Hacker News Reader

Comment by mullen | Hacker News Reader

Just get rid of spoofing phone numbers and this problem goes away. Make every caller reveal their phone number of origin and give consumers the ability to easily block anonymous calls and overseas calls and the ability of scammers to contact people via phone goes away.

Phone companies don't want to do this because implementing the no-spoofing infrastructure requires money and they also make a lot of money off scammers business lines.

The telephone infrastructure is critical to a nation and anyone abusing it should not be tolerated, especially scammers.

View on HN

Getting rid of spoofing is kind of tricky, because you then need a way to know which numbers are authorized to be used by which accounts, especially when there can be several intermediate carriers in the connection process.

A standardized reporting code (like *69 for call back, but instead to report abuse) combined with detailed enough call records to enable that would be helpful.

Maybe a carrier can charge other carriers more it at least x% of calls are flagged as abuse. And a carrier may charge a customer more if at least y% percent of calls are flagged as abuse. And a customer is referred to FCC for enforcement action after N calls are flagged in 30 days or if z% of calls are flagged.

Perhaps a requirement for record keeping of flagged calls, such that the recipient can sue for statuatory damages, and the carriers involved would be liable if they can't provide records. If they provide the records, liability moves to the origin, but the end customer may seek to quash the suboena without revealing their identity in narrow circumstances where anonymous calls serve the public interest and the abuse process is being used to deanonymize rather than stop abuse.

> A standardized reporting code (like 69 for call back, but instead to report abuse)

We have this. 57

https://en.wikipedia.org/wiki/Vertical_service_code

"is an upcharge fee subscription service offered by telephone company providers which, when dialed immediately after a malicious call, records meta-data for police follow-up. A police report must be filed after each use, as law enforcement will only act on the trace once a formal police report is filed in regard to the call. "

So, I will get charged for reporting a scammer? And nothing will happen unless I file a police report? That is certainly a solution, but not the one I would hope for.

They introduced these as a $5 add on in the early 90s, but it rapidly became just a regular part of service. I've never heard of any telco to charge for the reporting service.

The infrastructure is there[1]. The theory is that they don't want to kick off their biggest customers that get billed for the oversized use of the phone system.

[1]: https://en.wikipedia.org/wiki/Automatic_number_identificatio...

There are legitimate reasons for spoofing, but they all involve the permission of the number being spoofed.

We need something akin to DNS records for phone numbers. Each number would list the numbers allowed to spoof it. When a spoofed number comes through you check the list and see if it's allowed. Only the owner of the number can edit the list. (This is not a burden for the vast majority of people who have no need of spoofing, they don't need to ever look at the system.)

The Oligarchic Phone Companies already have a system like this in place, to lookup names based on phone numbers, and it's based on DNS. On the downside, each Oligarchic Phone company charges for each lookup (everything on the Oligarchic Phone Company costs money).

There is no such thing as phone number of origin. A business voice circuit doesn’t have an identity like that. Each call it carries is whatever the signaling data says it is. There may be some inbound numbers routed to it, or not.

The problem is not “is this the true phone number of this circuit?” because there is no such thing. It is not even “do I route inbound calls for this number down this circuit?” because there are legitimate topologies where you don’t. It’s the fully general “is this customer authorized to use this number?” which you somehow have to establish with a bunch of mutually distrusting competitors. It’s possible, that’s what STIR/SHAKEN is, but it’s a formidable problem. Telephony is much more complicated than your one-circuit-one-number residential POTS line.

> there are legitimate topologies where you don’t.

Perhaps it's time to admit that eliminating those topologies is a cost worth incurring.

> there are legitimate topologies where you don't

This has been repeated many times and I still don't believe it.

You’re right, as I’m not aware of any of those telcos have any problem knowing the right person to bill. Odd that the knowledge for that part is perfect ...

Reply on news.ycombinator.com