Comment by croutonwagon | Hacker News Reader

Comment by croutonwagon | Hacker News Reader

Parent Full thread

Surprisingly it’s usually banking and investment company’s that require SMS based MFA. Including my main 401k brokerage.

In those cases I keep a google voice number. It’s also the same number I use to give to anyone/any company and it’s just on do not disturb 24/7. If I need to deal with a company on that number I just turn off DND. This practice of never giving out my actual number has drastically decreased the number of “car warranty” trash calls to my actual phone. They all go to that and generally a message is never left, and the phone doesn’t ring. Sometimes I get a voicemail of 3 seconds of dead air but that’s it.

I know a lot of people de-google but my thought is this isn’t a normal PSTN endpoint, and it’s not nearly as easy to sim swap, if not impossible but still works as a second factor. And I’m not aware of another service that can do it better and like it or not, google is a big target so I trust their auth over some other fly by night competitor.

My strategy for people that need to reach me by voice involves a one step IVR on my own asterisk system. This IVR is linked to a DID that I give out for this purpose. It answers and has a voice greeting prompt that says something like "press five zero zero to be connected". If someone does that, x500 initiates a new outbound call to my actual number, preserving the calling party's caller ID.

This cuts down on 99% of your car's extended warranty and IRS scam calls.

>If someone does that, x500 initiates a new outbound call to my actual number, preserving the calling party's caller ID.

Which provider allows this? Won't stir/shaken authentication requirements break it in a few years?

I am my own provider: incoming DIDs reside with a wholesale SIP trunking service. Outgoing SIP with the same provider, usually, though I have multiple possible routes. The asterisk system, I run myself. My outgoing caller ID (and my carrier's links to its upstreams such as bandwidth.com) are SHAKEN/STIR compliant.

This sounds fascinating and also completely over my head in terms of possibilities… is there a basic “getting started guide” you would recommend for someone who may not have the bandwidth to go all-in learning telephony from soup to bolts but would still like the benefits? :)

Wouldn't recommend it unless you do network/telecom stuff for a living, it has a bit of an ongoing time cost in maintenance...

some of the SIP trunking providers that have more focus on the consumer market such as voip.ms do let you define your own custom IVR and menus, to accomplish pretty much what I described, without having your own SIP-speaking system registered to it persistently. You should be able to define a voip.ms IVR destination as your cellphone.

Thinking about this a smidge, you probably can just use voip.ms to (a) order a DID (aka a phone number), (b) setup an IVR for the message, and (c) instruct them to dial an [internal to your account] extension that forwards to your real number, all on the voip.ms platform.

You wouldn't have to set anything up, just pay them for per-minute charge. You will have to pay 2x per minute, once for the inbound, and then outbound to your real number, ..... unless you go through the extra steps of setting up SIP phones.

FWIW; I've used voip.ms for a long time, and just a very happy customer. The biggest trouble they've had was availability issues a month or so ago when they were the victim of a DDoS :-/. You probably could pull off this trick with any of the pay as you go SIP trunking providers ...

How do the calls actually get routed to your phone? Via SIP, or through your cell provider (ie. it dials your phone's phone number)? If everything is over SIP, then it makes sense that everything is SHAKEN/STIR compliant.

at present I do it as the latter. My cellphone's direct number is an external destination on the asterisk system and it initiates a new outbound call to it, and bridges the audio/call from the incoming caller to it.

I can also do it direct over SIP if I want. The android linphone SIP softphone client is not bad. My cellphone can register to my asterisk system as the same extension as my SIP desk phone in my home office. Or if I want I can give it a new extension number and make my desk phone extension number, and the linphone softphone extension number part of the same ring group for me as a person. In which case I would send x500 from the IVR main menu to that ring group.

I generally don't leave linphone running and connected unless I'm actively using it because it can be a battery/CPU hog (in order to SIP register to my asterisk system I also need to be on my personal openvpn link, my server doesn't accept incoming connections from any public IP on the internet). So a combination of the openvpn client running and linphone simultaneously.

> at present I do it as the latter. My cellphone's direct number is an external destination on the asterisk system and it initiates a new outbound call to it, and bridges the audio/call from the incoming caller to it.

But under that scheme, would it still work SHAKEN/STIR? I would think not, because to your cell provider it's effectively indistinguishable from a bad guy spoofing caller ids. Or perhaps there's some forms or whatever you can fill out to get a certificate that allows a third party to spoof calls to you?

I called someone today and they appeared to be using a generic call screening service that offers exactly this feature - a computerized voice asks you to enter a random number to be connected.

I didn't even randomize mine, it's literally the same greeting every time and a fixed extension number. Just the fact that it exists as a roadblock to listen to, comprehend and put in some DTMF tones seems to stop 99% of the scam calls.

I'm guessing most scammers don't even hear your prompt. I have a simple, short, "leave a message <beeep>" prompt and the vast majority of my scam voicemails go:

0:00 - 0:10: silence

0:10 - hangup: "Hello? Hello?"

once stir/shaken is in place, won't the underlying problem go away?

I'm surprised this works for you. Every time I've tried to use my GV number for MFA it's rejected. It's easy for companies to check if a number is assigned to a "legitimate" mobile provider and if not, they just don't accept it.

Is has come up occasionally. But not for anything that’s been a show stopper. I think discord was the most recent, which I use totp for MFA anyway but they want some type of verification or something.

Reply on news.ycombinator.com