Hacker News Reader

Comment by TheSpiceIsLife | Hacker News Reader

As an individual authenticating callers is difficult.

I recently had someone claiming to be from the ATO (Australian Taxation Office) call and ask me to identify myself. Not surprising, my tax filing is overdue. I advised them as a security policy I do not give out PII to unauthenticated callers, asked for a reference number and a return phone number. The number I was given is not listed on the ATO website so I did not return the call. Found some forum posts claiming the number is for return callers who have a reference number. Still, if I can’t find the number listed on offical media I don’t call back.

I’m trying to think of a way the average person could authenticate a caller. I’m not security or technology expert so my knowledge in this area is limited.

Any ideas?

View on HN

I've had my bank call me at work because I forgot to pay my credit card off the day after it was due. No callerid info, just a number. The woman on the phone didn't say who she was, who she was calling from, she just immediately asked me if this was blahblah. My work has been the subject of a bunch of scammers calling about financial services lately so I wasn't too keen on saying who I was. I kept asking her who she was calling from and she just kept asking me who I was. Finally she said she was from my bank. I told her I'd call her back. Called up my bank and had to wait through several people for someone to tell me what was up. Not only does there need to be some etiquette when cold calling someone (like using callerid and stating upfront who you are and who you are calling from!) but callerid need an update so you can't spoof it so we can trust it again.

Funny cause on email this is a solved problem (from a technical standpoint not a social one); encryption and digital signatures are easy. And it would be so useful to those industries too.

Etiquette from a bank is like water from a stone. Consider moving your accounts to a credit union.

I think just call back on one of their listed numbers and explain.

It seems so obvious now you've pointed it out. I do like to over complicate things.

This is the advice given by banks and anti-fraud agencies. NB in some countries landlines can remain on a call for several minutes after the call receiver has hung up. A phisher will play a dial tone etc to make it seem realistic. The advice is to either wait 10 minutes (longer?) or preferably call back on another line if you receive a suspicious call.

Or try calling somebody else you know. If you land back on the same caller, you know they're playing you. =)

> NB in some countries landlines can remain on a call for several minutes after the call receiver has hung up.

Source for this? I find it highly suspect from a technical perspective (1-3 seconds, maybe, but not several minutes) and nothing I can find online even remotely seems legitimate / real.

I’ve personally experienced this, probably 30 years ago, in Canada.

I’d call a friend, we’d finish talking, then I’d hang up and as a joke he’d leave his phone off the hook. I couldn’t make another phone call until he hung up or some timeout of unknown length passed.

When I was younger in the US the situation was similar, but I thought it was up to the originator of the call to disconnect. Been too long to be certain of my recollection.

I never determined the timeout, and I haven't had a land line in at least 15 years to experiment with.

You could be right, I can’t remember if the times that happened were when I originated the call or my friend did. I know it didn’t work all the time, and I think it stopped working at some point too.

This was back in the days when you could tell roughly where someone lived by their phone number - 43x—xxxx was south Edmonton (but not Mill Woods or Riverbend), 2xx-xxxx was Calgary, area codes didn’t matter because the whole province was 403, etc. The phone system is a lot different now - you can port a landline to a cell phone (and vice-versa). The original phone number where that happened has been ported to the cable company and now goes through coax (the equipment that handles it is basically a cable modem with a phone jack).

Actually, I’m coming around to your point of view. I think it was the recipient who controlled the “transaction”.

The world was so very different. Waiting for that 0 to finally work its way around the dial, good grief. Especially since as a kid I was perpetually afraid any phone number that included a 0 might lead me to somehow get connected to a phone operator, so I wanted to dial the following number as quickly as possible.

One of the things that radio hosts here joke about is how kids with a zero in their phone number had fewer friends. “Oh, I don’t want to call Bobby, he’s got two zeroes in his phone number, it takes so long to dial”. Between that and risking talking to An Adult and getting In Trouble, I wonder how true that is.

Telecoms + networking software engineer here:

'tis true - the caller has call release control on the PSTN i.e. the call doesn't end until the caller puts down the phone. There's special handling for e.g. 911 calls so that call release control is given to the callee i.e. the PSAP.

This doesn't work for e.g. SIP because the SIP client is not a dumb slave to the network. If I click end call, even if the network doesn't 'want' to end the call, my phone thinks the call has ended.

This used to be true but I really doubt it’s the case anymore.

Most of the “PSTN” nowadays has a bunch of SIP or other digital stuff in the middle, so this breaks down. Not to mention, this was never possible for mobiles to begin with.

It really is the case. VOIP in the middle isn't a problem. MGCs can translate between the callee's phone being on-hook to a SIP re-INVITE with inactive media. In fact, I've worked on projects in the last few years to do just this.

Telcos move slowly.

You're right about mobile networks though - that's a different kettle of fish.

Just wondering, why is that? It seems like a lot of effort instead of just sending a BYE when the phone is hanged up. I don’t see any legitimate reason for this “feature” to exist - if anything it makes scams & eavesdropping by a malicious remote caller easier.

Per one of the articles I found on it, British Telecom apparently set the delay to 3min. The rational (if article is to be trusted) is that customers wanted the ability to hang up one phone and pick up another phone in the same home without disconnecting the call.

It is how the old copper PSTN network worked, and if you are lucky enough to still have an actual copper PSTN phone line it is still true.

My argument was that even if you did have an “actual” copper line it would eventually be terminated at a device that speaks analog phone line on one end and spits out SIP on the other end.

This specific hanging-up behaviour was an artifact of older analog switches and I didn’t think they would emulate it in the software-based SIP switches but according to the comment above it’s still the case.

I definitely knew this was the case back when analog COs were the norm, but didn't realize this was still true. Seems it is very dependent on PSTN provider (I know SWBell didn't do this for normal lines when I worked there) as some do, some don't.

True in the UK; https://security.stackexchange.com/questions/100268/does-han... has a decent description of the history and includes a note that BT changed in 2014 from a several-minute timeout to 10 seconds, because of fraud issues. The link to the BT announcement of that change has bitrotted, but it is at https://www.openreach.co.uk/orpg/home/updates/briefings/down...

I just had the exact opposite experience! I was discussing scams with my regular painter. He said he got one recently, and showed it to me on his phone. It was an SMS that said, "Dear <FORENAME>, we have been trying to contact you without success. Please ring BlergCo on 99999 about your outstanding ATO debt". I thought, easy enough to check. I went to the ATO website; clicked the link about what we do if you don't pay; clicked the link about which collection agencies they use; checked for green padlocks throughout; and voila - BlergCo, 99999! Since the number on the SMS exactly matched the number on the verified ATO website, I couldn't see how the scam would work. So I told my painter I'd changed my mind, it was probably legitimate, and he should ask his tax agent to follow it up. Which he did. Then paid the overdue provisional tax that he'd completely forgotten about! It made me think, legitimate SMSs (like that one) should probably have extra words to tell the recipient how they can check that it's legitimate. For example, "NOTE: to verify our company name and contact number, please go to the ATO website at xxx.yyy.zzz (and remember to check the green padlock!)", or somesuch.

Same thing is happening here in Canada, got 2 calls recently. Geez what is going on?

The whole POTS system is archaic and ripe for abuse (which we see with telemarketers able to spoof their numbers).

IMHO the solution would be a calling system where spoofing is difficult/not allowed.

Reply on news.ycombinator.com