Hacker News new | ask | show | jobs
by dredmorbius 1 day ago
Doctors' offices, hospitals, and schools are well aware of this problem because they're dealing with both the outgoing and incoming elements of it. Many hospitals no longer permit direct calls to inpatient rooms because of the spam and fraud rates. Outbound communications are similarly frustrated, and are driving use of online and app-based contact methods (with ... their own issues).

Other organisations, institutions, and businesses too. HN discussion tends to focus on the consumer side of this, it's what most commenters have most familiarity with themselves, but you'd better believe that pretty much the entire phone customer base is fed up to there on this. Which puts the entire network at risk of defection, a risk that telcos have been talking publicly about for over a decade now:

[S]ince mid-2015, a consortium of engineers from phone carriers and others in the telecom industry have worked on a way to [stop call-spoofing], worried that spam phone calls could eventually endanger the whole system. “We’re getting to the point where nobody trusts the phone network,” says Jim McEachern, principal technologist at the Alliance for Telecommunications Industry Solutions (ATIS.) “When they stop trusting the phone network, they stop using it.”

<https://nymag.com/intelligencer/2018/05/how-to-stop-spam-rob...>

I've mentioned this on HN a few times: <https://news.ycombinator.com/item?id=21494300> <https://news.ycombinator.com/item?id=21542926> <https://news.ycombinator.com/item?id=28756827> <https://news.ycombinator.com/item?id=29003329> <https://news.ycombinator.com/item?id=31939562>.

Broadband Breakfast just addressed the issue as well in this Fediverse toot, calling out not just schools (subject of the legislation) but other affected entities: <https://mastodon.social/@BroadbandBreakfast/1169990755811584...>.

1 comments

Jim is a good guy and ATIS tried real hard with STIR/SHAKEN, but technology cannot overcome the commercial incentives that carriers have to let this nonsense continue. I've written about this before too [0].

[0] https://news.ycombinator.com/item?id=48920432#48928781

I'd seen your earlier comment at the time.

Your follow-up, here (<https://news.ycombinator.com/item?id=48938169>), was particularly insightful, and has influenced my thinking. Essentially: authentication / validation should happen out of band with phone number itself, for the reasons you've given.

I do suspect that for routing authentication, header-level signifiers should be reasonably useful, but for strong identity or authority attestation, they're not. That's ... a deeper problem, but also one which can be solved independently.

Oh, and I'd love to see that Dallas Morning News AT&T CEO interview story, if you could find it.

Would this be it?

"Watchdog Memo to AT&T's CEO: Didn't mean to get you in trouble", by Dave Lieber (July 8, 2016) <https://www.dallasnews.com/news/watchdog/2016/07/08/watchdog...>

Yes, I think that is it. Thank you for finding it!

AT&T took some bad press around that time, and in July 2016, the FCC, facing political pressure, and now sensing that the PR gods were now on their side, leaned on the major carriers to set up a 'task force' to get things moving. I remember sitting in the little room at the FCC while various telco industry grandees bloviated. We all agreed that ATIS and IETF should define technical standards since they'd already made a start (Jim M did ATIS, for example) and so everyone agreed that STIR/SHAKEN was going to be The Path.

The original STIR/SHAKEN assumptions were that the attestation would be carried throughout the network in a SIP header and that every SIP processing element would deal with it. Reality soon intruded in the form of ancient telco equipment that didn't have the headroom to process another bunch of bytes in every call setup message. Another idea was to have signing and verification done by SIP application servers, but that didn't pan out for the same reasons. (Forgive me, I'm going to toot my own horn here for a second:) I invented a scheme with my colleagues where the signing or verification was an HTTPS operation triggered by the SIP device at the network perimeter (a 'session border controller' in telco-speak) which made the problem more tractable. AT&T took my PowerPoint and submitted a stunningly close copy as their own to the FCC. I still have the slides somewhere. I was salty at the time but ah well, what can you do: my employer still made money off the product with other customers.

Thanks! I'm going through the articles with interest.

I've heard the "but we can't filter traffic at the network level" line from AT&T much more recently than that date. If there's any corporate learning that's occurred, it's not filtered through the ranks.

It seems as if sorting out the STIR/SHAKEN situation with smaller telcos is going to have to happen. How that happens is something I don't have much clarity on, though I suspect some degree of national regulation and assistance will be required in the US. Your work could be an element of that?

I've been ... unhappy ... with telecoms options for well over a decade now, and predicting the #DeathOfTelephony (one of my Fediverse topics/tags) for much of that time. It's coming about more slowly than I'd expected/hoped, but I'm seeing lots of strain. Enterprise/organisational frustration has been increasingly apparent over the past five years or so. Millennials and onward (as well as many Gen Xers) actively avoid voice calls. It's simply getting hard to connect to people. Then there's the privacy / surveillance / propaganda / manipulation elements.

I think what I'd like is a SIP trunk to the house, and manage remote calls over WiFi (possibly with a SIP phone, I've got an old GSM 2G I'm thinking of doing some hardware-hacking on, or I could buy something ready-made). Carry a standard mobile for emergencies, but avoid it if at all possible, and route most comms through the VOIP system with a bunch of bespoke rules.

If I were running a business there'd be other considerations. I'm ... glad I'm not, for the moment.

The extent to which something vaguely resembling that might be more widely used ... I'm not sure. I'm thinking through elements I'd like to incorporate, might post that later (probably to the Fediverse or elsewhere for now).