Hacker News Reader

Comment by _bxg1 | Hacker News Reader

I've never understood how number spoofing can be so easy in the first place. Are there no security mechanisms? Are numbers not somehow tied to a physical line/sim card? We don't have a widespread problem with domain spoofing (when it does happen it's because one of the mechanisms has been actively compromised, not because there simply isn't one). I don't see how this is different, aside from telco companies just not caring enough to do anything about it.

I'm seriously wondering. If anybody can enlighten me, I'd appreciate it.

View on HN

When an organization makes an out-going call, they generally wish to show their central number to the caller. So if someone from within Apple (for example) called you, the caller ID would show the Apple general phone number, rather than the actual caller's number. To achieve this, the business exchange server that companies use has a field in which they can place any phone number they choose. This field was seen by the designers of digital telephony switching as merely a convenience feature for customers. Of course, the "feature" is now widely abused. I think it would take much effort to come up with a system that forced a legitimate number to be placed in that field.

You'd just need a "certificate authority" system like we have with domains. Companies that wish to use a "virtual" phone number register as such with the provider (they probably already do), and the provider keeps a whitelist of those, which is enforced crytographically. Email had the same problem before MX records.

Maybe the challenge is doing all this in such a way that's compatible with legacy systems, though I'd think all of the complexity would live on the business exchange servers and the network itself, so "dumb" phones shouldn't have to know the difference.

Either way, I've learned to never underestimate the laziness and capacity for anti-consumerism of telecom companies.

I as a consumer however do not wish to have to navigate a phone tree to get back to whomever left me a voice mail.

As I suggested elsewhere you make the CEO personally liable and a technical solution will be found. It will probably just mean that the telephone company sent the relevant information and ignored what came from the subscriber.

If you have the time listen to this:

https://www.gimletmedia.com/reply-all/102-long-distance-part...

it gives a lot of information about the subject

Reply on news.ycombinator.com