Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FCC will require phone carriers to authenticate calls by June 2021 [pdf]

docs.fcc.gov

Post reply on HN
Print view View original

321–330 of 352 posts

Re: FCC will require phone carriers to authenticate calls by June 2021 [pdf]

#321

Post by equalsione »

ugh123 wrote: post #166

I didn't see anything in there about penalties for carriers not enforcing this. Also willing to bet they beg for extensions claiming they're not ready - or too costly to implement.

New legisation is being enacted around this on an ongoing basise: e.g H.R. 4998 was introduced about two weeks ago

All the major carriers are implementing a STIR/SHAKEN strategy that should be in effect by next year. But it is complicated to do and there may still be problems when they do - as others have explained here it's not as simple as it first appears.

I don't have any sympathy for the operators in this. They've profited from this for long enough and ignored the problem. There's a lot of pressure on them to solve it and the impression I have is that there's no appetite for "the dog ate my homework" excuses from regulators so let's see.

Re: FCC will require phone carriers to authenticate calls by June 2021 [pdf]

#322

Post by darkarmani »

cletus wrote: post #184

Good. But really, why did this take this long? It should be relatively easy to identify the bad actors here and I don't mean the spammers, I mean the telcos that make this possible, deliberately so, by essentially "laundering" spam calls. My response to picking up a number is to answer the call and say nothing. Auto-dial systems will route the call to a person when they get a "live" response. I don't know the criteri…

> My response to picking up a number is to answer the call and say nothing. Auto-dial systems will route the call to a person when they get a "live" response. I don't know the criteria but I'm pretty sure it's them detecting noise on the call (which could be voicemail).

I do the same thing. I moved and my old number is forwarded through google voice. Everytime i get a call from my old area code I know it is a neighbor spam call as no one calls me from that area code anymore.

It's gotten so bad i let my calls go to voicemail now.

Re: FCC will require phone carriers to authenticate calls by June 2021 [pdf]

#323

Post by darkarmani »

readme wrote: post #232
nimish wrote: post #210

Earlier quoted context omitted.

It took this long because the fcc is run by people who simply do not believe in using government to enforce oversight.

We shouldn't interfere in the free market. Those robocalls are just good old American ingenuity.

I agree. Free the telcos to strictly requiring authenticated calls, so i can freely choose to ignore some calls.

Re: FCC will require phone carriers to authenticate calls by June 2021 [pdf]

#324

Post by throwaway894345 »

michaelbuckbee wrote: post #42
throwaway894345 wrote: post #39

Earlier quoted context omitted.

What solutions does Europe, etc have that the US doesn't? Genuine question.

A working legislature?

Clever. What solutions has said legislature come up?

Re: FCC will require phone carriers to authenticate calls by June 2021 [pdf]

#325

Post by chrisfinazzo »

dantheman wrote: post #258
chrisfinazzo wrote: post #255

Earlier quoted context omitted.

Ahem. "An independent U.S. government agency overseen by Congress, the commission is the United States' primary authority for communications law, regulation and technological innovation." Source: https://www.fcc.gov/about-fcc/what-we-do You can have arguments until forever about what they should or shouldn't do, but their raison d'être is to set policy according to these overarching objectives. Oh, and just to be cle…

Ahem, the authority comes from Title 2 passed in 1934. In 2005, the FCC decided that ISPs should be regulated by them. From 2005 - 2012, Congress failed to pass new bills granting the FCC this authority. It was denied by congress. In 2015, the FCC decided that they didn't congress to grant that authority. So yeah, the FCC website claiming they have an authority is not an impartial source. Two years later, the FCC rev…

Seriously, read this - you'll learn something.

https://www.rpc.senate.gov/policy-papers/why-title-ii-is-not...

The GOP lays out an obviously slanted view about why they are opposed to the "utility-style" regulation that Title II entails.

However, this assumes that the market is functional when it's been clear since the '96 Telecom Act that it has been anything but. The idea that the FCC can't claim this authority without Congress acting first is FUBAR.

From pricing (generally higher for lower speed) to barriers to entry (the upfront cost for infrastructure is enormous), time has shown that carriers and ISPs will refuse to behave unless they are forced to.

Legislation is needed, but Republican arguments that a light touch will "preserve innovation" or some other nonsense doesn't work. 1993 was a long time ago and almost anyone who cares about this issue will tell you that Internet access is a utility (essential service, widely available, for reasonable cost) but the incumbent providers don't act like one.

(Save for maybe Google/WebPass, Sonic, and any number of municipal broadband initiatives)

Re: FCC will require phone carriers to authenticate calls by June 2021 [pdf]

#326

Post by spartas »

IgorPartola wrote: post #310
m101 wrote: post #285

Earlier quoted context omitted.

My strategy has been to do the exact opposite. I've claimed to have had the accident, spoken to the real person, asked them to hold the line whilst I finish something off some "urgent" work, received the follow up call after they hang up and asked them to call me back in a couple hours, again kept them waiting a few minutes. It really wastes their time and turns me in to an expensive call for them. Yes, it's wasted m…

I employ one of two strategies. Either I answer with “911. What’s the location of your emergency?” or similar. If it’s a live person calling it usually gets them nice and confused. I then get to yell at them for calling an emergency line. My favorite was the guy I talked to when I pretended to be “Shepard Sharp, deputy director of the NSA”. “How did you get this unlisted number? Where are you located, we are dispatch…

https://donotpay.com is an automated service that will collect the information you obtain from illegal robocallers and allow you to craft a demand letter.

Source: I've sent demand letters to vehicle extended-warranty robocallers using DoNotPay

Re: FCC will require phone carriers to authenticate calls by June 2021 [pdf]

#327

Post by gouggoug »

frereubu wrote: post #291
m101 wrote: post #285

Earlier quoted context omitted.

My strategy has been to do the exact opposite. I've claimed to have had the accident, spoken to the real person, asked them to hold the line whilst I finish something off some "urgent" work, received the follow up call after they hang up and asked them to call me back in a couple hours, again kept them waiting a few minutes. It really wastes their time and turns me in to an expensive call for them. Yes, it's wasted m…

A friend of mine used to actively enjoy doing this. Most of the calls he got were of the "we hear you've had an accident" variety, and he would start with a generic story about something like a car accident. The story would slowly get more and more bizarre until he's eventually telling them a story like how he hit a lorry full of miniature circus animals, with loads of tiny tigers and giraffes bouncing off his windsc…

I did something similar to this a while ago, but the scam was happening via text messages.

I spent a full weekend texting back and forth with the scammer.

Although I never went as far as your lorry of circus animals, I did give _many_ hints to him that he was being played with.

Now, the more interesting part is that I was particularly fed with scammers and wanted to see if I could out scam one, which I did.

On the Monday after that weekend, I managed to get my scammers to provide me with his bank account username and password.

Once I got this information, I checked that they were correct credentials and stopped all and every contact. I also did nothing with it as I didn't want to myself be on the wrong side of the law, nor did I want to mess too much with a scammer and get myself in trouble.

Re: FCC will require phone carriers to authenticate calls by June 2021 [pdf]

#328

Post by plandis »

webkike wrote: post #2

If you’re wondering if STIR/SHAKEN was a James Bond reference, the answer is yes, and SHAKEN stands for “Signature-based Handling of Asserted information using toKENs”

Really missed out on the opportunity to have STIR/SHAT

Re: FCC will require phone carriers to authenticate calls by June 2021 [pdf]

#329

Post by vel0city »

dantheman wrote: post #240
chrisfinazzo wrote: post #233

Earlier quoted context omitted.

Well, actually... That kinda/sorta was the mandate, until we put a telecom shill in charge. https://en.wikipedia.org/wiki/FCC_Open_Internet_Order_2010

Where did congress grant the FCC the authorities for that order?

It was granted in the Telecommunications Act of 1934.

https://en.wikipedia.org/wiki/Communications_Act_of_1934

Re: FCC will require phone carriers to authenticate calls by June 2021 [pdf]

#330

Post by PeterisP »

kube-system wrote: post #109
StavrosK wrote: post #61

Earlier quoted context omitted.

Same in Greece, I think it's EU-wide. When you tell a spammer you're registered in our do-not-call registry, they get scared pretty quickly and swear they'll never call again. They usually don't.

The US has had a do-not-call registry for 17 years. It still doesn't deter spammers who are not subject to US law. Back in the early 2000's I remember doing the same thing you're describing: startling spammers by telling them that I was on the list. But today, the people calling don't care because they aren't inside of the US.

This is what anti-spoofing is for - it's trivial to deny calls from India or Russia or whatever if you're not doing any business there, the problem is that currently they're spoofing a local number.

If you're being called from a local number, then this should mean (and outside of USA actually means) that there's somebody who's subject to local law and fully responsible for ensuring that the spam laws are met. If you're a telecoms operator sending in calls to the nework, then you ensure that the fines get paid - the spammers are, naturally, liable, but if you enable access to scammers in an unreachable jurisdiction or insolvent shell companies, well, it's coming out of your pocket and it's your problem on how to recover these losses. In USA, however, telecoms who specialize in providing such access to phone spammers have a legal and profitable business model. This needs to change.

Post reply on HN