one to focus on technological solutions given sociological problems, but this one seems to be a good exception. If we "just wanted to" [1] all this fake calls could be stopped by requiring strong authentication/authorization. We are very much used to just anybody being able to call my number, but that doesn't need to be the case. At the very least, cold calls should be treated as skeptical in the UI as instant messengers like Signal treat first messages. Probably this isn't enough, though, as it wouldn't have prevented the cases described in the article. Cold calling someone should probably require the caller to be traceable to a real, government-ID-verified person [2]. Even if that person is being defrauded themselves ("get a thousand bucks by installing this app and clicking a few screens") is would destroy the economics of the attack, as it would make each call expensive again.

[1] Structural inertia is the killer here. It will certainly not happen until the problem is huge enough.

[2] Exceptions can of course apply to numbers that are meant to primarily be cold called, like doctors offices. The callee possibly have to be specially trained to withstand this kind of attacks.

[smallmancontrov]

Speaking of which, what happened to SHAKEN/STIR? I thought the strong authentication requirements came down the pipe years ago and they were going to start turning off (or hiding by default) routes of low reputation. That was years ago, it was supposed to take years, but here we are years later and I still get loads of spam calls. What happened?

[kjellsbells]

I worked on STIR/SHAKEN for the two biggest US operators. The techies tried very hard to make it work, and, indeed, there was a brief time when it worked pretty well, but, the incentives from Corporate were and are fundamentally misaligned.

Type A attestation is, generally, solved. Carrier A attests that the number is one of theirs, and they know that the caller is one of theirs too and attached to their network.

However: this is a fraction of calls. Carriers also sell blocks of phone numbers without the corresponding access network. This is what allows you to pick, say, a Twilio number with a local area code. In these cases the best that can be hoped for is a lesser attestation.

But it gets worse, because the operator can also sell blocks of numbers to people with no direct connection to the US carriers and who need to spoof US numbers. That call from Capital One comes from the Philippines via two or three intermediate operators, none of whom can attest to much of anything. And into that gap ride the spammers.

Furthermore, in an Experian-like twist, some carriers also realized that businesses would pay to have their calls show up as "trusted" on the recipient's phone. So the standards were enhanced to deliver 'rich call data'. However, in order to be something worth paying for you also need a baseline of calls that do not have that premium look. A scam? You decide.

Finally, one other misaligned incentive. All of this needs VoIP. Not TDM (classic legacy telephony). However, the big US carriers make bank selling TDM circuits to the hundreds of small regional telcos, and refuse to sell them SIP trunks, because it's s such an easy money maker. So again, technology loses to incentives. These incentives, to make money from phone numbers, vastly outpace what

[smallmancontrov]

So we can't block shady spammers because business wants shady customer support call centers? Ugh. It figures, but ugh.

Thanks for the inside perspective.

[kjellsbells]

I'm going to mangle the terms of art here, but the ur-problem is that labels of routing, like phone numbers and email addresses, get confused with labels of identity, and then with indicators of trustworthiness.

Everything is built to address that weakness - think DKIM, SPF, etc, plus STIR/SHAKEN, to say nothing of IP or ASN filtering, but they feel like bandaids on a very difficult problem. What you end up with are basically default-deny except for a personally curated trust set ("only accept calls from my contacts", "everything goes in spam unless I have previously corresponded with the sender"), etc.

One last robocall story. AT&T sat on their hands for years until consumer groups embarrassed the then-CEO enough to do something about it. There was a memorable interview in the Dallas Morning News where they called him on it instead of lobbing him softballs and I suspect that the embarrassment finally got through.

[e40]

Details please on the AT&T CEO story

[cptroot]

It's worth noting that TFA addresses this in the context of the scam: When the scam depends on the emotional reaction in response to a loved one's distress, it doesn't matter if the number the scam is coming from is unfamiliar. This means that the scam can use "technically correct" numbers that pass SHAKEN/STIR with no loss in conversion.

TFA also mentions that by routing calls through older non-IP networks you lose the accurate information, although it sounds like the FCC is slowly cracking down on this.

[indymike]

It is hard to get vendors to give up revenue no matter how illegal the source of revenue is.

[smallmancontrov]

So lots of judicially-unreachable call centers under judicially-unreachable telecoms need to lose reputation score and get spam-binned by default, just like email. I thought that was going to happen by now. Did the US telecoms just chicken out?

[tartoran]

Why not fine vendors instead? They'll quickly change the tune..

[sdellis]

I never answer my phone if I don't know who is calling me.

[pavel_lishin]

I think the hardest thing to come to terms with is not that this is the new reality, or even that this is soon going to be the new reality for our older relatives, but that this is coming for almost all of us.

[jdashg]

Disempowering deputies is how you end up with customer service that can't actually provide service to customers. Low-trust societies are a huge efficiency loss, and just a general pain in the ass if you are acting in good faith.

[bluefirebrand]

Like it or not, the Earth is a very low trust community. Old people get scammed by scammers from all over. This is a global problem, not a local problem

The global community is very low trust, unfortunately. That might be an unfixable problem

[coldtea]

How much "customer service" are we getting today, and of what quality?

[butlike]

> and not at the personal level of relinquishing control over our own lives

No one wants to do that. Once you give up control of your life you're essentially dead. Why would I want to voluntarily cede my rights so I'm relegated to being pushed around in a wheel chair while all my decisions are made by others? Because it makes my children, the people too young to have any perspective on the situation, feel better?

[atleastoptimal]

I wonder what percentage of the US GDP is "Fooling old people"

[cwmoore]

Compare to enticing youth, compounded over decades

[armchairhacker]

I think limited rights for old people are like limited rights for children: justified because there is cognitive decline, and every individual (except children who tragically die young) gets to live some life with full rights.

The biggest problem is that it’s depressing. A child gets to look forward to growing up and having full rights, an old person is already looking forward to declining and dying and the loss of rights reflects that. Another problem is that, just as some old people are scammed, taking away rights will have other old people abused by their “caretakers” (e.g. one relative hurting them and stealing from them even against other relatives, which already happens).

So I want to see it implemented but tied with our culture restoring respect for old people, giving them a sense of purpose, and looking out for those who aren’t our relatives. Specifically including reforming retirement homes, many which take advantage of their residents, and stronger safeguards against abusive relatives who (already are seizing and) abuse POA. I’d like to hear what old people themselves think, because maybe I don’t (empathetically) understand the consequences, but although maybe outside the Overton Window logically it seems reasonable.

[close04]

Children are legally differentiated from adults purely based on age, not some formal verification. You get extra rights and obligations at 18, that’s a very objective criterion.

Declaring someone mentally unfit is anything but objective and it’s very ripe for abuse.

[Terr_]

> Children are legally differentiated from adults purely based on age, not some formal verification.

Often but not always: https://en.wikipedia.org/wiki/Emancipation_of_minors

[armchairhacker]

I’m saying that old people should also be differentiated by age: once you reach some age (maybe 70 or 80, the same age for everyone) you lose certain rights. This is separate from the existing system.

[ninalanyon]

> limited rights for old people

How old did you have in mind?

> an old person is already looking forward to declining and dying

All of my colleagues who have died in old age (at least late seventies) did so in full command of their senses, one of them still contributing to international technical committees into their eighties.

Age is not a useful measure in this field.

[armchairhacker]

> How old did you have in mind?

Somewhere between 70 and 80

> All of my colleagues who have died in old age (at least late seventies) did so in full command of their senses, one of them still contributing to international technical committees into their eighties.

Likewise, there are 14-year-olds and 16-year-olds smarter and more mature than most adults. Loss of rights doesn't mean they can't contribute, have others deny opportunities or abuse them; people would still look out for them, they would have more protection than children in this regard. Mainly, it makes it easier and more common to control finances, prevent from driving, and prevent from rotting in front of the TV old people who have lost their senses.

[ninalanyon]

Perhaps I'm misreading you but giving up rights and losing rights are two different ideas.

I'm 70 by the way. If I want to plan for this I can set up a power of attorney.

[f1ay]

There's also the strain and discontent that comes with being the person who is taking away the rights and putting up guardrails for your loved ones. I opted not to do so for my mother shortly before she was scammed out of her life's savings, because I thought I could train her against scams.

[YeGoblynQueenne]

Nothing to do with cognitive decline. From the article:

>> It is tempting, and wrong, to attribute the targeting of older adults to naivety. The brief that prompts this article identifies a more uncomfortable truth: the characteristics that make older people disproportionately vulnerable are not deficiencies of intelligence but features of a life well lived. They tend to hold higher average savings balances, the accumulated product of decades of work, which makes them efficient targets — a single successful call can yield far more than one aimed at a younger person. They were raised in, and still operate within, established patterns of trust-based communication, in which a phone call from a distressed relative is answered as a genuine emergency rather than interrogated as a potential attack. They are, through no fault of their own, relatively unfamiliar with the existence of AI voice synthesis, having spent most of their lives in a world where a voice on the line was definitionally a person on the line. And they are exposed, like every parent and grandparent, to the particular emotional architecture of the family-emergency scenario, in which the instinct to protect a child overrides every slower, more sceptical faculty.