Hacker News Reader

Comment by IG_Semmelweiss | Hacker News Reader

There are so many non-techy folks that are getting run over by phishers. If tech workers can also be targeted, the rest really have no hope.

I really wish someone would make movies or enticing thriller series out of these post-mortems. There are some good stories to be told, plus it would help the most vulnerable to be better prepared..

View on HN

We’ve lost control of the telecom system. The fact you can’t trust caller id and bad actors aren’t banned still astounds me.

Yep, we need the equivalent of DMARC, DKIM, and SPF for the telecom system. We solved it for email, feels like we should be able to solve it for telecom.

I really hate any system that relies on the telecom system for any sort of verification. I hate every website/app/whatever that doesn't let you disable SMS verification as a "backup". So many places that offer (and even force) 2FA just let you bypass your authenticator with SMS verification.

This exists. https://en.wikipedia.org/wiki/STIR/SHAKEN

And it does work, despite what people will say. My carrier blocks outbound phone calls from caller IDs of number we don't own. The next step will be to for carriers to start refusing calls that don't pass attestation.

My carrier is GoogleFi, and I still get several phone calls a day with my cellphone's area code as the incoming number. (At least, it makes it easier to ignore those calls. I really wish I could program my phone to automatically reject any calls from that area code if it's not in my phone book.)

It exists.

It's utterly ineffective to the scale of attack.

It’s still being deployed. Or more precisely, it’s now mandatory and the service providers which haven’t implemented it are in the process of being forcibly removed from the PSTN: https://natlawreview.com/article/fcc-cracks-down-are-you-rea...

The US telecoms industry has supposedly been "fighting phone spam" for well over a decade. I can tell you it's simply not working.

The system will die, if not from the abuse than from rejection by individuals, businesses, and organisations. And I suspect we'll never again have a single universally-accessible voice comms system again.

Email has similarly been slowly dying for similar reasons.

Yes. Now tell me how I can determine the stir/shaken attestation level of a given incoming call to my iPhone before I answer it.

(The answer in my experience is: you can’t, and next, nobody knows what the different attestation levels mean, and many legit calls still come in without any attestation)

It’s like if browsers only told you that https was enabled after you POSTed your credit card number to the remote site.

The FCC is fixing this: https://www.fcc.gov/call-authentication

Finland passed a law that simply forbids forging caller IDs and forced telecoms to implement it in 2024.

https://ficom.fi/news/combatting-scam-calls-and-smss-how-fin...

worth mentioning that Finland didn't generally have a problem with spoofed caller IDs even before that (I've never personally heard of this happening in Finland ever)

STIR/SHAKEN isn't helping much either. The carriers are all about that sweet, sweet revenue...

This is really a case where PSAs/ads could actually help.

The targeted old people still watch TV, and * hearing* the actual fraudulent pitches will be far more educational than reading about it.

You're totally right, but I also wonder what you could even say in 30 seconds? Don't trust the person on the phone who sounds exactly like your grandson? There's so much nuance to explain.

"The Beekeeper"

Reply on news.ycombinator.com