41–50 of 164 posts
Easy solution: Assign all accounts a unique and randomly generated ID, and allow everyone to then use the handle they want. If someone wants to write a @handle in a post or a comment, a list shall appear, asking them to choose the account they wish to link to. IDs shall be public, and the list shall present itself as something like "@Max 36hf28bcd ; @Max 9jv1tcsh ; @Max b63avg960"
Absolutely hate any service that does this, and won't use them.
The common thread among most stories like this is the spoof-ability of phone numbers. Telecom companies must make changes to prevent this kind of spoofing. Honestly, I think if telecom companies could be sued for damages caused by this kind of thing (not to mention spam) then I think the problem would get solved very quickly. The only reason it hasn't been solved yet is most of the cost and pain is borne by others.
Traditional phone companies absolutely should do a better job vs spoofing (and I believe there is supposed to be at least some progress there via STIR/SHAKEN in the US at least), but I'm a lot more inclined to blame services and particularly armed response services that still treat them as secure in a way they have long long LOOONNNGGG since proven they aren't. Telephone numbers simply were never ever a particularly secure thing, predate the entire net let alone widespread use of cryptographic protocols, and retrofitting real security onto that legacy has proven non-trivial. They shouldn't be blindly depended on for something like SWAT deployment. Security services live in a world where they can be lied to and they act like it in other circumstances. They're the ones sanctioned by the state to responsibly employ lethal force, and have been given ludicrous amounts of outright military grade gear. They should be investing in tools and techniques to evaluate reports and gather intel on site before "storming the house". Even basic old humint like "asking the neighbors if they heard any shots" seems to have been tossed aside. Like take this very reported case:
>The caller told the dispatcher he had killed his girlfriend. He had barricaded himself inside his home in a quiet, affluent neighborhood on the eastern edge of Palo Alto.
OK, so maybe there is a criminal there, but by his own (suspicious) words nobody is in any immediate danger. The supposed body he's killed isn't going anywhere. Surround the place from a distance, sure, and if someone does start shooting from the house obviously that's clear enough. But if the police have the place covered and nothing happens, maybe ask some neighbors. Send in a drone or two. Get on the line with a judge for a quick order to use IR or terahertz imaging or whatever and see if that reveals anything. Get a megaphone and ask everyone to "come out with their hands up" even! If the police though just go and storm the place though they could well cause the very situation they seek to avoid, what if someone is fast asleep and hears a break in and opens fire to defend themselves? Hardly an impossible thing particularly in America. It's happened.
Everyone in tech knows all about blindly trusting user input. Yes absolutely it'd be good to deal with trivial spoofing but that alone isn't going to mean there can't be malicious input. Or even non-"malicious" per se, there are people out there on bad trips or with untreated disorders who might report fake stuff fully believing it. The human mind is an imperfect thing. Stopping spoofing also won't stop someone from making a real call from a real phone that they've stolen or hacked into some business network and used their VoIP, calls from the victim's number could just as easily be calls from "a neighbor who heard shooting and saw flashes through the window" or "concerned passerby". E911 is supposed to have a variety of standards for including location information and in principle that should cut back on this as well, if someone claims to be in a house and the location doesn't show they're at the house that should be a red flag. But that still leaves holes due to legacy and risk aversion from bad incentives. At the end of the day, I think any service for the general public needs to be careful about considering their inputs. Ask for money upfront for that pizza for the first order. Trust but verify and all that.
Edit: One useful thing the government could perhaps provide here would be something along the lines of a national "known harassed number(s) registry", where someone could report getting this kind of thing at their local police station in person, show proof of identity, and ask for their number to be flagged for a year along with a code word. Any future 911 calls could automatically be flagged in turn, the operator could ask for the code word, or at least let responders know that there was a history of spoofing and everyone should be extra careful.
I remember getting a demand I surrender my HoTMaiL address to somebody in a very threatening email to my address way back in 1998. It was kind of surreal back then as the internet was still fresh. Nowadays the closest I've gotten to this is the people who keep using my Gmail address as their own email address. I find this behavior rather bizarre and don't know what it achieves.
It shouldn't be this easy to use someone else's email address.
Darknet diaries has done a few recent episodes on this topic. Episode 106 is about account handles told from the perspective of the victims, and it is quite sobering. Episode 112 is long interview with an individual who had hacked handles, and it has a look into sim-swapping and some of the tactics around that. Highly recommend ep112.
I remember getting a demand I surrender my HoTMaiL address to somebody in a very threatening email to my address way back in 1998. It was kind of surreal back then as the internet was still fresh. Nowadays the closest I've gotten to this is the people who keep using my Gmail address as their own email address. I find this behavior rather bizarre and don't know what it achieves.
Likewise I have no fewer than three people trying to use a gmail address I've had since 2003 as their own. It's extremely frustrating - one even sent me $45,000 in a mistaken paypal transfer and then when I reversed the charges I was hit with an overdraft since I had made a Paypal purchase (which would ordinarily come from my direct bank funds) not knowing the money had been sent to me in error. It shouldn't be this…
I remember getting a demand I surrender my HoTMaiL address to somebody in a very threatening email to my address way back in 1998. It was kind of surreal back then as the internet was still fresh. Nowadays the closest I've gotten to this is the people who keep using my Gmail address as their own email address. I find this behavior rather bizarre and don't know what it achieves.
Likewise I have no fewer than three people trying to use a gmail address I've had since 2003 as their own. It's extremely frustrating - one even sent me $45,000 in a mistaken paypal transfer and then when I reversed the charges I was hit with an overdraft since I had made a Paypal purchase (which would ordinarily come from my direct bank funds) not knowing the money had been sent to me in error. It shouldn't be this…
Ask me how I know :( PP money was not recoverable that one time my ex sent it to the wrong email address.
Easy solution: Assign all accounts a unique and randomly generated ID, and allow everyone to then use the handle they want. If someone wants to write a @handle in a post or a comment, a list shall appear, asking them to choose the account they wish to link to. IDs shall be public, and the list shall present itself as something like "@Max 36hf28bcd ; @Max 9jv1tcsh ; @Max b63avg960"
It turns out that cryptographic gobblediguuk is difficult for humans to understand. Even if your conscious mind knows it's a meaningless jumble of characters, your visual processing system evolved over millenia and honed with decades of schooling to read text fast is automatically failing to parse it in your visual field. So your users will self-train to ignore them. A solution is to display the random nonsense as a…
2. User is free to change avatar and username, except there must be no visually similar avatar-username combinations across userbase. The restriction is enforced any time the user changes avatar or username.
3. System ID is shown to screen readers in place of avatar.
4. Whenever user interacts with another, if they have not communicated before, profile image or system ID is made more prominent for validation.
Earlier quoted context omitted.
Likewise I have no fewer than three people trying to use a gmail address I've had since 2003 as their own. It's extremely frustrating - one even sent me $45,000 in a mistaken paypal transfer and then when I reversed the charges I was hit with an overdraft since I had made a Paypal purchase (which would ordinarily come from my direct bank funds) not knowing the money had been sent to me in error. It shouldn't be this…
That was nice of you, you probably could've kept the money and there isn't much they could've done. Ask me how I know :( PP money was not recoverable that one time my ex sent it to the wrong email address.
I can't imagine these people are that untraceable. If they are dumb enough to reach out to the victims, finding them should be doable with a bit of luck.
I think one of the issues is spoofing numbers is still not prevented by the miserable US telecoms. That allows these people to spoof calls and swat the target, worst case.