Hacker News Reader

Comment by nlh | Hacker News Reader

Congrats on launching!

One security-related question: I had looked into this area previously as a user and a security-conscious friend pointed out that systems that use call forwarding to stop the spam problem are a HUGE security risk.

You’re effectively man-in-the-middling all mobile calls, SMS, etc, and if there’s some sort of compromise (or, much less likely, malicious act) on your end, all of us users will be in a tough spot.

Is this accurate? Can you share some thoughts?

(Not trying to knock your business or approach, btw - just want to know if the fears are founded or not.)

View on HN

Same thought here. I have been toying with the idea of building something OSS so that people could run it themselves, for this reason.

(Also I have what is possibly a common filtering case in the US that would eliminate 95% of my spam calls without blocking any relevant calls from "new" numbers. And for whatever reason, I have not seen it implemented anywhere yet.)

> Same thought here. I have been toying with the idea of building something OSS so that people could run it themselves, for this reason.

I'm in the process of open-sourcing the core part of a SaaS I run that does exactly this. It relies on Twilio but could be easily made to work with any API that exposes the forwarded number, which should be all of them.

Would love to sign up to get notified when this is ready!

Good luck!

IF (area code == my area code) AND (prefix == my prefix) AND (last 4 != my last 4) THEN SPAM SPAM SPAM ?

YES

Also: if (area code == my area code) AND (number NOT IN whitelist)

Basically: I have a mobile number in an area I left 15 years ago. Any call I get from there that's not one of my friends is de facto spam.

You may be looking for Hiya Spam Call Blocker:

https://apps.apple.com/us/app/hiya-spam-phone-call-blocker/i...

This supports area code and local prefixes (but not wildcard local prefix). Unlike Trucaller etc., the privacy policy is ok.

If you want to block all prefixes, see WideProtect above.

>I have a mobile number in an area

Wow, that's fascinating to find out that is how the US works.

Australian mobile numbers and I'm pretty sure most of the European ones, are prefixed by carrier and have no geographical breakdown.

Yup, the first 3 digits (the area code) tell you the the part of the country where the number is located. Obviously this was setup before mobile!

> prefixed by carrier and have no geographical breakdown.

I'm not sure how/if that would work here given the active mergers & acquisitions in telecom. (Among other things, some of these require some customers to be divested to achieve approval of the deal.)

Additionally, we actually had Congress pass a law requiring the ability for consumers to take their number to other carriers:

https://en.wikipedia.org/wiki/North_American_Numbering_Plan#...

Prior to this, carriers could use as leverage the fact that people prefer not to change their phone number.

I wonder how long before AdTech uses location data change which robo-call center to choose from its aws equivalent in your area code.

You may be looking for ‘WideProtect Spam Call Blocker’:

For iOS: https://apps.apple.com/us/app/wideprotect-spam-call-blocker/...

If only one or a few prefixes need match, use Hiya below. If you want all wildcard prefixes, you want WideProtect.

Most do not support the wildcard formula, this does.

This is definitely a big concern and I have thought a lot about it. Storing data like whitelists, whitelist requests, etc. on the device instead of server is probably going to be the best way to minimize potential issues around privacy. One way to do that is to locally store the whitelist and to route the call to the device and then have the device reject the call if not in the whitelist. But it’s slightly more complex than that, because PINs are an option here too. This is an area that I'm going to be working hard on exploring.

I intentionally haven’t added SMS filtering because of these privacy concerns.

I definitely want to focus on privacy because I am as privacy conscious as everyone else on here.

A bloom filter of my contact’s phone numbers that is updated on my device and checked on the server could be a good privacy approach. A small number of false positives (robo calls getting through) would be acceptable if the device still filters or presents the option to accept.

PINs could also be a bloom filter on the server, then the device filters on whether the specific PIN entered was single use or has been revoked.

I'd just use the bloom filter a pre reqs to doing an actual query.

Reply on news.ycombinator.com