Hacker News Reader

Comment by mehrdadn | Hacker News Reader

Can someone explain what this will translate into in terms of the end-user experience? For one thing, authentication will be next to useless (at least to me) if my phone is still going to ring. So does that mean it's not going to ring for a spoofed number? Also, if it results in tons of voicemail then that's still going to be quite annoying. (How) is the actual end-user experience going to be addressed?

View on HN

From my understanding, it basically means all telecoms will be required to do what T-Mobile already does in the U.S. If I get a call and the reported Caller ID doesn't match the transmitted one, it reads on my phone as "Scam Likely".

Pixels also have their own solution to this: If that condition occurs, the Google Assistant will answer the call and auto-decline if it is actually a robocall.

So that means phones will still ring (unless you have a Pixel or something)? That will still drive people crazy!

iOS also has a feature to send unknown calls directly to voicemail without ringing through [0]. It seems an easy jump to classify numbers into three categories (known, unknown but authenticated, and unauthenticated) rather than two once reliable authentication is available.

[0]: https://support.apple.com/en-us/HT207099

Some carriers may have the ability to limit calls to customers based on attestation level. Customer could configure they only want to receive i.e "A" attested calls. This means the carrier from where the call originated knows that the customer who made the call owns the number they dialed from.

Right, but I guess I'm asking, are plans for this in the works? Because currently I'm not aware of anything like this, nor of any plans to implement anything like this. None of the announcements suggest it might be happening either, so that's why I'm lost as to what the end-user experience would be.

I can only speak for one carrier, and the answer as of this moment is no. Pretty much everyone is struggling to meet the FCCs aggressive timelines and do interoperability testing with each other. After that is done, maybe. I'm sure the FCC has upcoming requirements based on this, but to my knowledge those aren't out yet. If the FCC doesn't make additional requirements, then it will depend on the carrier's decision. I'm under the assumption that they will introduce those additional requirements though.

I see. Thanks!

I think T-Mobile only does this for postpaid users though. Prepaid users are excluded AFAIK.

Wrong. Prepaid MVNO Metro By T-Mobile has this feature as well.

I can't be sure about Metro since I don't use them, but I've gone from postpaid to pre-paid on T-mobile and I no longer get the the warning/caller ID saying it. Even on their page, it does not mention anything about pre-paid.

https://www.t-mobile.com/support/plans-features/scam-id-and-...

Also, their website doesn't have the option for me like it used to, and here's a thread on their site from 2018 that talks about it not being available to pre-paid users:

https://community.t-mobile.com/thread/146574

It is available to all customers[1] with a supported device (plan doesn't matter, but I suspect prepaid customers are more likely to have cheaper, unsupported devices).

[1]: https://www.t-mobile.com/customers/mobile-security

Hmmm. Interesting.. When I was on postpaid, I used to get caller ID with something like "Scam Likely", but since switching to pre-paid, I don't get those anymore. Looking at their page about it, it only mentions post-paid.

https://www.t-mobile.com/support/plans-features/scam-id-and-...

Here's also a thread about it on their site.

https://community.t-mobile.com/thread/146574

The thing this will address is certain classes of scams that rely on spoofing a specific area code. The infamous “Windows support” calls, which generally spoof a Redmond, WA area code. The IRS/FBI/Immigration scam calls that spoof Washington DC area codes. These are scams which defraud people of huge sums of money every year, mostly the elderly and immigrants.

Most of my spam calls originate from a number close to my area code. Now that I live on the other side of the country, it’s easy to tell when I’m getting a spam call from where I first got my number

Do people generally know area codes other than their own area?

At least on my iPhone, for numbers that aren’t in my contacts, it shows the location under the number. I’m assuming based on area code. So it will say Redmond, WA right on the screen.

> STIR/SHAKEN enables phone companies to verify that the caller ID information transmitted with a call matches the caller’s phone number.

Seems to target spoofing. If they can eliminate spoofing it should make tracking down bad actors easier which should ultimately put many of them out of business.

I don't think actually tracking down the bad actors is the motivation for this is it? You're still going to be blind to the call behind the originating network; you just won't get attestation as to its identity.

Fraud becomes harder because unauthorized impersonation of someone else's number becomes illegal and is (hopefully) technically prevented.

Because of this, you can just blacklist spammers again, and burner numbers for them become harder to come by.

This is the correct answer. Forcing all numbers to be authenticated doesn’t stop scammers from calling you, it just makes it easier for you to make an effective blacklist. (A blacklist around which Apple and Google, etc would be wise to make a good UX.)

Presumably it would reduce the amount of fraud. While it may not deter legal nuisance calls, that should make the phone a more reliable communications medium. That's especially true for businesses and government since, with the current state of affairs, it isn't even worth verifying that an incoming call is legitimate. Not to mention that spoofed numbers make targeted attacks possible.

Off-topic, but your sentence made me realize a useful difference between "lawful" and "legal". I first read "legal" as "relating to matters of law" rather than "lawful", and then realized you meant the latter. Now I see why the word "lawful" might be used!

Regarding your actual reply, though, that basically means we shouldn't really hold our breaths for this to actually stop calls? :\ Just less fraud, which is nice, but from the only thing that makes these calls such a nuisance.

From my understanding, spoofed calls won’t get onto your carrier’a network under this model, let alone ring your phone. All this assumes that sorting out spoofing resolves the problem, which isn’t guaranteed.

I thought they still go through to the carrier? Just under a different attestation level: https://www.bandwidth.com/glossary/stir-shaken/

Thanks, that link is a much better overview. It seems the calls will still reach the destination network, and the phone then, but with potential for the operator to signal the likelihood of it being an unwanted or spoofed call.

I imagine we will see a tickbox in the operators apps and web settings portals to block or send such calls straight to voicemail (or similar), as they'd be able to be distinguished via the reduced attestation level.

Maybe I'm missing something but if authentication is allowed, it will allow the client or carrier to block calls based on authenticated ID accurately. RN that's effectively impossible.

Yeah I get that, but I'm asking what a user should expect to actually happen by that time, not what a user should expect to be theoretically no longer impossible by that time.

This is a first step, make all this stuff able to be traced and authenticated.

Step 2 is to start to put the fraudsters in jail, now we can figure out who they are.

This also means easier blacklisting for the client.

Reply on news.ycombinator.com