Hacker News Reader

Comment by spectramax | Hacker News Reader

I feel like if FCC/Telephone providers don't fix this soon, traditional cell phones will become unreliable and we will need to adopt a new system or just use existing framework (facetime, whatsapp, etc.).

If every cell phone has LTE and internet connection, why the fuck do we need traditional cell phone number? I never use it except for calling my pharmacy, customer support or restaurants/shops. All conversations with friends and family happen over messages and Facetime Audio or Whatsapp.

While I don't wish to suggest we move to a proprietary system such as Facetime, I think there is a real need for email equivalent of a VOIP solution where there is automatic spam filtering just like emails.

Also, why can't cell phone providers use same spam filtering techniques used in email filters? I don't know the details of spoofing but I feel like telephone providers are scum of the earth and they have some kind of a reverse incentive to continue allowing spam calls.

View on HN

On spam filtering: the public telephone network transmits almost zero data on a call - the only header is the originating number, which can be un-traceably spoofed at the originator. There is no embedded message data (that would be the call itself). So there’s literally no valid data to filter spam on, unless the spam caller is chivalrous enough to use their legit caller ID.

I would also bet that there are regulations that require phone providers to complete all calls that are presented to them.

My provider, T Mobile, does overwrite the caller ID with “Scam Likely” for what they believe to be telemarketing calls, which is probably the best they can do until we implement a standard that authenticates the origination ID of calls.

There’s at least one piece of data on every call that the network operator has—-the identity of the prior network hop.

In the early days of fighting email spam, that was enough. Every network operator was responsible for receiving spam complaints and responding appropriately. Network providers that couldn’t or wouldn’t prevent spammers from using their networks were blacklisted and other networks would refuse to route mail originating from them.

It wasn’t perfect, but it was far better than nothing.

"There’s at least one piece of data on every call that the network operator has—-the identity of the prior network hop."

I'm curious - is this available in a call passed through twilio ?

I would like to log, or pass, the prior network hop using twiml ... or a twilio function, I guess ...

From my best interpretation of your comment you seem to think VoIP is far more "carrier peer to carrier peer" than it is in practice. As a value added telecom provider I have a few upstream carriers but it's not as if I receive calls from every carrier. Just like the Internet, my upstream carriers are my access points to the PSTN, so all of my SIP invites come from either my customers or my know upstream carriers. Those carriers are effectively my ISPs of the PSTN. I chose them and I pay them for service.

Distrusting one of them and the calls that come from them is something of a non-sequitur since you chose them and intentionally became one of their customers and pay them to receive those calls.

TL;DR This isn't like email or IP traffic where you're interacting with other IPs in a purely untrusted network model. Merely analyzing the previous hop doesn't tell us anything valuable.

That’s the peril of being a leaf node. The same thing was true in the early days of email. An end user, or in your case something close to it, couldn’t blacklist his upstream—-as you say that would be ridiculous. But your upstream (or possibly their upstream) does have true peers that they could blacklist for bad behavior. It might mean there customers couldn’t receive calls from entire countries, but that’s a trade-off I, and I assume plenty of other, would be happy to make and even pay extra for.

This assumes that is that there isn’t some kind of international treaty that forbids doing so. The existence of such has been claimed from time to time in similar discussions but I have yet to see an actual citation.

> the only header is the originating number, which can be un-traceably spoofed at the originator

That's wrong, phone signalling systems always specify the originating number and it cannot be spoofed. The key thing is that only 911 responders and similar lines have the CLIRIGN flag set on their lines which means that the spoofed number transmitted via CLIP is ignored and the real one used instead.

In addition victims of e.g. threat calls can have the MCID flag set on their line which makes the provider systems log all call information for later retrieval by police.

My phones so bad that I have the do not disturb night mode feature enabled full time only allowing people in my contacts to ring.

It really annoys me that there isn’t a way of filtering calls based on country. 99% of my junk calls come from Australian numbers, so if I could just block Australia...

Wouldn't help here in the US. They almost always fake caller id from a local prefix.

70% of the spam calls I get could be stopped simply by blocking the exact same exchange that my number is in.

Do spam callers really think I'm expecting a call from the same area code, same exchange as my own number? Do most people have friends that have phone numbers with the same first six digits in common with their own?

I feel like this trick can't possibly work on anyone who has already seen it twice, and just based on the number of times I've seen it, I have to assume everyone has seen it at least five times by now, either that or they aren't even paying attention to caller ID at all.

Yep. This works for me, I have a 310 area code and live in 425, so almost anything 425 and 206 is legit, anything 310 is probably not.

Yeah having a 775 in 312/773 is great for this reason (except sometimes people assume I mean 773).

I use the same tactic as someone with a 310 number who does most of their living in 805.

Yes. I bought my parent's thier phones and so they are on my plan, with very similar numbers.

And at work, all company phones are on the same first digits.

Exactly. When spammers call me, they use the same prefix as work. Most of the times I answer just to hear a robocall.

The way a friend described it to me, if you have a child, and that child is out of your sight, you sort of have to be open to answering phone calls from your local area.

One thing I like with Google Voice is that it has a phone screen where you have to say your name and then it plays it back to me before I decide to accept the call.

The Pixel phones have integrated call screening in the dialer too.

> Do spam callers really think I'm expecting a call from the same area code, same exchange as my own number? Do most people have friends that have phone numbers with the same first six digits in common with their own?

In the US, outside of the dense metro areas, this is a much more common than you think. For non-metro areas, it is quite common for everyone in the area (business and personal) with which you might receive a call has a number in the same exchange as your number.

But it is doubtful the spammers are considering that fact. It is much more likely they simply did A/B testing and saw a measurable increase in answer rate if the transmitted caller ID matched area code and exchange of the number they were dialing. And so they simply started using this trick, because their testing showed it worked.

You're right. On two counts. My folks live in a small town in Western NY and everyone has the same exchange. I have to believe that's a minority of people by the numbers, but I could easily be wrong, and if rural towns are specifically your target market, it wouldn't matter if I was right...

And I worked for a call center company once, which employed a similar technique. Not down to the exchange, but by area code. We ran the numbers and found that we were much more likely to reach a person if we called through a number that belonged to their own area code, people don't pick up for out-of-state callers.

We were calling for customer satisfaction surveys, on behalf of companies they had done some business with – and almost always with a presence in their local area. So it wasn't technically a deception, unless you think that area codes should reliably represent the caller's location, in which case you'd be fighting a losing battle to be sure...

In hindsight it may have helped us work contact lists faster but it did nothing for our survey completion rates. People who were not likely to answer an out-of-state call were apparently also not likely to answer a survey, even once you got them on the phone. To us, that trade-off was still worth it, because we were usually contracted to try each contact on our list either 3-5 times or until we reached a person who (completed or) declined the survey or asked you to stop calling.

If you didn't want the calls, then we straight did not want you to continue getting them. Another rule we had was, it should not be possible for the person's phone to ring, and when they pick up it's just dead air. That means no predictive autodialers. (And of course that was the first rule to change when the company was sold, barf.)

We also ran the numbers on each area code and did a little cost-benefit deciding whether to buy those numbers or not, based on how many times we'd use them. If we didn't own a local number, we didn't use one. And we made sure that if anyone called back, the first thing they reached was a robot with a single digit to push to be added to Do Not Call list.

Turns out if you make it easy for people to get the calls to stop, you get a lot less angry people calling the reception and less angry voicemail messages, which makes for better call center employee experiences and better outcomes all-around. (I guess another strategy is to just spoof Caller ID with a number you don't own, so they can never call you back, and run the predictive rates so high that you never actually talk to an employee either. Totally unethical and it has to stop!)

The number of calls I receive which immediately hang up seconds after I pick up is absolutely ridiculous. I just imagine this call center full of people with auto-dialers going on full-speed across the room, nobody is wearing a headset and nobody is at their desk, but everyone is just sitting around a cash bonfire telling stories and laughing...

It might be related to the same reason that Nigerian scam emails keep following the same easy-to-spot pattern. It is to the scammers advantage that savvy marks immediately recognize the scam and don't participate. It saves the scammers time and money if they don't chase leads that won't pay off. Better to be immediately recognized as a scam by 98% of everyone, and focus your attention in the 2% who are most likely to pay off anyway!

I'd buy that argument. It jibes well with the research we did to come to this conclusion, when we started buying numbers in local area codes at the call center I used to work for... (excerpt from where I posted it elsewhere)

> In hindsight it may have helped us work contact lists faster but it did nothing for our survey completion rates. People who were not likely to answer an out-of-state call were apparently also not likely to answer a survey, even once you got them on the phone. To us, that trade-off was still worth it, because we were usually contracted to try each contact on our list either 3-5 times or until we reached a person who (completed or) declined the survey or asked you to stop calling.

> If you didn't want the calls, then we straight did not want you to continue getting them.

Don't chase leads that won't pay off. Do as little extra work as you can, to increase the likelihood of learning when a lead is known bad, so you can stop wasting effort there.

"Do spam callers really think I'm expecting a call from the same area code, same exchange as my own number? Do most people have friends that have phone numbers with the same first six digits in common with their own?"

All of the weirdness and strange patterns and methods you see in practice by these actors make perfect sense when you realize their targets are seniors.

In fact, even the ability to keep someone on the phone past the first 2 seconds of recorded intro greeting makes sense if that's the only interaction with a human you get all day/week.

The lives of inactive, retired seniors in the United States - especially in small or rural towns - is tremendously bleak.

And yes, they've spent their entire life with technology wherein everyone they talked to had the same NPA+PREFIX.

You can use an app like hiya to block all calls starting with certain numbers.

As someone who has worked in telecom for a long time, I assure you most of us carriers / service providers (Except maybe Big Red and Big Blue) desperately want to implement signed SIP invites and kill robocall for our customers. We also want to universally deploy G.722 HD Voice without unnecessary transcoding. The telephone industry and the Big Color Telecoms (Red /Verizon, Blue / AT&T, Green / CenturyLink, Yellow / Sprint, Pink / T-Mobile) moves at a snail's pace. The security model of domestic VoIP right now is largely IP whitelisting or private IP circuits, no encryption allowed unless it's an entirely on-net call where you deal with that yourself and send it to the telecom unencrypted. We'd like to fix that too, but again, big telecoms aren't interested as best we can tell (they don't communicate their strategy reliably so we have to infer from their actions). Encryption of in flight calls, even with wiretap laws and legalized domestic surveillance, is important in my opinion.

Of all of them, I think T-mobile is the most willing to actually improve the industry for everyone's benefit.

When we receive a SIP invite (incoming call) from one of our upstream carriers, the amount of metadata information they're able to provide us is often very limited (largely due to interop issues in my opinion). If you think about IP spoofing, BGP, and the state of egress filtering on the internet, it's a very similar situation.

Since this is related to my work, obviously all of the above is just my personal opinion.

> we will need to adopt a new system or just use existing framework (facetime, whatsapp, etc.).

I already use white lists -- I simply don't answer the phone if the person isn't in my contacts list and I'm not expecting a call from an unknown number. I assume this is pretty common practice.

> If every cell phone has LTE and internet connection, why the fuck do we need traditional cell phone number?

I almost never have LTE or even mobile data of any kind when I'm outside of cities (for a liberal definition of city).

> Also, why can't cell phone providers use same spam filtering techniques used in email filters?

Because spam filters rely on contents in addition to meta-data. You can't pick up the phone and listen to the contents for a few minutes.

> I almost never have LTE or even mobile data of any kind when I'm outside of cities (for a liberal definition of city)

I'm curious what countries /places these are. My operator doesn't even activate 3G on modern phones, I literally have nothing aside from LTE/VoLTE. Since LTE got deployed on the low frequencies reclaimed from analog TV, the reception is generally BETTER than 3G etc.

Also when there are natural disasters, the voice infrastructure is the first to collapse, but data in chat apps still makes it through

> I'm curious what countries /places these are.

The United States. Not even the western or mountain states! One of the places I regularly go that doesn't have data coverage but does have voice coverage is in a national (or maybe state there?) forest in New York state.

> Also when there are natural disasters, the voice infrastructure is the first to collapse, but data in chat apps still makes it through

I don't have any experience with this, so I'll take your word for it.

> I think there is a real need for email equivalent of a VOIP solution where there is automatic spam filtering just like emails.

https://truecaller.com uses a crowd-sourced model to help you identify PSTN callers and spammers not in your contacts.

Besides, I think WhatsApp had the right idea around personal communication at least when Jan and Brian called the shots.

> If every cell phone has LTE and internet connection, why the fuck do we need traditional cell phone number?

I think with SecureElement now common in Android-based devices, eSIMs would be ubiquitous and may be SpaceX's Starlink would mean the end of traditional PSTN: https://news.ycombinator.com/item?id=19680412

These apps steal your phonebook and upload it

Unfortunately, yes, but you don't necessarily have to use the TrueCaller app on Android/iOS, the website works just fine. Besides, TrueCaller and WhatsApp won't be the only apps to steal your phone book, and with 100M and 2B installs respectively, the jury is already out on their utility.

You can use Whatsapp without giving it access to your phonebook. It complains initially but it works fine.

What I like about PSTN is it’s open nature. If I tried to build an online voicemail system for WhatsApp or FaceTime, I’d get banned.

I like having my PSTN voicemails emailed to me. And calls logs in csv.

If someone says they called me 3 years earlier, I can find that out without scrolling.

Then google voice might be for you ...

Not as an unamerican.

It's available in other countries now but only as a part of a paid service.

I wish I could pay for this with my existing Google account. I don't want a new Google account to access G Suite-only features/services.

AT&T and T-mobile (maybe others?) have free spam filtering. It's not perfect but it does help.

As for your other question - there are still lots and lots and lots of regular phones in the world that call me and that I need to call. As you mentioned in your example - every business, school, government, etc.

Someone decided to spoof my cell phone number to spam call people. I don’t know how they filter spam calls from legit numbers without a new approach akin to DKIM/SPF where the number sets what carrier a call can originate from.

> I feel like if FCC/Telephone providers don't fix this soon, traditional cell phones will become unreliable and we will need to adopt a new system or just use existing framework (facetime, whatsapp, etc.).

They do not intend to fix anything.

This captured FCC would rather everyone use the internet to communicate, since they deregulated that, than telephones which they cannot deregulate. The game is, make money as fast as possible in deregulated industries until people complain of lousy service and the government steps in.

Bonus points if the captured FCC can convince you that they care about these robocalls.

EDIT: Please explain downvotes. You feel the current FCC are saints and would never do such a thing?

I occasionally contemplate trying to find a data-only plan for my cell phone, with no associated cell number.

That may be impossible under current cell designs. WiFi hotspots even have assigned phone numbers.

But a hotspot doesn't ring, so you can ignore it.

My hotspot gets spam text messages but I'm only aware of them the once or twice a year I log into its control panel.

You'll always have a phone number, but on an SMS- or Data-only plan it will never ring (MVNOs in my country offer these types of plans at a discount because reserving a voice phone number here is subject to ID verification and higher fees)

Get a Wifi box, that itself contains a SIM card. Then you connect to it from your phone using Wifi. You just need to be careful because your phone will now take the liberty to update apps and use your data more liberally.

TMobile used to offer (maybe they still do?) a data-only plan that was/is meant for remote sensing applications (alarms, etc). It wasn't something that was listed on their site (ok - it was there, but you had to really, really dig for it to find out about it).

IIRC, it was also free, but limited to 200 MB a month.

You basically got a SIM card you could stuff into your embedded sensor app and away you go.

That might be a large enough data cap for plain-text messaging, but not much else.

If every cell phone has LTE and internet connection, why the fuck do we need traditional cell phone number?

You don't. Get a hotspot and use Skype instead. Problem solved.

Reply on news.ycombinator.com