Comment by astangl | Hacker News Reader

Comment by astangl | Hacker News Reader

I dispute their contention that an "ideal" solution would not block political or charity robocalls. Ideally we close these loopholes in the No-Call List, so these all are illegal.

It seems to me a lot of the problem results from allowing the caller ID information to be spoofed. Any serious attempt to fix this problem would seem to involve tracking down real numbers, defeating the spoofing.

Most satisfying (and effective!) thing I have ever done to eliminate a repeated scam call (to lower credit card interest rates, never admitting who they're with, except some vague reference to imply they're associated with the credit card companies) is to string the guy along, when I am "going to get my credit card", setting the phone down and going about my other business, until it's clear he finally hung up. Then he called back, and I said "when I got back to the phone you weren't there!", and repeated the game a bunch of times over the day, with the guy getting more & more exasperated. Funnily enough, I never get those calls anymore...

Caller ID spoofing is a true misfeature. The ability should be removed, or consumers should have out-of-band access to the real number in order to be able to at least blacklist it.

http://www.catb.org/jargon/html/M/misfeature.html

Phone numbers are to the telephone network like IP addresses are to the internet. Caller ID is to phone numbers as DNS is to IPs. I don't think getting rid of caller ID would really help anything, and you can't fix the caller ID to specific numbers, as phone numbers are as transient as IPs -- they can terminate to an IP phone in Pakistan one day, and to a Twilio gateway used by some other company's apps the next day. Blacklisting the number can be both ineffective and harmful.

Letting the caller set the caller ID is the only way someone calling you from Comcast about your bill can have Comcast show up on the ID. Most large companies like that don't own the numbers they call from, or the call centers -- they outsource both inbound and outbound phone support and sales. Typically to multiple phone center companies at the same time, who all have to call "as" Comcast, and ramp up or scale down with more or less phone numbers as needed. They'll use autodialers too, with real people rather than recordings, to minimize the delay between one outbound call ending and there being another person for that now-available rep to talk to.

The ability to set caller-id is important. I was surprised by how easy it is. With the free X-Lite SIP softphone and a flowroute.com account, I can set an arbitrary caller-id number and place a call to anyone. This is very useful, as it lets me place cheap VoIP calls "from" my mobile phone number. It could also be used to get into voicemail and other systems that trust caller-id.

Businesses can detect your billing number, the ANI. Having been involved in a system where employees logged in and out of work via the telephone it was very important that we could prove where they were. We had many people attempt to spoof it which never worked.

So the information is there. However it is worth a lot of money to the phone company and they sometimes resell that information to others who repackage it. They also in turn don't always give you this information even when you pay for caller id which is similar but not the same. Originators can block paid caller id, I have never seen a case where you can block ANI subs

I was under the impression that ANI was forced on WATS lines, but that it didn't necessarily exist for residential, shall I shift my understanding? I think this could actually be a good lever, putting the problem purely into the policy domain.

In the good old ISDN/SS7, both the network-provided caller-id as well as the user-provided caller id are transported, even in case the caller wants to perform an anonymous call. Usually the last hop before delivering the call to the called party is responsible for removing the relevant information. In SIP, the same exists with From- and P-Asserted-Identity headers.

The SS7 interconnection partners usually go through extensive tests before allowing you to hand over signaling traffic via SS7, but this is not so much the case for SIP interconnects, where we're lacking a bit of clear standards (however working groups like http://www.sipforum.org/sipconnect exist and are taken more seriously nowadays).

If you are allowed to do "CLIP no screening" - which means you can set arbitrary caller ids in the user-provided part, the terminating system (the hop delivering it to the called party) is still able to check both fields, so this could be a way to pin down the real calling party, even if it "spoofs" its caller id.

It can still be sent in a sideband for reading by a third-party device, tantamount to a MAC address.

>phone numbers are as transient as IPs -- they can terminate to an IP phone in Pakistan one day, and to a Twilio gateway used by some other company's apps the next day. Blacklisting the number can be both ineffective and harmful.

Harmful to whom? Twilio?

Reply on news.ycombinator.com