Hacker News new | ask | show | jobs
by mey 4304 days ago
The ease at which caller id is spoofed could be solved by the carriers. If sent called id information doesn't match line termination information (geo location and owned phone numbers) block the call.
2 comments

No, it actually cannot. The phone network is a massive bunch of criss-crossing and mutually-dependent relationships. It is intractable to know if a given company is "allowed" to send a certain calling party number.

Not to mention such a restriction would break many applications that depend on the source caller ID being forwarded. Call forwarding applications, some 911 implementations, etc.

So the underinformed get a better idea of what you mean by "criss-crossing and mutually dependent relationships" I'll say that there are many, many phone companies, and they constantly buy and sell DIDs (phone numbers).

They all run different hardware and software, and can't even keep track of who owns what DIDs. During the average day there are several phone network outages throughout North America as certain sets of numbers become unroutable from certain networks. Carriers often end up sending CSVs and excel files with their latest updates around, frantically.

In this system, Caller ID is a fourth class citizen. No one can spare the time to care about it, no systems are standardized, and no networks are responsive in anything like the time you'd need to maintain a system that monitors what caller ID information is allowed to originate from what place.

The CSVs and Excel sheets thing is out of control. Basically the entire telecom infrastructure runs off assorted attachments sent to people with essentially zero verification. (I have a sinking suspicion that many other industries might run the same way.)

To govern which calling party number can get sent, you'd need an access control system that goes all the way down to the end user. For instance, if I start using Skype, I may want to place calls from Skype using my cell phone number. It's not desirable to block such usage.

Which means I'd have to have a way to make ABC Comm (who I bought my number from) signal their provider to signal their provider that I've now granted access to Skype. And this would be required every step of the way (ABC Comm would need to let everyone know which 5 providers they use. Each one of those providers would need to let everyone know which 20 providers they use, etc.)

So it's not really a lack of care or time. It's just that to make it work like you want it to actually work, you end up with this massively layered, complicated thing. And if any part goes wrong, you end up messing up people's calls. (And some of those calls could be 9-1-1 emergency calls, so you might end up killing someone.) All for what benefit, exactly?

The FCC could fix this problem overnight. They just need to levy fines, get serious about it. If I was liable for my customer's behaviour, I'd make them put up a deposit or go through some serious hoops - maybe require insurance. The entire problem would be solved within weeks. It'd just take a few hours of work in drafting the law to make sure good-faith actors aren't going to get hurt.

This, just like IP spoofing is something that should be straightforward to correct. However, the carrier in both cases has incentives to continue allowing it (getting to charge for minutes, or bandwidth).
I wouldn't say that carrier's have a large incentive. Dialer or robocall traffic is normally frowned upon in the telecom community. We charge per minute, and dialer traffic is the worst offender or taking up large amounts of resources, while providing very little minutes. To give you an idea, a typical robodialer user may have 30% of their calls answered, and an average call length of 16 seconds. Whereas a "retail" or normal long-distance customer has an 85% answer ratio (ASR) and a 2+ minute average call length/duration (ACD). All of the tier-1 telecom carriers have strict rules AGAINST this type of traffic. From a business perspective, a single T1 (23/24 channels), I can get ~200-300k minutes/month worth of usage. With a dialer customer, I can expect about 40k minutes/month
Actually, most carriers aggressively turn down customers that send dialer traffic, due to increased overhead versus total minutes (most dialer calls go unanswered or last only a couple seconds). Carriers would LOVE a magical way to distinguish, in real-time, a dialer call from non-dialer. But since they can appear from any number to any number, there's no way to know.

Instead, the carriers look at aggregate stats, and if it's too bad, they raise rates, charge fines, or disconnect customers. Some companies take a hard line and just cut any customer off if they appear to have any dialer. Others don't want to throw away an entire customer for only one fraction of the traffic. So everyone dances this line, trying to jam as much dialer in as they can get away with.