Live data from Hacker News

Show HN: Phone verification at no cost

github.com

61–64 of 64 posts

Re: Show HN: Phone verification at no cost

#61

Earlier quoted context omitted.

This is also a fun attack. Find a provider that does this. Request to port a target number (a bank or an escort service or whatever). Port will stall for a bit, in the mean time, the service provider activates your number internally, so their own dialers route to their "version" of the number. Now you get all the calls from that provider to that number. Forward them to the actual destination (using an unrelated provi…

This assumes that the caller id has anything to do with how the calls are routed.

Sure. Just sometimes, they accomplish that by adding the number into their internal inventory as if it already had ported.

Re: Show HN: Phone verification at no cost

#62

Earlier quoted context omitted.

Similar to Twitter's Digits, which has been around for a while and seems quite popular. https://get.digits.com

Why is it free?

Twitter built fabric and it's free because they say "they want more developers using their platform" to help them with building apps

Re: Show HN: Phone verification at no cost

#63
post #27

Earlier quoted context omitted.

>"Caller ID" isn't the "source of the message", just some data transmitted along with the ringing sound, and as you can see the circuit doesn't have a globally unique identifier. // The companies could enforce the side channel info as the actual call origin, but they don't want to. Just like snail-mail spammers they're paying more money than residential customers will pay to require that info. It's broken because it…

That you say it easily doesn't mean that it's easy to do. The current telephone infrastructure wasn't designed. It grew: Verifying a call would involve either tying up an additional channel back (doubling the cost of the infrastructure), or replacing (parts of) the infrastructure with something better designed- like a TTL "ping" packet going backwards to verify the route on the original channel. Getting everyone to c…

>Verifying a call would involve //

I'm not specifically wanting call verification I'm wanting them to detail origin if they have it (they can use the callerID field to forward that information to me) or to refuse to route calls that are clearly spoofed. If the callerID is 0 then the phone company knows it's spoofed and can block it, but they don't get paid for that - that's the only reason I can come up with for them to forward calls that have certain incorrect origin information. At least when I look at the callerID display and it says my number I know that it's not possible that call is anything other than spam - why would a company choose to forward such calls if not for the money they get for doing so?

>You can ask the phone company to research the calls made to your number at a specific time, and in the process of reconciling billing //

Are you telling me that at the point the company decides to carry a call from an external source they don't know if they're going to be able to bill that company for the call? Surely they know the network origin of the call - they at least know the hard infrastructure it's arrived at their periphery from, they have to right?

So when I get a foreign call centre spammer on the line the company knows at the very least that was forwarded to them from, let's say, France Telcom [made up example] and could give me that info in the callerID field.

Re: Show HN: Phone verification at no cost

#64
post #27

Earlier quoted context omitted.

That you say it easily doesn't mean that it's easy to do. The current telephone infrastructure wasn't designed. It grew: Verifying a call would involve either tying up an additional channel back (doubling the cost of the infrastructure), or replacing (parts of) the infrastructure with something better designed- like a TTL "ping" packet going backwards to verify the route on the original channel. Getting everyone to c…

>Verifying a call would involve // I'm not specifically wanting call verification I'm wanting them to detail origin if they have it (they can use the callerID field to forward that information to me) or to refuse to route calls that are clearly spoofed. If the callerID is 0 then the phone company knows it's spoofed and can block it, but they don't get paid for that - that's the only reason I can come up with for them…

> I'm not specifically wanting call verification I'm wanting them to detail origin if they have it (they can use the callerID field to forward that information to me) or to refuse to route calls that are clearly spoofed.

The phone company that provides you service simply does not have this information at the time of the call. They only know for certain who to bill. Changing this requires replacing a lot of deployed equipment.

Furthermore, it is already illegal to spoof caller ID in the USA[1], and the UK[2] and elsewhere.

You can indeed tell your phone company to reject calls without caller ID, and indeed from various switches. If one gets through, you will need to note the time that you received the call and file charges with the authorities.

The phone company will then research the call, and produce for law enforcement who in fact made the call.

> If the callerID is 0 then the phone company knows it's spoofed and can block it, but they don't get paid for that

You are confused: The callerID field (aka "presentation number" in the UK) is in-band and transmitted by the calling station, the billing field is out-of-band and transmitted by the receiving station's "next hop". It is also not normally presented to the callee, although with a special kind of connection you can receive it.

> when I look at the callerID display and it says my number I know that it's not possible

You should contact law enforcement. This is a crime.

> Are you telling me that at the point the company decides to carry a call from an external source they don't know if they're going to be able to bill that company for the call?

Yes.

Your phone company doesn't bill the caller. They only bill the other phone company that handed them the call.

> Surely they know the network origin of the call

The "network origin of the call" as you put it, is the phone company that handed them the call. It is not the person who dialled the number.

Even if all of the phone companies are really one (limited) company, the individual switching offices don't send this information down with the call for efficiency reasons.

> So when I get a foreign call centre spammer on the line the company knows at the very least that was forwarded to them from, let's say, France Telcom

No. "The company" only knows the company that switched them the call. It takes research to work out who actually made the call that is normally distributed by separate offices because it's more efficient.

[1]: https://en.wikipedia.org/wiki/Caller_ID_spoofing#United_Stat...

[2]: http://stakeholders.ofcom.org.uk/telecoms/policy/calling-lin...

Post reply on HN