Hacker News Reader

Hacker News

Comment by cletus | Hacker News Reader

Parent Full thread

cletus

So robocalls are the result of:

- Cost of phone calls decreasing to basically zero

- Cost of automation going to basically zero

- Phone calls that can come from the Internet so there are no national boundaries anymore

- Caller ID operating on essentially the honor system

- Bad actors (telephone companies) benefitting from this traffic by charging for it

- Larger players having no incentive to punish bad actors

There's a reason why most messages are now sent on whitelist instead of blacklist systems.

For whitelist systems to work you need to be able to enforce identity or have a significant cost to sending messages.

Frankly I don't even want to receive phone calls on my "phone". If I did I'd be more than happy with a contacts only whitelist. Why I can't get this is beyond me.

EDIT: for those mentioning the doctor's office and other non-whitelist cases, just send non-whitelisted callers to voicemail. If you need to answer the phone then OK, I guess this won't work for you. But for the majority of people for the majority of their time, whitelisted contacts only with the rest going to voicemail will work.

View on HN

Whitelisting is problematic because there are so many cases where it's impractical or impossible to add a contact first: Doctor's office calling to confirm your appointment; restaurant confirming a seat reservation; delivery guy is outside and can't find your doorbell; Lyft/Uber/whatever is nearby and is looking for you; pharmacy calling to inform about a prescription being ready; some store calling to inform that your order is ready to be picked up; insurance company calling about some claim; etc.

These examples are from my own life, and they happen several times a month. I hardly ever make calls myself, but I do have to be able to receive important calls.

Obviously some use cases can be fixed with text messaging and app, and increaasingly they are, but there are always going to be exceptions. Directing to voicemail is also a solution to some of these, but voicemail acts as a filter: The caller may decide to not bother leaving a message.

> Doctor's office calling to confirm your appointment; restaurant confirming a seat reservation; delivery guy is outside and can't find your doorbell; Lyft/Uber/whatever is nearby and is looking for you; pharmacy calling to inform about a prescription being ready; some store calling to inform that your order is ready to be picked up; insurance company calling about some claim; etc.

The problem is phone number that is short and easy to guess. Imagine replacing them with a longer token that would be generated each time you want to give someone else a way to contact you (e.g. displaying a QR barcode on your phone and letting the other party scan it). Then you'd share a unique identifier with all that parties. Delivery guy can get a token that expires after a while. If someone abuses their ability of contacting someone, the token would get revoked.

I leave the details and implementation as an exercise for the reader ;)

That sounds like a huge hassle, which would probably make it a no-go.

QR codes are widely used in China for example for quick transactions: https://a16z.com/2017/08/11/qr-codes-in-china/

It's actually a longstanding part of phone culture - "extension xxx". It doesn't need to be terribly long to keep out spam - having to enter a single digit would fix the immediate problem, and even when the spammers adapted 3 or 4 still seem sufficient.

Yes, it sounds like how PGP failed.

The solution available on my land line is very simple, and works very well.

Any call from an unfamiliar number get an automated prompt to enter a specific digit. The digit changes, and of course relies on the caller being able to follow this simple instruction. All of this happens before my phone rings.

Once a call does get through (or even if it hasn't), you can review it on the telco web site, and either whitelist or block each calling number. Those that are whitelisted now get through directly, without the prompt, and then continue on as normal.

No cost to the consumer either for this feature, but it isn't on by default.

I'd expect to be able to whitelist my doctor's office number. Likewise services I use like Uber/Lyft/delivery service XYZ.

And if whitelisting becomes a thing you know the UI is going to say "your order is complete! Please click here to whitelist our number in case we need to reach you."

Not a big deal, and it basically solves phone spam.

> And if whitelisting becomes a thing [...] Not a big deal

But that's the whole (big) deal. The solution is usually the trivial and easy part - getting people to change is the hard part.

Humanity is littered with millions of problems that could be solved if it wasn't for inertia. A solution cannot simply be better or more convenient - it has to be so overwhelmingly better, so much more convenient for people to even consider switching.

And while this solution is better, I don't see your average person caring enough to take the time to make sure they've whitelisted all services they use.

The mental overhead of having to keep track of what to whitelist means it's not something 99% of people are going to do. So while it might work for you, it's not a solution. I'm certainly not going to do it.

If caller doesn't leave voice mail, then it's not important. All entities that value your business perfectly understand this. Worst case - complain to their management and this will get sorted out very quickly.

That's nonsense. Whether the call is important to them has nothing to do with whether it's important to me. The delivery guy may give up and not deliver my food; the doctor's office may just assume I will show up (but maybe I forgot to add it to my calendar); and so on.

Need intelligent chat agents to receive calls on your behalf and act appropriate, just as you would -- arranging legit appointments, coordinating pick up times with the spouse and trolling offshore scammers by dangling red herring personal info to keep their resources tied as long as possible.

AI assistants are all well and good but I find you continually run into seemingly simple situation that completely flummox them. I experienced this myself recently when I discovered that, despite nearly a decade of development, Google Assistant can't handle the command "navigate to the McDonald's closest to the Best Buy"

"Once again, sir, we're terribly sorry that Alexa misunderstood your daycare provider due to their accent. Due to your loss, please accept this $20 Audible credit to your account."

Give unimportant strangers a Google voice number or an equivalent. Being able to mark a phone call as spam for a centrally managed service is useful.

It never made much sense to me that the providers would not offer some kind of robocall-free plan. I would instantly switch to avoid getting any more of these spoofed calls, which would block the vast majority of robocalls. It turns out that it is government regulation somehow preventing this:

>"The FCC last year authorized voice service providers to block more types of calls in which the Caller ID has been spoofed or in which the number on the Caller ID is invalid." https://arstechnica.com/tech-policy/2018/10/robocallers-evol...

I pay t-mobile $4/month for their advanced spam-call blocking feature, and it works very well. I now get maybe 1 spam call every 2 weeks, compared against my worthless work number that has no such blocking which gets maybe 6 spam calls a day.

FYI: T-Mobile's app that they charge $4/month for is a reskin of the Hiya app (https://hiya.com/) that's only $1.25/month when paid yearly.

I just installed it. It identifies many of my recent robocalls as spam. Thanks!

It also allows me to block numbers from my sim area code. This is where most spam calls spoof to be coming from. When I recently called T-mobile to ask for them to do this, they said they couldn't help me.

I'm not entirely sure that is correct, because the behaviour of hiya and t-mobile's offering is different. Hiya will hang up on a spam call, but t-mobile's app seems to make it so they don't even connect to me.

I was using t-mobiles free tier scam call blocker, which worked pretty well except it also blocked calls from Twilio, including our downtime alerts. So I unfortunately had to disable it.

How does it identify spoofed numbers?

The company I work for has a similar feature. We have a tap on the actual phone network (for some carriers) and can track in real time. If we notice that (407)-555-1212 has placed 100 outbound calls in the past 10 seconds, that's probably a robo call. If it's from a phone number that isn't provisioned (or not in use---there are databases for such information) then it's spoofed. Or it could be a valid phone number whose home switch [1] is in Kentucky making dozens of outbound calls per second from the Barbados, it's probably spoofed as well.

[1] At least in North America, each phone number is assigned a "home switch," which will always be notified where (as in "which phone switch it servicing it" not "at 40°58′35″N 80°8′9″W") it is so calls can be forwarded to the proper switch (think roaming).

Thanks. It seems technically possible to stop a great deal of these robocalls with that info.

FYI, in France, the ISP called "Free" provides an option to block marketing calls in their box but many still go through

http://portail.free.fr/m/l-aktu-free/astuces/6159173_2015100...

The nightmare case for whitelisting is an emergency call from or on behalf of your spouse or child using a stranger's phone. This is why I don't want a whitelist.

What I want is for spammers specifically to be identifiable and blockable, or for their business to be made prohibitively expensive. I didn't get spam calls on my cell phone 15 years ago, and as you say, what has changed is largely economics. Why can't we work to adjust the economics back?

I treat my phone as if it’s on a whitelist anyway. I can’t imagine how people do otherwise. If it’s an unknown number, I reject it. If they leave a voicemail, I’ll get notified and I’ll check it pretty soon after the call. Every day I get no less than two unwanted calls from scams and robocallers. I don’t have time for that.

I do that, too. But I didn't always have to, and I shouldn't have to, that's my point.

I only answer calls from contacts, i ran into this scenario a few weeks ago, my wife lost her phone and wanted to contact me to locate it with "find my iphone" she just text me from her coworker's phone, no problem at all.

Sounds like some next century level “how to track anyone”. Just send an SMS from a random (non-spoofed) phone number, ask to do a “find my iPhone.”

Yeah, that would sound suspicious but she just let me know that she was calling from a diferent number.

That sounds plausible, but then why are robocalls not a problem in Europe?

I have two EU numbers and have never gotten a robocall on either of them. I have never heard of anyone getting a robocall in Europe, and while that might just be anecdata I think I would have heard something after two decades, especially in privacy-minded Germany.

When I get off the plane in San Francisco and activate my American SIM card, I usually have my first robocall before I get my first beer. And my mother gets so many on her land line, she always screens her calls.

What is Europe doing right here that America is doing wrong?

Denmark: almost all (cold) sales calls are forbidden by law.

Exceptions are sales of books, newspapers, insurance, and research (e.g. Gallup). There is also a "do not call" list that blocks all such calls.

In Danish: https://www.forbrugerombudsmanden.dk/hvad-gaelder/markedsfoe...

The exclusions sound... arbitrary?

I get the research exemption, and i’m Happy about a politics exemption, but why books, newspapers and insurance?

Why not bicycles or theatre or education?

Probably just grandfathered in. I'm guessing at the time of legislation, these things were commonly sold via cold sales calls.

I get tons of these in the UK to the extent that as others have posted I treat my phone as being whitelisted.

I don't even know what most of them are. From times when I've been expecting important calls and checked, the most common is probably accident claims. Some of them aren't even automated.

France gets them a lot. Often it’s “DHL” calling and you have to pay some fee to release a package.

Likely because cheap francophone labour is available in similar time zones.

Language barrier.

A smart phone app which behaves as a firewall requiring callers to enter, say, a three character PIN code before phone rings may be useful. Incorporate two message files, one for leaving messages from those who know the PIN code and one those who don't, would allow for any contingencies. A front end answering machine box for the home with the same functionalities may be useful as well.

So shift the burden of calling to literally everyone who is acting well? Why would I want to remember a unique PIN for everyone I know?

Also, isn't that just taking the 9 digit phone number and turning it into a 12 digit?

Bad actors exist and they're cleaver. Plus these days you don't have to remember anything. Adding an updatable PIN field to a personal call file in such an app coupled with a software protocol with a pop-up button labeled say 'PIN entry' which appears once a contact device answers (say, with a message enter PIN) that can transmit the PIN number would be sufficiently user-friendly for such an app. Better than receiving junk calls while waiting indefinitely for regulations with teeth from dysfunctional legislatures.

Plus how would we share this "pin"? Maybe we could append it to the phone number, like "+1 (616) 281 - 2123#32343" - Oh wait, it's already a number, what's the point of adding more onto it? It would literally turn into the same system that we have, as you have to share the pin with everyone anyway.

It's different because then not every "number" will result in a call being placed. Determining whether a number is valid requires making a call, which ties up robocallers.

You could have a Captcha to force that the person on the calling ewnd is a person and not a computer. That would increase the costs for telemarketeers.

Or the system could ask for information that someone who knows the recipient might know but a telemarketeer might not know, e.g. "What is the 2nd letter of my first name?"

That still shifts the burden onto everyone else.

What if the caller was required to know the first character of the recipients last name and enter that on the keypad?

From my experience with robocallers: they already know your name

I bought a Tel-Lynx (this thing http://tel-lynx.com/ ) and it worked great for the paired cellphones and the landline, sort of an automated mini PBX. First time callers had to introduce themselves to the system, spammers never bothered. I'd still be using it if it wasn't incompatible with "flashing" through call waiting calls -- like the phone company it wanted to do out of band signalling with the "flash"

Is there a way to access the call before it hits your phone? I looked briefly, because I'm very passionate about this problem, and couldn't find anything. I don't want to answer the call and wait for someone to enter a pin. I want them to have entered a sufficiently long randomly generated number (spoken to them by some voice generation service) before it even makes my phone send a notification to me.

You might be able to host an instance of Asterisk [0] and set up call forwarding based on the extension [1].

I haven't played with Asterisk before, so I'm not 100% certain.

[0] https://en.wikipedia.org/wiki/Asterisk_(PBX)

[1] https://www.voip-info.org/asterisk-call-forwarding/

Learn the lessons of SMTP-based electronic mail. Non-solutions like this just lead to an arms race. And indeed the other side already has a huge in lead this particular arms race. Voice recognition, speech-to-text, and DTMF generation are widely available telephony technologies.

Recent Panasonic cordless phones, which can handle cell calls if configured, have this feature. It lets the user define the 4-digit code that a non-whitelisted caller must enter before their call is allowed through.

I don't pay for apps on my phone. I would $20 for that.

> Why I can't get this is beyond me.

The first setting in my default Android phone app is to block unknown callers. What specifically do you want?

Phone numbers are being spoofed so while you might block the majority of those calls you won't be able to block all of them. The problem has to be solved upstream.

Is that just blocking calls with unknown caller ID or calls that are not in your contacts list?

In my phone with LineageOS, the option was to block anyone who was not in the contacts list.

That's a blacklist, "Don't accept calls from X". A white list would be "only accept calls from Y". That's what GP seems to be asking for.

Block unknown callers is a whitelist though. It's literally "block everyone not in my contact list".

You might want to verify that. Last time I checked, android's block unknown caller option just blocked calls where caller ID was blocked (aka "private").

...until and unless the phone number is spoofed. Then the blacklist is getting onto the whitelist.

Technically you're right, but what are the chances that a bad actor is going to spoof one of the phone numbers in your contact list.

I mean, the odds of them hitting that are so close to zero I don't even want to think about it.

Years ago, spam emails were sent to random email addresses found on the internet.

Now spam emails are sent to live email addresses harvested from peoples' activities

Today caller ID is spoofed not even with random phone numbers but specifically phone numbers with area codes relevant to you. For me, it's phone numbers of my area code which I have zero contacts in. Or it's phone numbers from my phone's registered address in Houston.

What makes you think it won't be long before fraudsters are able to connect the phone number they're calling with people likely in your contact list by ... looking up leaked contact lists?

It depends on the phone, but I'm pretty sure there are still devices where "Unknown number" /= "Number not in my contact list".

I was getting 10+ spam calls a day a couple of months back. They all originated from overseas numbers and I was pissed off that there isn’t a way with iOS at least to block certain countries. Like no one from Malta is ever going to call me so why can’t I just block Malta.

I resorted to using Do not Disturb mode allowing my contact list to ring. It’s worked out great, I have missed a couple of blocked caller numbers that I would have liked to have taken but they always leave messages. And the spam calls have more or less dried up now.

It would be nice if someone would create a device to exchange contact info with businesses to close the loop on managing the whitelist for new, infrequent associations. I should be able to go to a receptionist, mechanic, or contractor and accept identifying info from a Bluetooth device or a standardized non-URL QR code payload to let them contact me in the future. Then we could more conveniently manage authentication ourselves and cut the bad actors out of the process.

You can embed a vCard in a QR code right now. Your phone should handle it correctly.

That's a neat feature that I didn't even know existed. Sure enough, fives seconds on a random qr code site (https://www.qrcode-monkey.com/#vcard) and my iPhone's camera offered to add it as a contact. I wonder why this isn't first-class (in terms of exporting); something I can expose directly as "this is me" or to pass off an existing contact via a quick visual swap.

I guess I'll generate one for me and store it in the notes app, which is sort of a catchall for this sort of thing.

That only works until the receptionist, mechanic, contractor, business can no longer be trusted.

I took my cat in for an oil change over the weekend. That resulted in three spam texts and two spam e-mails from VCA. Time to change vets.

How often do you need to change the oil on a cat? Every 10K Meow-les?

And to be on topic, you'd need a trusted 3rd party to manage those. But lately we've seen you can't trust them to secure / not resell your data anyway.

Since caller id was implemented so poorly:

https://www.onsip.com/blog/how-caller-id-works-why-it-might-...

Maybe it would be nice if we had something kind of like a CAPTCHA, where an app on your phone would say "please dial <random-number> and say your name to complete your call" and the person would have to dial it and say who they are to talk to you.

Totally knee-jerk idea I realize, but I literally get 10 SCAM LIKELY calls for every real call now, rendering my phone almost unusable. Huh, I just did a quick search and it looks like it might already be possible to install an app to do something like this. Anyone know if this works?

https://support.apple.com/en-us/HT207099

It's insanely easy for a program to recognize individual digits and then type them out. Saying a name would also be trivial (recorded, generated, etc). Audio captchas have existed for a while, they have been an alternative for a long time, and they are even more annoying than images.

What we need is an abuse prevention system involving authentication. You can get reported for robo calls, and if enough different accounts you called have reported you, you get reviewed/banned/throttled. Let's not reinvent the wheel, it's been the standard way to deal with spam all over the web. But it requires rethinking the way we use phones, and a whole new infrastructure. It also brings some anonymity concerns but half-measures are just an arms race.

I think you are right about this. The previous response said they received 10 spam calls for every 1 real one. I'm probably about the same. My email spam isn't even close to that. 50 to 1, inbox, maybe?

This situation is far more dire for the telco's and their debt holders than they are catching on to. The telephone number, portable or not, is what anchors their customers. When it is gone, you've got a commodity.

say your name to complete your call" and the person would have to dial it and say who they are to talk to you.

I'm not sure why you're being downvoted for this. My in-laws have this feature on their landline from their local telco. Completely annoying, but I don't want to talk to them anyway.

My mother has this feature (in UK). The first time you call, it will send you to the voicemail and ask you to state who you are. Then she gets a notification and can listen to the message. If she phones you back, the number you are calling from is whitelisted. I think she can press something else to blacklist you, otherwise you stay in the grey zone and will always go to the voicemail. I think she has had a couple of people not leave a message several times and eventually blocked them where she would have been completely happy to speak to them if she only knew who they were..

Be careful calling back. I had a friend who called back what turned out to be a Wangiri Scam http://www.three.co.uk/hub/earth-wangiri-scam/

The call-back cost him ~$4 in long distance charges.

Contacts-only whitelist with some work:

Default ring: silence, no vibration. Custom ringtone for everyone you actually want to pick up the phone and talk to. Yeah you gotta spend some time setting it up for your existing contacts, then spend 5s selecting a ring when you add a new contact.

This seems like an iOS specific work-around.

On other platforms they simply give you the choice to block non-contact calls. I can do so on my Pixel by leaving Do-Not-Disturb on with Contacts Only.

I've done this on my Pixel 2 for some time, however it no longer appears to work. Have you experienced issues with this on recent android updates?

> Cost of phone calls decreasing to basically zero

I think this is the crux of the issue, and I don't think it's a situation that any non-spammer end-user wants. There's a definite non-zero cost to receiving a phone call.

I think we'd fix the robocall problem in a heartbeat if a small artificial charge was billed by the receiving phone company each time they connected a call (or rang a customer's phone, not sure about the precise terminology).

You mention 'no national boundaries anymore'. But robocalls are extremely rare in Europe. Presumably both for legislative and commercial reasons. None the less this is an existence proof that they aren't some kind of inevitability of mobile technology.

> - Cost of phone calls decreasing to basically zero

> - Bad actors (telephone companies) benefitting from this traffic by charging for it

I don't think these are compatible.

iPhone at least has the option for a contacts only whitelist, I only get notifications from contacts and everything else gets ignored. No point in even considering answering a call from someone I don’t know, if it’s truly important they can leave a message and I respond asap.

That's only true with Do Not Disturb, which also silences all other notifications as well, a major drawback (for me, at least).

If your other contacts have "VIP" status in the contact list, they will automatically go through.

I'm not sure if it works for non-Apple apps, though.

The only reason that matters here is bad actors.

What kind of lack of compassion do you have to have to participate in an organisation that generates something universally hated.

There's some kind of mental disconnect involved.

I once knew a guy who ran a spam operation from Chicago. I was in his office once and he showed me something on his computer. In doing so I could see that his mail in-box had over 29,000 unread messages.

I asked him how he deals with all those spam messages. He didn't think it was a big deal at all. Spam simply didn't bother him, and he believed in his heart that spam doesn't really bother anyone else, either.

This idea is summarized in a famous quote:

>"It is difficult to get a man to understand something, when his salary depends on his not understanding it."

I'm pretty sure there are already apps for Android that can do what you are asking. I use google voice, which tends to block most of the crap.

> For whitelist systems to work you need to be able to enforce identity or have a significant cost to sending messages.

s/whitelist/blacklist ?

I probably make two or three phone calls a year. And that’s just to companies behind the times not offering chat support. I think it’s high time we just deprecate phones altogether. It’s pretty crazy I use a 10 digit number to identify myself. ICQ did that and it was considered archaic.

Reply on news.ycombinator.com