Comment by hshdhdhj4444 | Hacker News Reader

Comment by hshdhdhj4444 | Hacker News Reader

Parent Full thread

Outside of the obvious, the tragedy of the young woman losing her life, the fact that the scammers likely will not be impacted at all, etc. a couple of other thoughts.

- It’s strange that we still haven’t setup any sort of authenticated form of communication with official parties. Email/phone call scams have been around for a long time. They’re very easy to fall prey to. There’s no reason our phones shouldn’t be able to inform us that a certain number is officially from the IRS, Cops, Verizon, etc.

- This is a form of Swatting. Delivery companies, and also the police, etc need to do better in ensuring the people demanding services are where they’re demanding the service and/or the person who lives there is aware and genuinely needs to be visited. - We need a bit of a broken windows policing for online/digital scams. The reason they are blowing up is there is hardly a risk of being caught. And the cost/benefit analysis probably suggests that th police really shouldn’t be involved in most of the individual cases or expend too many resources. However, this blows up the number of cases so the aggregate cost does indeed grow too high. So there needs to be an effort to prosecute and expend resources even on low level cases so the criminals get the message that they’re not gonna get away with it.

Phone scams shouldn’t even be a thing. Every phone number has to be registered to a company. Simply hold those companies to account for all crimes committed using them.

If you sell numbers to Indian scammers, then you take the hit for all the scams, because why are you selling phone numbers to scammers?

> It’s strange that we still haven’t setup any sort of authenticated form of communication with official parties.

My alarm company had me come up with challenge and response words. Yet when they call they want me to say my word first. Like how do I know they are who they say they are? Caller ID can easily be spoofed.

So so much for that idea...

The security model here is different than usual. The goal of the challenge is to authenticate you to them - in case they are calling a landline, or a left-at-home mobile phone that the burglar is now answering. So this actually makes sense.

If they call, you say you word, then they can't authenticate themselves to you, it seems like you must then change your word.

For active man-in-the-middle, I don't think this protocol is designed to protect against that.

We need a high trust society.

Everything else is band aids on a broken one.

Cah you clarify the mechanisms by which a high trust society reduces the incidence of scams/becoming victims to scams?

A high trust society reduces the incidence of scams/becoming victims to scams by reducing the number of scammers and increasing the number of honest people and honest behavior. That's what a high trust society is and does by definition.

If you want "mechanics", that would be an increased focus on community, with positive community best-behavior incentives (reputation, pride in work, solidarity, rewarding good behavior) and negative ones (shame, ostracism, punishing bad actors), social cohesion, and an emphasis on duty and morality, while reducing cynicism, and selfish individualism. This includes the appropriate role models and media/entertainment landscape.

> A high trust society reduces the incidence of scams/becoming victims to scams by reducing the number of scammers and increasing the number of honest people and honest behavior.

Considering that the scammers in this instance haven't been identified, there's a good possibility that the phone scammers belong to an out-group (e.g. infamous Indian/Nigerian scammers) of the victim's society. In fact, it seems to me that trusting more (because the in-group are honest) without appropriate safeguards preventing out-group members from impersonating in-group members exacerbates the problem. So I do not really see the connection between your solution and the problem.

Agreed. We (meaning the United States) used to have this for the most part. It doesn't scale to mediate all human interactions with authentication/authorization.

Trust seems to decline specifically because we seek to replace it with alternative systems.

In re your first point, it's tricky because the advice is to call them back on the publicly available number. Problem is, I know somebody who fell for a SEO hijack and called a fake number. Not everybody knows how to spot a scam. The guy here did though, and he used my techniques (ask questions they'd know the answer to). He knew he was getting scammed. I think it was just an emotional override with weighing the risks. This one is very different than a call saying the IRS wants Google Play gift cards or whatever. Especially with the scammers having the woman actually show up. That's next level in all the wrong ways

You didn't say, and I wouldn't want to assume the situation, but calling the number on the back of a bank or credit card would work better here (in case it was a bank). This is also an argument in favour of paper bills, or logging in to a customer portal as a best-of-the-worst option

Correct. We all told the person after that they should've called the number from previous communications. But there's so much diligence that's needed in these stressful times and it only takes one mistake to get fooled. Wasn't nearly as bad as this though...

> It’s strange that we still haven’t setup any sort of authenticated form of communication with official parties

Because this would add compliance and regulatory overhead which the Telco industry has lobbied against, and activist organizations like the EFF will screetch muh liberties while taking donations from those very companies, and HNers will dutifully complain about the descent into authoritarianism.

Additionally, a large portion of smaller essentially fly-by-night VoIP vendors and MSPs have an incentive to not ask questions about who is purchasing their services despite attempts at regulation by the FCC [0].

[0] - https://docs.fcc.gov/public/attachments/DA-24-1235A1.pdf

Reply on news.ycombinator.com