Hacker News Reader

Congrats on launching!

One security-related question: I had looked into this area previously as a user and a security-conscious friend pointed out that systems that use call forwarding to stop the spam problem are a HUGE security risk.

You’re effectively man-in-the-middling all mobile calls, SMS, etc, and if there’s some sort of compromise (or, much less likely, malicious act) on your end, all of us users will be in a tough spot.

Is this accurate? Can you share some thoughts?

(Not trying to knock your business or approach, btw - just want to know if the fears are founded or not.)

Same thought here. I have been toying with the idea of building something OSS so that people could run it themselves, for this reason.

(Also I have what is possibly a common filtering case in the US that would eliminate 95% of my spam calls without blocking any relevant calls from "new" numbers. And for whatever reason, I have not seen it implemented anywhere yet.)

IF (area code == my area code) AND (prefix == my prefix) AND (last 4 != my last 4) THEN SPAM SPAM SPAM ?

YES

Also: if (area code == my area code) AND (number NOT IN whitelist)

Basically: I have a mobile number in an area I left 15 years ago. Any call I get from there that's not one of my friends is de facto spam.

I wonder how long before AdTech uses location data change which robo-call center to choose from its aws equivalent in your area code.

You may be looking for Hiya Spam Call Blocker:

https://apps.apple.com/us/app/hiya-spam-phone-call-blocker/i...

This supports area code and local prefixes (but not wildcard local prefix). Unlike Trucaller etc., the privacy policy is ok.

If you want to block all prefixes, see WideProtect above.

>I have a mobile number in an area

Wow, that's fascinating to find out that is how the US works.

Australian mobile numbers and I'm pretty sure most of the European ones, are prefixed by carrier and have no geographical breakdown.

Yup, the first 3 digits (the area code) tell you the the part of the country where the number is located. Obviously this was setup before mobile!

> prefixed by carrier and have no geographical breakdown.

I'm not sure how/if that would work here given the active mergers & acquisitions in telecom. (Among other things, some of these require some customers to be divested to achieve approval of the deal.)

Additionally, we actually had Congress pass a law requiring the ability for consumers to take their number to other carriers:

https://en.wikipedia.org/wiki/North_American_Numbering_Plan#...

Prior to this, carriers could use as leverage the fact that people prefer not to change their phone number.

You may be looking for ‘WideProtect Spam Call Blocker’:

For iOS: https://apps.apple.com/us/app/wideprotect-spam-call-blocker/...

If only one or a few prefixes need match, use Hiya below. If you want all wildcard prefixes, you want WideProtect.

Most do not support the wildcard formula, this does.

> Same thought here. I have been toying with the idea of building something OSS so that people could run it themselves, for this reason.

I'm in the process of open-sourcing the core part of a SaaS I run that does exactly this. It relies on Twilio but could be easily made to work with any API that exposes the forwarded number, which should be all of them.

Would love to sign up to get notified when this is ready!

Good luck!

This is definitely a big concern and I have thought a lot about it. Storing data like whitelists, whitelist requests, etc. on the device instead of server is probably going to be the best way to minimize potential issues around privacy. One way to do that is to locally store the whitelist and to route the call to the device and then have the device reject the call if not in the whitelist. But it’s slightly more complex than that, because PINs are an option here too. This is an area that I'm going to be working hard on exploring.

I intentionally haven’t added SMS filtering because of these privacy concerns.

I definitely want to focus on privacy because I am as privacy conscious as everyone else on here.

A bloom filter of my contact’s phone numbers that is updated on my device and checked on the server could be a good privacy approach. A small number of false positives (robo calls getting through) would be acceptable if the device still filters or presents the option to accept.

PINs could also be a bloom filter on the server, then the device filters on whether the specific PIN entered was single use or has been revoked.

I'd just use the bloom filter a pre reqs to doing an actual query.

Over 50% of phone traffic is spam.

Please, don't generalize. That statistic is maybe valid in the USA. In my case (Serbia) spam is practically 0%. There's an occasional landline call or two per month but that's enough for making fun by letting our kids answer the phone and troll the spammers. Third world "problems" (:

Anyway, I support your fight against spammers.

Same thing in France. I wonder if phone spam exists elsewhere than in USA (in UK perhaps) ?

There’s a lot in Australia

My parents in France get spam calls on their land-line phone almost everyday. It almost never occurs with mobile phones though.

Nothing much in the UK, maybe once a month if you’re unlucky

In the Netherlands, I get called unsolicited and for marketing purposes maybe once a month. The call is always by a human, I’ve never been called by a robot.

As soon as I notice it’s a marketing call I just hang up and if it’s not a hidden number, I add it to my “blocked numbers” contact, which I have blocked from incoming calls on my iPhone.

You could also GDPR the shit out of them... ;-)

Don’t get much in the U.K.

My parents in France receives 3 spam calls everyday, the first one always between 9 am and 10 am.

I have mobile numbers in HK, mainland China and UK. I get zero spam on the UK number, and daily spam calls on the other two, although they hang up as soon as they realise I speak neither Cantonese nor Mandarin, which is a good enough spam filter for me :)

Seriously? If my phone makes any kind of noise and/or presents any text or other media that I have to look at and/or dismiss then it is not enough spam filtering for me.

I'm from France and we get daily spam, especially at night. My parents don't even use their landline for that reason.

Living in Germany I have received a total of 0 spam calls over several years.

That’s because there’s actually a law against it. I remember some years ago we always had Werbeanrufe on our landline. We don’t have a landline anymore but I’ve not gotten a single spam call for years now (except from my own home internet or mobile provider, which isn’t “spam” per se but still annoying because they sometimes call you five times a day instead of emailing you about some minor things).

It was about 90% for me, personally; at least for a while. In Canada.

You're right, the number varies based on geography. Also it is subjective because what constitutes spam depends on personal preferences (I'm personally okay with 1 appointment reminder, for example, and getting work calls only between 9-6). Thank you for the support!

I built a whitelisting phone system for my aging dad with Twilio, an OBi200 VoIP adapter, and gcloud for transcribing untrusted calls sent to voicemail.

(US specific) If you think the aggressive IRS and Sheriff scams are bad -- you've committed a crime only $100 _right now_ will solve! -- the shakedowns targeting enfeebled senior citizens are truly sinister.

Which is to say, people who care for seniors (children of, part time caregivers, etc) are an unserved audience for tools like yours. I would have paid for one had it existed.

Good to hear, it's sad to see grandparents/parents get scammed. I've had a few senior citizens getting these types of scams use CallStop to protect their cell and landline. It feels good to be helping them.

Android/google got better with this past few years...

People! You really need to get into politics or whatever and fix those things from a legal side!

You really need to stop inventing services and starting businesses for the most simple things in life!

edit: Don't get me wrong, I love the spirit, but there are _real_ problems to tackle and you are still working on stopping telephone spam? It's 2020, nobody should even think about things like that...

What should we be thinking about ?

Apparently we are all supposed to become lawyers. ;)

Creating a whitelist service for yourself literally only takes a couple hours studying Twilio docs. Hardly a huge waste of time, and when you get 2 spam calls every morning before 8 am for weeks it's completely worth it.

Creating change in a society might also only take a couple hours, but serve the people next to you and after you.

Just imagine you would be in charge to keep your whole town clean of robocalls. What would you do? Set this up for everybody in town, administer it and take care that it's up 24/7?

Helping (anywhere in the line of this process) to pass a law that simply prohibits such calls seems to be more efficient.

Most robocalls are illegal anyway, unless you've given your explicit consent to a company, like your utility company.

Making something illegal doesn't mean it goes away completely (or at all). https://www.consumer.ftc.gov/articles/0259-robocalls#legal

In Germany I can report numbers that are doing spam SMS or calls to a governmental agency and they will be shut down within days. That should be possible for other countries, too.

Nah, this is exactly wrong. What you're describing is the hard way to solve small problems. There's really no personal value in doing that.

As for me I just use Google Fi and an Android and it blocks these for me.

Robocalls are the #1 complaint to the FCC.

Ok, then go out, complain to your local politicians and whom else in charge to make a law to stop it. That's how it works.

The problem I have with a whitlisting approach is, what if it's actually some legitimate and damn important call? When my father was in the hospital close to death I got informed by phone from an unknown number. You get these calls hopefully only a few times in your lifetime, but I definitely don't want to miss them.

What's your approach for these cases?

> What's your approach for these cases?

If it's important enough, the caller will leave a voicemail.

I had unknown/blocked phone numbers blocked so a deputy had to unblock her number to notify me my brother had died.

I would've been alright with a voicemail, tho.

Most people don't answer unknown calls anymore. They're likely to miss these life/death calls right now. That's why the PIN feature is better for most people--you can give a 5 digit PIN to loved ones. You may be an exception if you answer every call--I won't answer any call from an unknown number, and most young people don't answer unknown calls anymore. Seniors tend to answer more, but that's because they are more used to landlines and times when there were less robocalls. I'd rather make sure that my family can remember a 5 digit PIN (obviously there are lots of tricks to make numbers memorable) than answer every unknown call in my life.

Until this service becomes so popular that the robocallers start deliberately working around it, I think you may only need a 1-digit PIN. I've had a service from the phone company on my landline for decades that just makes an unknown caller dial a 1 before my phone will ring, and it continues to nearly eliminate spam calls. So the 1-digit PIN can just be a "1".

Randomized "Enter X to be connected" with 0-9 is a feature several people have requested. I agree that you can probably cut most with just that.

So, a captcha :)

A soundcha ?

>What's your approach for these cases?

Send an SMS/Whatsapp/etc

I want something different.

I want a Lenny, but that I don't have to conference in. That step is failure prone, takes time, and usually doesn't work -by the time Lenny is on the line, the spammer has long fucked off.

I want a "bot" that spews nonsense - but sufficiently plausible nonsense to keep spammers on the line - that I can activate with a single button click, at any point during a phone conversation with anyone. Either by reaching out to a remote server, or by running it locally on my phone.

When a human being reaches my phone, I want to be able to keep them from reaching others, for at least some time.

( Lenny: https://toao.net/595-lenny )

Check out the Robokiller app - their answerbots do exactly what you described.

https://apps.apple.com/us/app/robokiller-block-spam-calls/id...

This one also has ‘neighbor spoofing’ blocking.

I tried - it might work like that on iPhone, but on Android you have to enable some network-specific features that Google Fi doesn't currently support :(

Absolutely - I think something like this could make it non-profitable to operate as a telemarketer or telescammer anymore.

I really wish this would have come out like 4 years ago. I love the idea, but Apple's newest iOS helped significantly cut down on the robocall annoyance. I'm cheering for you!

Thank you, I'm definitely looking to continue working on productivity features like scheduling to keep it relevant and less "platform vulnerable" so that it can't made moot by Apple.

Interesting.

I kind of wish there was like an audio captcha app. If the number isnt in your contacts, voice comes on asking them to type some random 4 digit number. Well it is of course anarms race, almost all my call spam is recordings so i think itd be effective.

Google voice has a feature where you can ask the person to say their name. Not sure if they force you to hit # after or what happens with automated callers, but I could imagine this being a decent solution.

A few people have mentioned they'd like this service, where a random digit/puzzle is presented. I decided to focus on people who wanted the most extreme call blocking service but would like to come back to this later.

Whitelists works fine. Pin "extensions" work fine. The next step is probably just a simple question/answer regarding personal information about the recipient.

Just like account security questions. Provide drop down selector/s for users to select their question.

I'm not going to provide my public number here, but if a caller of mine isn't whitelisted I just prompt them for my billing zip code. Now, that's not going to work for every one, but considering who I want to get phone calls from, it's pretty foolproof.

Keep the energy up @davidajackson. I'd love to see you hugely successful with your efforts!

I've set up something similar to this on my Asterisk server. I prompt callers not on my whitelist to respond to: "Tell me, what is 2 plus 5?", and parse the response with Google Cloud voice to text (7 is a good response as it is reliably parsed).

For the motivated, it's a short weekend project.

Congrats on the launch.

My advice is to stay away from the "Like X for your Y". Define your own category otherwise, you will end up just copying way too much of Superhumans thinking.

I definitely will need a non-analogy description. I've called it a "Call Manager" on the App Store. I'll see if I can think of something more... descriptive.

Question: does any app (yours or others) block such calls in a manner that prevents them from ringing at all? It's extremely frustrating for me when I use a call blocking app only to find that it still rings for a split second before suppressing afterward, and I have no clue why that happens with every app.

iOS has a setting to send numbers not in your contact direct to voicemail and those never ring.

Yes it does. It won't ring you unless the caller is permitted to.

I would’ve loved this prior to getting a new iPhone, but from my perspective the iOS setting that sends numbers not in your contact straight to voicemail does 90% of what I’d use this service for.

You obviously have some useful features though (I do miss calls on occasion).

I like the idea of having a pin.

I wonder if overloading the “extension” field in existing address books would be reasonably ergonomic. Eg:

(555) 876-5309 ext 1337

Or similar syntax should work with legacy systems to share your phone number (and maybe autodial the pin).

The format for autodialing with CallStop is "<number>,2,<PIN>". The commas are pauses. You can store these in Apple contacts for example if you want to try dialing a number, pausing, and then pressing a tone.

Here's what the PIN email invites look like, which use this system:

David Jackson has scheduled a call with you. To join, tap here: 11111111111,2,73827

Call start: Saturday, February 1, 2020 at 7:00:00 AM Pacific Standard Time

Call end: Saturday, February 1, 2020 at 8:00:00 AM Pacific Standard Time

You will be able to call David Jackson starting 5 minutes before the scheduled time and until 5 minutes after. You can continue talking after the scheduled end time, but you can only call David Jackson during this window of time.

If you're unable to join via the link above, call 1111111111, wait for the prompt and then press 2, and enter the PIN 73827. Your call will then be forwarded to David Jackson.

Organizer notes: None.

Congrats, definitely going to give this a try as I get spam calls all day long!

I wanted to tinker around with other phone projects what provider are you using on the backend if you don’t mind sharing ?

Let me know how you like the app! The backend uses Twilio. They have good documentation and examples, and their teams are responsive.

Does it work with Google Voice forwarding? I tested it by calling my Google Voice number, but it looks like it doesn't.

You can protect any number (cell, landline, google voice number) by forwarding that number to your CallStop number. As long as you can forward the number to CallStop, you can screen calls in this fashion. If you're intending to route incoming calls from your CallStop number to another number, let me know and I can try to add that option into the app. Also my email is david@callstop.com if I can help any further.

Great tools. I am just a normal web developer, yet still receive unwanted calls from the insurance sale every month

So it's like a shared and community driven (but automatic) blacklist?

Do numbers ever need to get whitelisted?

CallStop uses whitelists that each person manages. When an unknown caller calls you, they hear, "You have reached a phone number protected by CallStop. If you know this person, press 1 to send a whitelist request with a quick note. If you have a PIN to reach this person directly, press 2 and enter the PIN." Your contacts are your default whitelist to begin.

I thought CallKit only allows a blacklist of numbers to block, not a whitelist.

Numbers forwarding means you can create whitelists. CallKit doesn't support whitelisting as you mention. Whitelisting with CallKit was the first thing I looked for in the Apple developer docs, and there was nothing on it, so I used number forwarding.

Any plans for Android? Would happily pay for a service like this.

Android's built-in "do not disturb" setting supports silencing all phone calls from numbers not in your address book.

iOS supports this too: https://support.apple.com/en-us/HT207099

One of the features I like about it, though, is the ability to create arbitrary "pin" extensions that I can give out. I'd love for my phone number to be opt-in, worldwide.

Getting spam on a particular extension? Guess CompanyA leaked my number. Blocked.

Call screening is nice, and I actively use it, but a system that is "zero spam by default" is far more preferable than "click to block spam".

Don't know about generic Android, but this works pretty well on Pixel. Automatic "call screen" has eliminated my spam calls to almost zero.

As soon as possible :) I've been honing the iOS version and getting feedback but doing an Android version soon would be ideal.

Show HN: CallStop – Superhuman for your phone number