Hacker News Reader

Comment by brk | Hacker News Reader

It is unfortunate that the cellular companies have allowed their core product (voice calls) to be so devalued that they need to be forced to solve this problem instead of just doing it naturally.

The carriers are clearly customer-hostile, as this is really a very solvable problem. Instead, we now are moving to alternate mechanisms to manage audio calls (eg: Signal, Whatsapp, Facebook, etc.). My wide-open Verizon cell-phone number is my least preferred method of contact by far, due to the fact that I cannot trust that unknown numbers are high-value incoming calls.

View on HN

It's also unfortunate that robocalling isn't bannable across the board because politicians want to continue to have the ability to spam call constituents. It's really unfortunate that all sorts of automatic calls need to continue being permitted just so we can have the delightful luxury of getting spam fundraising calls from politicians.

This has real world consequences, last year a lost hiker ended up declining calls from search and rescue[1] since they assumed they were spam.

There is a really easy and extremely effective solution to this problem - charge calls on both ends. Make the caller pay a few cents for every call placed instead of placing the full charge on the receiver.

1. https://www.npr.org/2021/10/26/1049252333/lost-hiker-mount-e...

Yes, there are lots of solutions if there is a genuine attempt to solve the problem and not just dance around it.

Political calls and texts should absolutely be blockable by users if they so choose.

Cost-based calling may not be practical, IMO. I look at the amount of junk mail I get from the USPS and I am not sure a "sender pays" approach would result in a meaningful reduction with a cost structure that didn't also impact regular users. A rate-limiting approach on call origination could work, but in the end I still think that a simple that gives the users control to block unwanted calls/texts, coupled with an origination source validation would solve most of the problem. There is nothing preventing us from capturing and passing accurate call origination data.

Just an FYI, FTC has a signup for junk mail just like they do for phone calls. I just do the prescreen one and the only junk I get now is for previous tenants. Unfortunately I don't know how to solve that one.

https://consumer.ftc.gov/articles/how-stop-junk-mail

Ugh. That's an awful solution. In order to not be spammed and have your privacy invaded, you have to submit information about yourself to the bad actors in the first place. Plus you have to pay them for the privilege of not harassing you, and on top of it, they only stop for 10 years and then you have to do it all over again. It's fucking ridiculous. This is not a real solution.

It is awful, but they already are buying that information tbh. So I'm not sure there's an information gain through this. I don't do the paid service (which is $2... come on...) and my spam (phone and mail) is significantly reduced. It's not a perfect solution, but it is a real solution.

I've thought this would be a good solution for years. I would like if you could choose the amount to charge people to call you that aren't on your white list. You get 90% of that and the phone company gets 10%. A win-win-win for you the, the phone company, and people trying to talk to you. I would probably set to a dollar or two. Warren Buffet or Elon Musk could set it to $10 million put you would probably need and escrow account for that amount of money.

Aren't the robocallers paying for VoIP services now?

Since most robo calls are also illegal scams even if the call was legal all we really need is verified numbers so that we can use phone records to catch the person making the call.

Politicians want you to know who is calling - name recognition is important. "I got a call from X is a big deal".

>My wide-open Verizon cell-phone number is my least preferred method of contact by far, due to the fact that I cannot trust that unknown numbers are high-value incoming calls.

I thought it was a legal requirement for phone network operators to leave phone numbers accessible to all, and hence their inability to effectively fight spam.

Otherwise, what would stop the situation from becoming like email, where email is more likely to be delivered if sent from a big player and less likely from a small player.

What does “accessible to all” mean in this context?

Why do I in Europe get almost zero spam calls or text while in the US it seems like a plague?

In Canada and while I do get some it’s fairly rare. Maybe 1 a month.

I get 4-5 a week on Bell, my SO gets 1-2 a day on Rogers.

Have you signed up for the national do not call list?

Yes, of course I have. But the “CRA”, Duct Cleaners, and the women who speaks only Chinese all ignore that list.

I really wonder what the difference is between numbers, I’m on telus and I don’t think they make any attempt to block them? And I’ve had my number for 20 years, with both bell and Rogers in the past. and made no effort to keep it secret. Thou I occasionally answer the calls when I’m bored and waste them time.

Anecdotes do not constitute data. My family in Canada gets tons of robocalls and spam calls, to the point that nobody answers unrecognized numbers unless they're expecting a call...

Things seem to be improving: I’m getting fewer and fewer “neighbourhood” calls.

I suspect the vector is moving away from VoIP systems and more toward buying masses of prepaid plans and stuffing them into various contraptions that hold hundreds of sims to blast out messages/calls.

https://m.aliexpress.com/item/1005004095035108.html

Have they signed up for the national do not call list or renewed it? as it expires iirc. My friends in the same boat often never signed up like I did.

UK here, we get tons of scam robocalls to the point where I leave my phone on airplane mode with Wi-Fi enabled like 95% of the time.

You mean you haven’t been in an accident that wasn’t your fault?

Accessible to all meaning the rules for being part of the public switched telephone network:

https://en.wikipedia.org/wiki/Public_switched_telephone_netw...

Again, I am not sure and very well may be wrong, but I think I recall reading or maybe just assuming that the FCC or maybe a global agreement bars individual network operators from not accepting calls from others within the network.

I imagine this gets very hairy due to international jurisdictions and things like caller ID spoofing.

See section on Legal Considerations:

https://en.wikipedia.org/wiki/Caller_ID_spoofing

An interesting conversation that came up in my research about this topic for why a telco might be barred from blocking against certain numbers:

https://www.techdirt.com/2007/03/16/can-a-telco-block-phone-...

I have no idea why European numbers might not get spam calls with the same frequency as American. Maybe the spammers are looking for English speaking people, or Americans are richer or easier to scam?

Depends on the country. I think it comes down to availability of cheap labour for call-based vectors.

French numbers can get tons of spam calls, because there’s no shortage of impoverished French speakers in the world.

EU may be stricter about enforcing, but I've also experienced it's very person-dependent.

People who need to answer unknown callers for business reasons (small business owners, sales, etc.) get put on lists of "known active numbers" and may get multiple spam calls a day. Folks like me who can just ignore any unknown number & respond only if they leave a real voicemail, get FAR fewer (maybe 1 a month on avg). We tend to complain less about the issue (even if it is annoying & I still treat all unknown calls as spam by default).

Also, if you own a google device, they're very good at IDing spam callers. I recently switched from Google to Samsung and get far more.

Because you have a functioning government.

When you target Americans, you can use a single language to hit 239 million people with their native/first language. You can't do that in Europe.

In the US, one of the loopholes in rules requiring STIR/SHAKEN and other protections was that smaller carriers, usually serving rural or under served markets, were exempt. This became a profit center for them as they became one of the only means for these spam calls, which originated in overseas call centers, to connect to US callers.

Thus the smaller carriers were incentivized by profit to connect the calls.

Now that STIR/SHAKEN is supposedly a thing, is there a way in Android that I can block calls that go through those carriers?

Unfortunately it's carrier to carrier and not data we're privy to. Carriers get paid arbitrage fees for carrying or connecting calls, so they really have no incentive to stop these calls other than legal liability.

Then they really dropped the ball on SHAKEN/STIR. At a minimum they should pass the customer all the hops so we can block shit we don't want (international calls, VOIP calls, known spammers, known bad companies etc.) on our end.

Telecommunications is interesting in that everything strives to be backwards compatible and will accommodate the lowest common denominator to connect a call. It's very much like Microsoft Windows, in that backward compatibility is both a strength and a common source of problems. Government mandates don't usually go beyond borders, so carriers have to accommodate international operators.

And any new features or technologies often introduce or expose problems.

When Caller ID was introduced, there was a huge backlash around privacy. Callers were upset about having the number they were calling from being exposed. If a doctor called a patient it could expose his direct or home number instead of the office number. In the age of phone books, a phone number could be associated with an address. The ACLU sued to block Caller ID until it was possible to disabled it.

Because large call centers operated hundreds of numbers and wanted a way for them to all appear as the same business entity. Carriers later implemented ways for these customers to spoof Caller ID so that the carrier wasn't responsible for maintaining it. Carriers connecting calls had to trust the originating carrier's caller ID info as well.

All these requirements allowed for a bad actor to spoof Caller ID and for it to just be trusted.

Carriers use to have star codes you would use for certain features like disabling Caller ID, disabling Call Waiting, and, famously, calling back a number that called you. These are similar to the AT codes you can issue to the modem in your cellphone via the dialer. Kids today will never appreciate REM's Star 69.

When digital cellphones arrived, they presented some odd challenges too like the fact that call information was transmitted digitally to the carrier and not via analog tones. Because number presses on your cellphone didn't equate to analog tones over the line, cellphone users couldn't interact with IVR menu systems (e.g., "Press 1 for English...").

Character limits in SMS messages come from the fact that they occupied the null space in beacon messages transmitted between cell towers and phones. Before MMS was a thing you couldn't send longer messages or if your phone broke them up into chunks, they might be delivered out of order or not at all.

US has a larger market with a single language, and our regulators demanded calls to mobile phones to be on an equal footing for callers. You never needed to pay more to call a cell phone than a land line from the same rate center; the cell phone user has to pay any additional cost to carry the call over the air. Additionally, inter-carrier rates are regulated and set to approximate costs, which is now pretty much zero. This makes bulk calling and texting inexepensive (less than a penny per message or minute). In (most of?) Europe, callers have to pay for the privilege or calling a cell phone, and the numbers are in different ranges, and it's not cheap, 10 cents or more per minute or message at bulk rates; even though the underlying cost is probably similar to the US, near zero.

Over the last few years the FCC rules on carriers were relaxed so that they can discriminate against calls originating from domestic networks. Previously they could not block calls even if it was obvious it was a scam call. However, it's not always obvious which robo calls are legitimate and which aren't.

The bigger issue though is not about domestic origin calls, it's about foreign originated calls that the FCC has no power over. The domestic carriers had to forward these calls. There is traction gaining to require that calls that originate overseas verify their identity to US based networks. Domestic carriers can reject calls that don't verify (spoofed numbers that originate offshore).

That still may not stop all the spam calls but it will slow it down. The problem here is really that telephony became extremely cheap and accessible to the whole world.

I never, ever get legitimate calls from overseas. Just turn those calls off for my phone.

Well, perhaps callbacks from helpdesks located in other countries, in which case give me time-boxed control over foreign calls, and perhaps a passcode that I can communicate along with my callback number.

There are billions of dollars at stake, of course. This is a solvable problem, and the FCC doesn't even need to get involved. The carriers care more about the money than their customers (so what else is new?)

Can't all of this be done locally on the phone? Why does the phone app not have an option to simply ignore all garbage calls

The phone company doesn't give you the originator information. This is what they need to be forced to do. Then users could block calls and texts from international numbers to politicians to voips to anything from the state of Wisconsin, adblock-style.

I want the ability to block all overseas calls, and I want that ability in a way that is easy enough to opt into that most people choose to. This would resolve the overseas helpdesk problem by forcing domestic companies to use domestic call centers to succeed in reaching people.

I have never received a legitimate phonecall from overseas, and I don't expect I ever will. In every case that I've had a legitimate reason to talk to somebody overseas, we used voip-to-voip, never telephones.

The problem is someone from overseas can claim to be from a US number. The number you see on your phone can be anything the caller wants it to be. A fair number of robocalls are from overseas but looks to you like they come from your country.

That's precisely what the carriers need to solve.

They're not interested.

> However, it's not always obvious which robo calls are legitimate and which aren't.

I can make this real simple. I don't want any robocalls.

I feel you. Still, there are legitimate uses for robocalls. My doctor’s office uses robocalls for lab test results, so that patients can get their lab results as soon as the lab tech puts it in the computer instead of having to wait for a person to make the call. Sure, you can email/text these results for most people, but there are still some older folks who don’t know how to email/text.

That's cool - we can wait two extra days for a call from our doctor if it's warranted. I don't need instantaneous feedback on my bloodwork.

Well, grandma does need her bloodwork results. And she's the one most likely to fall for a robocall scam anyway.

And do you think illicit callers are going to follow the law? They're already committing wire fraud, and the software already exists.

Yea - I think illicit callers are going to follow laws whenever possible. "Criminals always be crime-ing" is an argument that can be used to counter having any laws but it has a fatal flaw - criminals generally don't want unnecessary attention. The more agencies they piss off by violating regulations the more likely it is that their activities will be suspended.

A lot of the crime you see on TV comes from highly irrational and unpredictable people, but scamming is usually a pretty rational decision if you live somewhere where repercussions are unlikely and the expected income is high.

I'm not arguing that we should roll back any legislation against wire fraud or spam calls. I am saying that the evidence demonstrates that those laws were not effective in deterring the overseas criminals who continue to constitute the bulk of these calls. They are simply not in the jurisdiction in which we are passing these laws. If US wire fraud charges aren't enough attention, I'm not sure what marginal increase in attention one could possibly expect from an additional law.

I get an e-mail and they show up on a web UI and it is instantaneous more or less.

And I don't know why I have to get robocalls because gramma can't operate the internet.

And both my 80+ year old parents can navigate the internet well enough to get lab test results off of websites.

We should still take into account the usability of public utilities for those who struggle with internet illiteracy or disabilities, regardless of how well your parents can cope. A full 25% of people 65+ don't use the internet in any capacity at all.

Again, why does this mean that I have to suffer from robocalls, other than cynical justification to defend robocalls in the abstract and continue to inflict them on everyone?

I suppose if you have enough money, you might be able to convince AT&T or your local lawmaker to cater specifically to your desires.

I just doubt that the result of your stated preference is a solution that would be workable enough for the general public. The rest of the world just wants the spam calls to go away but still get calls from their bank/pharmacy/doctor/school/etc. Asking them to choose between the two is not a solution for them, even if it is for you. No law maker is going to propose that. And your carrier already DGAF.

If this was an option available to every consumer I suspect uptake would be closer to 50% or more. It would look a lot more like Apple's privacy features than some bespoke setting that I'm the only person in the world who cares about it. And this is probably what you're actually afraid of for some reason.

I don't doubt that, I'm sure 50% of people will check the option thinking it'll just block spam. The problem is that blocking robocalls entirely would block legitimate calls that they're not aware of until it'll cause pain and frustration down the line.

Most people do want fraud notifications from their bank, notifications from their utilities about maintenance, notifications that their kid's school is closed today, a call back from customer service when they ask for one, etc. But nobody would think or even have the ability to know about this when checking your "block all robocalls" option, and now you have created a new problem.

If you give people a footgun, they will use it, and they will blame whoever came up with the idea. This is why nobody will do what you are asking.

What's the number of people 65+ who don't use a phone in any capacity at all? It's not zero.

There will always be people left to the wayside, and we need to act when that number is manageable. 25% might be way too much to legislate against robocalls in all forms, but we need to weigh the loss against the gains; how many seniors would benefit from less scams?

Of course, there are always exceptions. 25% of a major demographic is not one, though. I know that young people and those working in tech are totally over voice calls, but outside of our bubble, people still use telephones as telephones.

I definitely appreciated getting called quickly the last time i got a covid test

Then you can leave robocalls on.

Imposing that option on people negates its usefulness. Which option would you recommend to your elderly relatives? Accept robocalls from international scammers or receive updates from their doctors office?

You might as well ban robocalls for legitimate uses too, since legitimate users won't be able to rely on it anymore.

I agree it's not a 100% solution for all cases ever. But it's still a strict improvement for many people.

My doctor (well, their hospital system) uses Epic/MyChart as their EMR. I also have the MyChart app on my phone. I get a push notification via the MyChart app when anything new posts to my chart - no phone call, text, or email required. And I don't want the push notifications, I could opt out of that too.

Surely most doctors offices use a vanishingly small amount of EMR providers, and they could support similar very easily.

The people who use the hospital system the most are the ones who are the least likely to be able to use those functions effectively.

Never underestimate how out of touch and incapable of understanding other people HN nerds are.

Politicians exempted themselves from the do not call list: https://www.khou.com/article/news/verify/verify-yes-robocall...

There is nothing preventing them from providing users with more granular call-rejection controls. Their networks need to be "accessible" on the incoming call side, but that does not mean as a customer I should be forced to have every call intended for my number to be routed through to my phone.

An iptables concept with a user friendly UI would address much of this problem, particularly if we could filter on useful call origination data, or lack thereof.

The major carriers have this but charge for it. Like $5/mo. It's pretty sad.

> I thought it was a legal requirement for phone network operators to leave phone numbers accessible to all...

If only they were required to use caller ID to reliably tell us who is calling...

https://en.wikipedia.org/wiki/Caller_ID_spoofing

I thought it was a legal requirement for phone network operators to leave phone numbers accessible to all

Is it a legal requirement to allow spoofed caller ID from bad actors?

Spoofed IP addresses used to be a much bigger problem on the Internet than they are today (many examples but see Smurf Attack).

We collectively implemented security to reduce the threat. Phone companies could do the same for spoofed caller ID for companies that consistently abuse it.

> Spoofed IP addresses used to be a much bigger problem on the Internet than they are today (many examples but see Smurf Attack).

Most of the large DDoS attacks are UDP reflection, the attacker spoofs the victims address and sends to chargen[1] servers or whatever. So spoofing is still alive and well.

[1] yes really, the worst ones are people who install Microsoft's Services for Unix and enable the chargen server to the public... It sends a 64k fragmented response. Thanks Microsoft.

How long have you been on the Internet? I ask because I started an ISP in 1996 and IP address spoofing used to be soooo much worse.

Today’s situation is the product of literally 2.5 decades of encouraging and/or shaming Internet-connected networks into properly configuring their routers to drop spoofed packets egressing from their network with a spoofed IP address not from their network.

Approximately forever, although while I worked at an "ISP" in 1999, it was a two T1 ISP; one for modems, one for upstream; and then we outsourced all the modem stuff to MegaPath when something weird happened to our modem T1, but I was never trained on how that T1 worked, all just magic to me. I kind of sort of get the idea today, but ... I poked at the RADIUS server, and setup webhosting for customers. I never worked for a real DDoS target until 10 years ago (and even then it was mostly people kicking the tires with 90 second DDoS services). I'm sure it's not as bad as it once was, but it's still probably easier to get a big DDoS with UDP reflection than through botnets directly hitting the target.

Back to the topic of telco spam. STIR/Shaken should maybe get us actual caller-ids soonish, I think there's one more deadline for small carriers that service actual phone lines. OTOH, what are you going to do with a real caller id? I'm pretty sure phone companies just don't want to do it anymore, there's no money in voice calling, and it'll fall apart like landlines have.

but it's still probably easier to get a big DDoS with UDP reflection than through botnets directly hitting the target.

We were more sophisticated back then. So picture your netblock is 207.180.10.0/24 and you've directly connected all 200 computers on your Class-C netblock directly to the public Internet without any NAT. 207.180.10.0 is your network ID and 207.180.10.255 is your broadcast address.

Someone comes along and sends a 64 byte ICMP ECHO request to 207.180.10.255. And they get 200 responses. Literally every one of the computers on your entire network responds with an ICMP ECHO reply.

So now they can spoof an IP address from Victim IP address to send 1k ICMP ECHO requests to 207.180.10.255 and multiply their attack 200:1.

But now imagine instead of a tiny Class-C netblock they find a similarly configured broadcast address for a huge Class-A netblock. And their scanner counts 29,000 ICMP ECHO replies for each request they send out. Now their attack is multiplied 29,000:1.

And since they've been scanning for broadcast addresses on the public Internet every day for a month they have compiled a list of hundreds of them so the attack seems to be coming from everywhere.

https://www.fortinet.com/resources/cyberglossary/smurf-attac...

> It is unfortunate that the cellular companies have allowed their core product (voice calls) to be so devalued that they need to be forced to solve this problem instead of just doing it naturally.

And they did this while loudly complaining that they don't want to become a mere dumb pipe! That is the true twist.

to the point, I used to refer to the device as a mobile phone or cell phone. now, because I so rarely use the "phone" app, it is just now my "device". 99% of the time my phone app gives me notifications is SPAM LIKELY reaching out to me, but won't take the hint that we broke up years ago and I have zero interest in touching base and catching up. however, if anyone of my known contacts actually uses the phone app to reach me, i know it must be significant to not use a text/chat app like 99.9% of our typical interactions take place.

times have changed for phone calls, but the lack of Anti-Spam from these providers only hastened the change away from their core service

Imagine if nobody knew what a phone was, and then the device manufacturers suddenly introduced the phone app: it would outrage and annoy people!

Here is an app that allows any rando person in the world to cause your device to wake up, interrupt whatever you are doing, display a notification, play a sound, vibrate, and if you push the green button, that rando person (identifiable by a spoofable string of numbers) can hear and talk to you! It would not be well received in 2022 where privacy and digital well-being is increasingly important to people. Yet for historical reasons, it’s pre-installed on every phone.

How is that any different than a notification from any messaging, social media, or any app really with notifications turned on? They all know that the human brain is very susceptible to these notifications.

At least with the old school phone, you could leave the receiver off hook to send the callers a busy signal or just unplugged.

I feel like the legacy POTS system does more harm to society than good. Step back and imagine the web without SSL. Think of the sheer scale of fraud and abuse that would run rampant. That's the service phone carriers are operating right now.

> The carriers are clearly customer-hostile

It’s actually not the carriers. The carriers actual try to actively block spam.

It’s actual the Twilio’s of the world that originate the bulk of the spam.

The carriers could absolutely implement authenticated caller id as a very first start. Then, you can at least trust the caller ID and screen/block effectively.

Do you mean like Shaken/Stir?

https://en.m.wikipedia.org/wiki/STIR/SHAKEN

OK so I am on T-Mobile, I use an Android device. Is there a way I can automatically display the true origin for all phone calls and texts? I would like to block any calls from VOIPs, international origins, or non-SHAKEN/STIR providers.

It's not at all surprising to me that corporations are happy to redirect people from utilities to products as core means of communicating.

How did they allow this? I think text is just an alternative that most people prefer for large number of use cases.

It kind of goes both ways, politicians "allowing" themselves to be lobbied by big telecom.

Reply on news.ycombinator.com