Hacker News Reader

Comment by mullingitover | Hacker News Reader

I wish we could euthanize this garbage, antiquated phone system. It shouldn't be expected/required that every adult has a phone number when the system is so irredeemably broken and dangerous.

If the web didn't have HTTPS, it would be illegal to conduct sensitive business over it. Yet we're stuck with this entrenched telephone system, the best we can do is STIR/SHAKEN, and that's not real security.

View on HN

100%. My son got sick at school last week and I ignored the call from the school nurse because I have been so thoroughly conditioned by daily scam calls to ignore any unrecognized number. It’s insane that this is still a problem.

get an android and use "screen my call"

Useful for an individual tactic, not really a solution to the large scale problem.

The solution (well, one at least) to the large scale problem is for everyone to call their representative as long as it takes to implement necessary penalty regulation. All the US based people complaining here can start doing it today.

The exact same thing happened to me last week. My son got sick at school, enough so that they ended up calling the paramedics. But I had been spammed so much the week before with spoofed phone numbers from my area code that I had my phone on "Do Not Disturb" allowing only people in my contact list through. I thought it would be fine since the school's phone number is in my contact list.

Unfortunately the school's systems were down and so they weren't able to call me from the school's regular phone system. They called from random personal cell phones, so that went straight to voicemail. It wasn't until someone was literally sent to my house to bang on my door that I got notification of my child's medical emergency. They were about to administer medication that would NOT have been okay to give him, and I was lucky to be able to contact them and tell them to hold off before they did it.

Never mind reporting them to a phone provider. If something had happened to my son I swear to God I would have gone full Liam Neeson "what I do have are a very particular set of skills" on the jackass who's running that specific phone spam operation.

One slightly better solution is to get a Voip number from a distant area code in a place you’ve never been and know no one. Only give that number to people you want to actually call you. Then you can safely ignore all calls from that area code.

I feel very lucky to have a phone number from when I lived in northern NY for a few years. There are 4 people from that area code that I might ever want a phone call from, and they are all in my address book. Any other 315 number is safe to ignore.

I'm reasonably nearby the major city that has my cell phone's area code but I'm in a different area code and most people who are in the city who could even potentially call me are in my contact list. (For a long time I used to regularly get calls from areacode-exchange-random 4 digits which I knew to safely ignore/block.)

If you have a kid and are ignoring calls, that is crazy.

Well he’s 12, in the care of competent adults at a public school less than a mile away. But sure, I guess I should have been perfect.

I also have a 12yo (and three younger kids), and I have missed calls from school as well.

You're right. How about we all try this? The next time anyone's in a meeting together talking about a production incident or quarterly planning or whatever, they're going to tell everyone else to STFU and wait while they take every random call they get on the off chance it's their kid's school trying to get through to them. Does that seem reasonable to you?

No, because it isn't reasonable. What would be reasonable is for the individual receiving the call to excuse themself leaving the rest of the meeting to carry on. Isn't this already the standard?

When over 95% of the calls you receive are spam, it's not reasonable to excuse yourself from meetings whenever you get a phone call.

I mean, unless you just don't want to be in meetings. Which is okay.

Maybe, but that's the world we live in now. If it's crazy, it's an inevitable sort of crazy. Get enough spam calls, and even if you know you might get a valid call from an unknown number, you'll find yourself treating them all as spam just the same. We really, really don't do well with repeated false alarms.

It's how our brains operate, and the fact that the spam keeps on coming just reinforces it. If the call is legitimate and time sensitive, you hope they'll leave a voicemail or, better yet, follow up with a text message.

Is there a word for describing becoming desensitized from false alarms? A similar situation is instead of a shared calendar for OOF status (at work) we are asked to send a calendar invite to our team and immediate team. My calendar is filled with “doctor appointment” invitations from people I don’t often interact with or need to know their in-office status. I started missing meetings and appointments because I was so desensitized from appointment reminders that were meaningless, I’d just ignore the notification because they were rarely valid. Since then I’ve tried automatically deleting out of office invites but they don’t always follow the same format. I’m apparently alone here because I brought this up as an issue and no one else felt like it was a practice that needed to change.

I've heard alarm fatigue used. I think it originated in a healthcare context.

I've also heard the term alarm fatigue. Pretty sure I heard it in the context of cybersecurity where security admins will get complacent if there's too many false alarms and potentially miss legitimate attacks.

I have defaulted to No Phone/Voice Calls for over 5+ years. By default, everyone is blocked, and I maintain a whitelist (a group named "!DND") of numbers who can go through — school numbers, including quite a lot of teachers, the bus driver, and the bus assistant can get through. This is working so far.

I could see this failing because the nurse's phone number is different than the school. Any large institution usually has multiple lines.

Depends on how their PBX is set up, but often those lines—even if they have separate incoming numbers—will all have the same outgoing number.

Which is ironically done by spoofing the number, which is why it's so easy for scammers to spoof numbers.

I remember how shocked I was when I first learned how insecure caller-ID is. I was setting up a VOIP PBX for the small business I was taking over from my father after he passed away unexpectedly. I hadn't been able to get into his (telco-hosted) voicemail, until I happened to call the number from the new VOIP line. Since I had the caller-ID set to the same number, the voicemail system not only bypassed the greeting, but it automatically logged me in (it was set to bypass the PIN when calling from the same line).

I tell people that caller-ID should be trusted as much as the return address on an envelope. Perhaps I can soon update my guidance now that STIR/SHAKEN is (apparently) near full rollout.

Did the school at least leave a legit voicemail? (Curious)

Yeah, I don’t get people complaining about important missed calls.

Yeah, I may miss these occasionally, but I see them almost immediately if they leave a voicemail — and they should, if it’s important — and then call them back, and apologize for the missed call, which they always empathize with.

I lose at most a minute or two, which is totally acceptable.

I think this is cultural. I've never ever left a voice message, and never will. I've also never received one, the few I get are robocallers not understanding no one picked up.

If you want me to pick up, send an sms explaining what it's about.

A school nurse probably doesn't have SMS capabilities on their school phone, and might not be willing to share their private number (I certainly wouldn't in that position).

I rarely leave voicemails, but I will when it's urgent.

A school nurse is certainly expected to leave a message with a callback number. There are hundreds of millions of ways to leave a callback number that isn't 1 specific number you want. But "leave nothing" obviously isn't an acceptable solution, and leaving a personal cell number as a callback is a more acceptable one.

tl;dr: leave message+number, how you do so is up to you

Absolutely. The person I was replying to said that voicemail was not a reasonable option. If the nurse needed to send an SMS their only option may be to use a personal device, and it isn't reasonable to expect educators and staff to provide personal contact information to parents.

The proper procedure is for the nurse to leave a voicemail with their school-provided contact number (either the school office or a way to dial them directly that isn't their personal number).

However, since voice mail isn't common where I live, I also get all communication through text. Most systems send out texts. It's how I communicate with the plumber, my dentist etc. Basically never talk over phone with anyone.

Many of us here grew up in the answering machine era where leaving a message was normal, expected behavior- when phones were not carried on your person.

Ironically back in the answering machine era you could screen your calls as they were coming in, short-circuiting this entire loop.

And what's old is new again, both Android and (newly) iPhone have live voicemail screening features!

I'm always struck in these threads how much variation there is. I doubt I receive one SPAM/scam text or phone call a week. It would seem weird that I'd want to make myself potentially unreachable to avoid the odd junk. I guess if I got multiple per day I'd need a different strategy.

I have literally never in my life received or left a voicemail, or even know someone who ever did... and I also wouldn't expect anyone to listen to the one I leave on their phone.

Your school should offer alternate forms of contact, including texting and email

I guess this is the problem: you have to answer before you know what it is about. With email, you can immediately at least read the title of the email, or even the contents, before deciding if you want to respond or not.

>If the web didn't have HTTPS, it would be illegal to conduct sensitive business over it.

Source? According to this timeline[1], e-commerence with credit cards predate SSL. Therefore I'm not really convinced that there's some law against it, except for laws that were introduced after SSL was a thing.

[1] https://en.wikipedia.org/wiki/E-commerce#Timeline

E-commerce predates opening The Internet for commercial entities. In 1988 or 89 I ordered some Unix book, maybe the 4.3BSD daemon book, via email that I got from Nyx, which was a dialup Usenet server at University of Denver. Sent a credit card number over SMTP email.

I remember "buying" something online and having to physically mail a check with the order # on the info line.

Been there, done that. Also sent a credit card number split across two emails “for security.”

...and why would there be? People are free to be stupid if they want.

I really hate this attitude that every little danger has to be regulated.

It's not so much law, as far as I'm aware, as the PCI/DSS requirements made by the credit card companies. Since they'll stop doing business with you if you don't follow their requirements, for all practical purposes, they have the force of law.

You could probably get sued for negligence if you process card details over an unencrypted connection, but that's nothing compared to the damage your business will take if the card companies decide that you're on the naughty list.

Sure, since we do have TLS on the web card companies can require we use it. That doesn't mean that they would just disallow all online transactions if we did no have easy encryption available. Security is after all never the primary concern - if it was you would not interacting with other people and computers at all.

You can rest assured that the phone company 100% securely knows who to bill for the call. They just aren’t telling you.

Lol, no. "[call|charging] [data|detail] records" (CDRs) are batch transferred over FTP, followed by a pseudo ETL into a billing system. It (mostly) works, but it's an archaic mess.

To be fair, T-Mobile and AT&T are on sFTP nowadays.

In America’s “receiver pays their part” system I wouldn’t be too sure. In the rest of the world, the caller/texter pays 100% of the charge, but in the US you’re charged per text and minutes received.

Once you add a “free call” entity on the other side (like Google Voice) then no one is charged to make the call.

Additionally, plenty of people “sell” their real number and there are android apps routing internet call through the victim’s real number. In this case, even if the person is charged, it’s not necessarily the spammer.

> , but in the US you’re charged per text and minutes received

I doubt 99%+ of end users in the US have been charged for non international minutes or non international text in the last decade or even 15 years.

The bill the end user receives being zero doesn't change how telecom billing is set up. The fact that it's "Free" and costs are hidden from the user in America isn't exactly uncommon.

If the phone companies are billing each other, they don’t they have to know who to bill, per tinus_hn’s comment?

I wouldn’t exactly say STIR/SHAKEN isn’t real security. The protocol works fine (like HTTPS), the issue right now is that the Certificate Authority network is still being built out and attestation isn’t enforced by carriers yet. Things should steadily improve now that the protocol itself is deployed.

The sad part is that it only got really really broken when it got digitised, i.e. IP telephony. Preventing number spoofing was trivial and a solved problem back when the phone system was still "antiquated". These design flaws were added surprisingly recently.

Reply on news.ycombinator.com