Comment by dredmorbius | Hacker News Reader

Comment by dredmorbius | Hacker News Reader

Parent Full thread

Understanding that you don't know everything about or speak for the industry, the question I've had for a few years now is whether this is a deliberate tactic (I've little doubt telcos want to shed wireline service), or just a mess with no clear out?

Because the problem's not just with landline but with any direct-dialed PSTN telecoms system. I don't want a landline or mobile phone any more. The situation's well past simple cord-cutting.

It's been about three years since I stumbled across this quote which confirms that at least someone on the inside is aware that the present situation is eroding all trust in the system, and that this is an existential threat:

[S]ince mid-2015, a consortium of engineers from phone carriers and others in the telecom industry have worked on a way to [stop call-spoofing], worried that spam phone calls could eventually endanger the whole system. “We’re getting to the point where nobody trusts the phone network,” says Jim McEachern, principal technologist at the Alliance for Telecommunications Industry Solutions (ATIS.) “When they stop trusting the phone network, they stop using it.”

https://nymag.com/intelligencer/2018/05/how-to-stop-spam-rob...

(From an earlier HN comment of mine: https://news.ycombinator.com/item?id=21542926

Stir-Shake may have reduced levels of spam, I've no way of knowing. But the level it's at remains intolerable and a real financial risk to individuals and businesses. I'm personally aware of several people who've been scammed of thousands of dollars within the past year.

Cut phone service and that threat disappears, along with all the attendant billing bullshit and customer service nightmares.

Is the industry aware of this and what if anything does it plan to do?

my personal opinion is that there is simply too much legacy SS7/PSTN junk out there to change the protocol/traffic exchange between carriers in any significant way that will result in anything ever being fixed.

it's a legacy of the 1950s and 1960s era of the monopoly bell system when all of the phone system trusted itself.

the whole way that traffic moves between telcos in the PSTN is built on lack of crypto authentication, total trust between two phone switches, in a way that would be absurdly terrible if run on the modern internet (imagine all your online banking as http only, for example).

Are you aware of any working groups / consortia / skunkworks looking into this?

Or have any idea of what a solution-shaped object might resemble?

Your answer ... mostly confirms my outsider view. And that story ends poorly.

Thanks, regardless.

My POV is biased by working only adjacent to ILEC/CLEC/PSTN/SS7 related stuff in telecom, my day job is much more focused on building IP based packet last mile and middle mile ISP stuff for direct internet access.

Thanks.

I worked in telco when STIR/SHAKEN was invented. I was in the early sessions with Comcast and AT&T and the rest when they were politely asked by tbe FCC to fix it.

Headline: they never had a chance.

Conspiracy: they didnt want to.

- First of all, the legacy telco network is still out there in huge quantities. This is the copper landline to grandma's house. It speaks SS7 and TDM which have no inherent concept of identity: the tekco switch simply inserts the calling number in the signaling, the end. There is no economic incentive to replace any of this old stuff since there is no marginal revenue to be made. It will rust in place.

- the telco network has long supported cases where the caller had a legitimate need to replace their number with another. Your doctor calling you always shows as the office front desk, never their direct line.

- this use case gets even worse when you have call centers and other high volume users. Use of VoIP makes the modern call center possible, but also trivially easy to change the calling ID, and again, perfectly legitimately for the businesses that use it.

- extra wrinkle: offshore centers. now some agent in India needs to present as if they are calling from Ohio. No problem, VoIP can do that. But the same tech that does that also means their evil twin can call you up from an area code that looks like your town to ask about your car warranty.

I could go on, but this is a really hard problem.

Sprawling networks can be upgraded with gateways and bridges where wholesale replacement isn't viable. Rural services (telephony, electricity, water, gas, sewerage, postal, ...) are often noneconomical and in the US there's a long tradition of either cooperatives or government-run (often municipally-organised) services, and/or steep subsidies.

The legacy assumptions built into PSTN seem to be getting in the way. Simple dumb terminals with no logic greater than being able to generate pulses or tones, logic in centralised switches (which should make upgrading more viable). Identity presumed to be based on the device and circuit, rather than the person at the end of the line (in the increasingly rare cases where a person is in fact at either end of the line). Stronger authentication, and different levels of authentication, are both necessary. (And some preservation for anonymous communications, within the constraints of technologically mediated telecoms platforms, is also useful --- it has its place.)

I'm also fearful that such a system will become captured by a single entity and not offer interoperability --- the long line of personal messaging systems offered by a string of Internet monopolies and would-be monopolies suggest the position has some appeal, if it's difficult to attain. MCI, AoL, Microsoft Messenger, Google's litany of extirpated chat apps, Facebook, Discord, Telegram, Signal, Protonmail, etc.

In its early years telephony was exclusive, and for much of its existence, expensive. Those cost barriers to usage meant that the worst abuses of the system were avoided (though the annoyance of telephone solicitation were still remarked on).

I'm not sure how or where volume increased, though Google Ngram shows "telemarketing" and a set of related terms taking off in the 1970s and 1980s:

https://books.google.com/ngrams/graph?content=telemarketing%...

unless you've worked in telecom, this part

> Sprawling networks can be upgraded with gateways and bridges where wholesale replacement isn't viable. Rural services (telephony, electricity, water, gas, sewerage, postal, ...) are often noneconomical and in the US there's a long tradition of either cooperatives or government-run (often municipally-organised) services, and/or steep subsidies.

this is really overly optimistic, you underestimate how moribund the traditional telco/copper POTS line/dialtone service is. the various ILECs around the USA and their patchwork of territories are putting the bare minimum into keeping some of this stuff running. nobody is going to retrofit custom gateways into their network.

they'll spend money on lobbyists and lawyers to fight back against doing anything other than maintaining the status quo instead.

Exactly. Back in the early 2000s there was a flurry of activity as telcos replaced old Nortel and Lucent TDM switches with IP ones made by CopperCom, Metaswitch, Taqua and the rest but a lot of that was funded by govt funds (eg USDA RUS) and even then those companies could not do anything about the copper access wiring leading into tbeir shiny new switches. So you had this weird situation where a sleek, all IP softswitch was talking IP to a gateway which spoke some TDM thing to an even older SLC96 with a gazillion copper loops hanging off of it.

I think that all those companies are dead or acquired now.

I wonder if something like the strategy used for Certificate Transparency could work here? Take a legacy system, attach authentication on the side, propagate that data in a manner that allows looking it up, use it as a strong signal for "this is actually authentic", and then slowly ratchet that up until people feel comfortable saying that calls without it can go straight to voicemail without ringing.

Reply on news.ycombinator.com