Hacker News Reader

Comment by wtallis | Hacker News Reader

I've been wondering increasingly often over the past few years why we tolerate a phone network that allows for caller ID spoofing. I don't see how a system analogous to BCP38 would have any significant downsides, and there's a huge demand for anything that stems the rising tide of fraudulent robocalls.

View on HN

There are significant downsides to technically prohibiting caller ID spoofing. First, you would no longer be able to preserve caller ID when forwarding calls. Consider how much less useful Google Voice would have been if you couldn't see the caller ID of calls forwarded to you. Second, in VoIP, outgoing calls (termination) and incoming calls (origination) are completely decoupled services. This is really nice because it enhances reliability (you can fail over to different termination provider) and reduces costs (you can route outgoing calls to the cheapest provider depending on the destination). A BCP38-style system would require you to purchase your termination from the same provider as your origination in order to have outgoing caller ID.

I think the idea is that caller ID forwarding should be implemented in some authenticated or verifiable way. I hesitate to call credential forwarding a solved problem, but surely a modern protocol design could do a lot better than the current free-for-all, I-am-who-I-say-I-am system.

Maybe something like DMARC but for phone numbers, you should be able to set your phone number to be rejected if it is spoofed.

As a Google Voice user, the downside would be sad but totally worth it if it meant I could have GV accurately screen my calls. I could still get full caller ID information for GV calls received through VoIP, and when receiving calls through POTS I could at least know that the call is from somebody I'm willing to take calls from.

The other use case applies pretty much only to people I don't want to hear from in the first place, so I have no sympathy for how it would hurt their bottom line.

It sounds like the list of people you're willing to receive calls from is pretty small. Have you ever actually received a phone call which spoofed the caller ID of someone you know? I haven't - all the spoofed calls I receive are from numbers I usually wouldn't answer anyways since I don't recognize them.

Also, note that Google Voice no doubt uses many termination providers (considering they're giving the service away for free, they'll need some pretty sophisticated routing to take advantage of cheap rates), so the second use case applies to any Google Voice user.

Why can't we have a system whereby Google is required to prove to each of their termination providers that they legitimately own and control my GV number, and thus all of those providers can assure my outgoing GV calls have valid caller ID data? I don't see where it should matter whether calls into my number take a potentially different route from calls from my number.

Agreed.

And it isn't even just fraud. Charities and marketing companies also fake/alter the caller ID.

I will say that a lot of IP<->phone networks terminate on numbers which look like local residential numbers, so even if caller ID could not be faked, they would just not put a caller ID in at all and let it resolve to the local area code number.

Unfortunately there might be no "good" answer to fraud. Maybe some kind of reporting service?

The use case for caller id spoofing is when the callback number is different than the number you are calling from, most commonly to present a generic (possibly toll free) customer service number when an agent who might not even have a DID number makes an outbound call. Large operations might also have trunks from multiple carriers for redundancy, so simple ingress filtering is not necessarily viable.

Ingress filtering is totally viable. A telco should strip any caller ID information that is not coming from a trusted source. If a customer operating a call center wants to spoof caller ID they have to prove to their provider that they own the one number they're spoofing. Caller ID from shady telcos should be removed and customers given the option of not receiving such calls. None of those rules are at all difficult to implement.

It really isn't a big deal though, CID/ANI should never be trusted to identify the caller anyway.

Not being able to identify the caller means I can't report it to the FTC for spamming me with "you've been approved for a $250k business loan!" and "this is cardmembers services for both Visa and Mastercard" scams.

Why should FTC be able to help you? Phones work internationally.

The FTC handles complaints for the US Do Not Call blocklist.

https://complaints.donotcall.gov/complaint/complaintcheck.as...

If someone wants to spend the money to dial me internationally just to try and pretend they're my credit card company, they're welcome to waste it.

Bulk international dialing is pretty much just as expensive as local dialing. (Essentially free)

That's only because we let that system be gamed. It doesn't have to be that way. Telcos always know who they're billing for a call; they have the capability to make caller ID reliable.

That's not true. Phone companies have to pay fees when they have to pass a phone call through their telco to another. They have entire routing table fees involved and the telcos will pass traffic through the cheapest routes. That's why a call route can go through one set of routing in the morning but by the evening it can go a completely different way, it's cheaper the second time around. The fees are constantly changing. From a receiving telco side, they receive an incoming call that's identified themselves as Telco1, which matches the routing tables. The problem is the telcos rely on an honor system when they self identify.(I don't know when this started, it was in place when I worked in telco and everyone I knew at retirement age said it had always been that way for them.) And then we have telcos that go even further and completely avoid identification altogether. Which is sleazy but happens very often. The incoming telcos then are faced with either denying the incoming calls altogether (but then it's the callers that suffer -but it would force the telco trying to pass traffic for free, to either identify themselves or find another route) or risking passing that traffic and not being paid for it. If it's low enough traffic, it's probably easier just to let the calls through without knowing who to charge, so that telco got their calls passed for free. It was a constant game for us to deny traffic and keeping up with the routing tables.

tldr: The technology isn't the only thing that's over 100 years old, the business practices are also extremely broken too. And telcos are not an honest bunch.

A good handful of the larger telcos don't bother with least cost routing tables, and will instead just send all their domestic traffic straight through their own networks. The route quality tends to be much higher when they do that.

I don't think you've seen the systems they use in developing countries. Phone networks are almost a century behind the internet. It's not something that's easy to fix, nor are there too many situations where you would need to rely on the CID to identify the caller.

You're still using the circular logic of insisting that caller ID can't be trusted because it shouldn't be trusted because it can't be trusted. I and most people who want to not get robocalls want a caller ID system that is trustworthy, and the first-world telcos we're doing business with are totally capable of providing a service that is at least partly trustworthy. I'm not interested in receiving calls from third-world countries and would be perfectly happy only getting calls from those using providers that provide for trustworthy caller ID, but nobody's even offering to sell me such a service.

You're not talking about Caller IDs here though, you're talking about some completely new technology that'd require a complete rework of current telephony systems.

If you're worried about someone spoofing the source of their call you should probably consider using SIP over TCP, although it is unlikely that rest of the world is going to follow suit any time soon.

And no, first-world telcos wouldn't be capable of providing what you want without massive overhauls either... Nor would they want to since there's a plenty of business critical applications that depend on this behavior.

Caller ID is what describes what I want, and the current methods for delivering caller ID info to the recipient of a call would not need to change. The telcos may have to invent a new term for how they handle things behind the scenes, but it would be transparent to me except that I'd now have a way to stop the robocalls.

I highly doubt that it would be hard for telcos to implement such a system. I have no doubt that they don't want to, as evidenced by their decision not to in the face of strong demand. I can certainly understand that they might have lots of businesses interested in preventing such a change, but I'm not aware of how legitimate businesses would be harmed. All they need to do is ensure that when they call me they deliver caller ID information that corresponds to a real number that can be used to identify them to the FTC when I file my complaints.

I completely agree. You have to look at features like CID for what they were intended. CID was just a good sales pitch. It was never intended to be a reliable way to identify a call, it was a perk for those that could afford it in an era when the phone ringing meant you had no idea who was on the other end until you picked up.

Reply on news.ycombinator.com