Hacker News Reader

>However, just like email spam, stopping spoofed calls is harder in practice than in theory.

Is it really? Couldn't the carriers simply require a certificate to allow you to spoof a phone number?

Yes, that's exactly what STIR/SHAKEN does - in theory. In practice, like most complex systems, mandating a change like this requires software and hardware upgrades and compatibility testing, all of which takes time. The FCC tracks >10k telcos and providers. Last time I checked, only a quarter of the companies had fully implemented STIR/SHAKEN since the deadline and the FCC has recently started enforcement action on telcos that have ignored it. There is some evidence it has reduced spoofed calls, but just like email, the scammers have also moved to adapt their techniques.

https://www.fcc.gov/document/fcc-remove-companies-robocall-d...

The most legacy of systems. They didn't even get rid of human operators until 1970 on Catalina island. https://youtu.be/jitW_yLwihI

SS7 doesn't have a clean way to do this hence needing to make SHAKEN/STIR, but I don't think anyone did the signalling work for POTS.

Reply on news.ycombinator.com