Hacker News Reader

Comment by acomjean | Hacker News Reader

We’ve lost control of the telecom system. The fact you can’t trust caller id and bad actors aren’t banned still astounds me.

View on HN

Finland passed a law that simply forbids forging caller IDs and forced telecoms to implement it in 2024.

https://ficom.fi/news/combatting-scam-calls-and-smss-how-fin...

worth mentioning that Finland didn't generally have a problem with spoofed caller IDs even before that (I've never personally heard of this happening in Finland ever)

Yep, we need the equivalent of DMARC, DKIM, and SPF for the telecom system. We solved it for email, feels like we should be able to solve it for telecom.

I really hate any system that relies on the telecom system for any sort of verification. I hate every website/app/whatever that doesn't let you disable SMS verification as a "backup". So many places that offer (and even force) 2FA just let you bypass your authenticator with SMS verification.

This exists. https://en.wikipedia.org/wiki/STIR/SHAKEN

Yes. Now tell me how I can determine the stir/shaken attestation level of a given incoming call to my iPhone before I answer it.

(The answer in my experience is: you can’t, and next, nobody knows what the different attestation levels mean, and many legit calls still come in without any attestation)

It’s like if browsers only told you that https was enabled after you POSTed your credit card number to the remote site.

And it does work, despite what people will say. My carrier blocks outbound phone calls from caller IDs of number we don't own. The next step will be to for carriers to start refusing calls that don't pass attestation.

My carrier is GoogleFi, and I still get several phone calls a day with my cellphone's area code as the incoming number. (At least, it makes it easier to ignore those calls. I really wish I could program my phone to automatically reject any calls from that area code if it's not in my phone book.)

It exists.

It's utterly ineffective to the scale of attack.

It’s still being deployed. Or more precisely, it’s now mandatory and the service providers which haven’t implemented it are in the process of being forcibly removed from the PSTN: https://natlawreview.com/article/fcc-cracks-down-are-you-rea...

The US telecoms industry has supposedly been "fighting phone spam" for well over a decade. I can tell you it's simply not working.

The system will die, if not from the abuse than from rejection by individuals, businesses, and organisations. And I suspect we'll never again have a single universally-accessible voice comms system again.

Email has similarly been slowly dying for similar reasons.

The FCC is fixing this: https://www.fcc.gov/call-authentication

STIR/SHAKEN isn't helping much either. The carriers are all about that sweet, sweet revenue...

Reply on news.ycombinator.com