News for hackers. Stuff that matters.
Re:Verified by Twilio by HugoHobling on Thursday August 29, 2019 @11:34PM (#20835778)
I know it's overkill, but this is my current setup for my phone numbers. I treat phone numbers the same way I do my email address: I use different numbers for different purposes.

1. I have a "clean" phone number I only share with friends/family. Certain prefixes and phone number actually receive next to zero spam calls. This number has received 2 calls in the years I've had it.

2. I have a phone number I share with companies / loyalty programs / etc.

3. I have a legacy phone number I've had for 10 years that receives multiple spam calls daily. For this number I've set up an incoming handler that uses Google Cloud to ask the caller a simple question (What is five plus two?), parses with the Speech Recognition API, and forwards calls with the correct answer. The rest go to voicemail. It's better to use the speech recognition API than it is to ask the caller to press a DTMF tone, in case they are in a car or are calling from a device without a telephone keypad. If I every need to, I'll add this protection to use numbers 1) and 2).

4. I have a number that rings straight to voicemail.

All numbers use the Whitepages and Nomorobo APIs from Twilio. These score the "spamminess" of calls. Calls with sufficiently high values are forwarded to voicemail.

For incoming calls, I set the caller ID for the calls to my SIP clients to indicate which number is being called, and include the spam score.

Re:Verified by Twilio by lysp on Thursday August 29, 2019 @11:52PM (#20835851)
When I was younger I used to work for a market research company doing surveys over the phone.

The way their process worked was:

* Big company wanted a survey completed. * Big company would want it targeted to a specific state/regional area, so would provide a list of post/zip codes.

* Survey company would translate the list of codes into phone prefixes for each area.

* Computer would randomly generate phone numbers in the area - starting from xxxx 0000 through to xxxx 9999 for operators to call.

That meant you'd get disconnected numbers, businesses, private/silent numbers, faxes, modems, etc.

So having a "clean" number didn't protect you. While a few projects were targeted to specific people/numbers - most were just random.

Re:Verified by Twilio by k__ on Friday August 30, 2019 @09:32AM (#20838397)
In some countries it's illegal for companies to call random people, they need to gather opt-ins from all people they wanna call.
Re:Verified by Twilio by chabes on Friday August 30, 2019 @09:37AM (#20838452)
It doesn’t seem like it’s being enforced in the US, currently..
Re:Verified by Twilio by fjp on Friday August 30, 2019 @10:59AM (#20839244)
They actually do try to enforce it, but right now it's a losing battle. You can spin up a new voip company and start blasting scam calls from an overseas call center in a weekend, then spin that company down before anyone has any idea who you are.

Customers complain to carriers, who then either get the offending voip provider to block the scamming customer, or just threaten FCC action. But the whole cycle is so slow and you're fighting a never-ending shapeless horde.

I think STIR/SHAKEN will help with this if it ever gets fully implemented and enforced, and voip providers are always trying to come up with better fraud detection to avoid the man-hours associated with assuaging carrier concerns, blocking the customers, etc, etc.

Re:Verified by Twilio by jdc on Friday August 30, 2019 @01:00PM (#20840366)
Here's a kind of adversarial test of that hypothesis:

1. Spin up new voip company

2. Issue death threat to US President (or similarly powerful man)

3. Spin down voip company

4. Wait to see if/when someone finds out who you are

Re:Verified by Twilio by zbentley on Sunday September 01, 2019 @11:49AM (#20852883)
How is that a test of GP's hypothesis? Their claim was about commercial spam or scam calls, not potentially felonious threats.
Re:Verified by Twilio by jdc on Sunday September 01, 2019 @03:08PM (#20854094)
It seems to me the claim is that identifying VOIP subscribers is not feasible.
Re:Verified by Twilio by zbentley on Monday September 02, 2019 @09:35AM (#20859031)
Feasible (as in practical in general to identify spammers/scammers) and possible (as in "could a concerted legal effort identify a single caller who made a threat against an official?") aren't the same thing.
Re:Verified by Twilio by jdc on Monday September 02, 2019 @01:19PM (#20860512)
Absolutely. So now that we've established the possibility, the question is, why exactly is it infeasible to use our existing means to identify spammers. And what do we have to do make it feasible?
Re:Verified by Twilio by 0xJRS on Friday August 30, 2019 @10:26AM (#20838917)
And its working well, I only get 3-4 random calls a day instead of 5-6 now.
Re:Verified by Twilio by k__ on Friday August 30, 2019 @10:43AM (#20839090)
I only get 2-3 per month and they are from recruiters.
Re:Verified by Twilio by catacombs on Friday August 30, 2019 @06:50PM (#20843450)
> When I was younger I used to work for a market research company doing surveys over the phone.

Were you the one making calls? How did go through the randomly generated phone numbers?

Re:Verified by Twilio by waffle_ss on Friday August 30, 2019 @01:22AM (#20836130)
That sounds like a cool setup. I used to daydream about putting together a neat setup like that with Asterisk but over time I’ve actually regressed and even started giving out my direct cell number instead of my Google Voice.*

Having kids, buying a house/land, starting a business, contracting with services - every once in awhile I’ll get a high priority call that I really don’t want to be delayed (emergency at school or daycare, last minute problem with land/house offer, etc.). One time even my doggie daycare called because my dog had collapsed and they were doing CPR in the background and needed my consent to emergently administer epinephrine.

I also live in a rural area and I wonder if I tried to get a local business or contractor to return a call if they’d assume they had a wrong number if they called and a robot asked them to do a math problem. I know I’d not infrequently get confused voicemails with my Google Voice number (“Not sure I’ve got the right number but ...”).

So in the interest of not wanting to risk those rare important calls being delayed or blackholed I’m one of those luddite bozos who answers every call and has to deal with hanging up on the occasional spam call. :-)

* The other reasons I’m dropping Google Voice are 1) it seems like it noticeably affects call quality, at least in my area (particularly w.r.t. latency; I imagine there are fundamental round tripping issues since I’m in the midwest, and I’m sure the cell networks also have a lot to answer for here compounding the problem with the inherent latency of modern voice calls compared to the old POTS) and 2) I’m trying to get ahead of Google pulling the plug on the service and leaving me to track down and update phone number info everywhere and 3) not being able to do iOS stuff with other “blue text” phones (“call me on my other number in order to Facetime”)

Re:Verified by Twilio by ozmbie on Friday August 30, 2019 @12:41AM (#20836018)
Is this a uniquely American problem?

My Australian mobile phone receives maybe one spam call per year. It’s my single phone and I give out the number to various businesses and people.

Re:Verified by Twilio by giancarlostoro on Friday August 30, 2019 @07:34AM (#20837586)
It is an increasing problem. I've defaulted to never answering numbers I don't have saved unless I expect a call. If it's important they should leave a voicemail. I wanna say a few years ago it wasn't this bad, then I realized I had missed a lot of spam calls cause I had my number behind Google Voice (free with Sprint) and now it is just ridiculous.

Also idk about other states, but in FL everything is public record, so after I bought my house I've gotten spam letters and calls like crazy.

Re:Verified by Twilio by voltagex_ on Friday August 30, 2019 @01:36AM (#20836174)
This year I've been getting three types of spam calls (in Australia):

1. Spam call from new 03 8xxx xxxx range, I was sure these were VoIP numbers handed out by MyNetFone but haven't been able to prove anything. I can't remember what the content of the call was

2. International spam call from Mozambique (?). The call never connects if I pick up.

3. Private number, recorded voice in Mandarin. I think this is a tax scam.

I'm sure I'd seen some changes in the laws regarding caller ID this year, but I can't find it.

Yes, it's much, much worse in America.

Re:Verified by Twilio by Erwin on Friday August 30, 2019 @02:25AM (#20836341)
In Denmark, phone sales to consumers are generally illegal though strangely insurance and newspapers are excluded.

There's a national "do not call" list you can sign up to as well. This is amusing called the "Robinson List", presumably after Robinson Crusoe. The same concept is used in a dozen other countries.

I guess the penalties are severe enough that it generally only very shady people call, such as those pretending to be from Microsoft and calling to fix your computer.

Re:Verified by Twilio by squeaky-clean on Friday August 30, 2019 @10:48AM (#20839144)
It's also illegal in the USA, and we have our own national do not call list. The problem is the spammers are mostly using spoofed numbers (I get calls from my own phone number quite often) and are not actually physically located in the USA. It's difficult to prosecute some call-center warehouse located in Asia.
Re:Verified by Twilio by StavrosK on Friday August 30, 2019 @09:34AM (#20838415)
Rather off-topic, I was surprised by how readable this was to someone who doesn't speak a lick of Danish (me):

> Robinsonlisten er opkaldt efter Robinson Crusoe, som er en fiktiv person, der optræder i romanen Robinson Crusoe af Daniel Defoe. Han strander på en øde ø og lever isoleret.

Re:Verified by Twilio by mnbvkhgvmj on Friday August 30, 2019 @10:03AM (#20838677)
True but if a Danish person was to read this to you you would not even recognize the individual words...

https://www.youtube.com/watch?v=s-mOy8VUEBk

EDIT: Just FYI this is a clip from a Norwegian comedy program. Danish and Norwegian have very similar written languages but sound very different when spoken. In reality with some practice Danes, Swedes and Norwegians can speak together and understand one another.

Re:Verified by Twilio by paranoidrobot on Friday August 30, 2019 @01:12AM (#20836103)
It's primarily an American problem, but I've seen in the last year or two an uptick in certain kinds of Spammy activity to my Australian mobile number.

The most prominent type, and have appeared in the last two years are the one-ring-only calls from some foreign country. They're trying to get you to call back to some premium-rate number.

The second are SMS based random spam. Just an hour ago I got spam from "JbHiFi" (even though it's not them, I've never given JB my number) with phishing/spam "you won a contest". I also get random SMS spam from other sources.

Then again, if you have any kind of landline in a regional area you're going to get a ton of fake NBN/Telstra/ATO/etc scammers.

Re:Verified by Twilio by jlizzle30 on Friday August 30, 2019 @01:00AM (#20836074)
I think so. I never had this problem in Canada but it's been terrible since moving to the US.
Re:Verified by Twilio by _Codemonkeyism on Friday August 30, 2019 @02:20AM (#20836321)
Basically get no spam calls in Germany, sometimes from companies where I'm a customer.
Re:Verified by Twilio by 0xdeadb00f on Friday August 30, 2019 @01:16AM (#20836115)
I'm in Australia. I'd say I get between 5-10 spam calls a year.
Re:Verified by Twilio by ben509 on Friday August 30, 2019 @12:49PM (#20840253)
The downside of inventing it is the US has a massive amount of legacy in telephony that few other nations have to deal with. That opens up tremendous opportunities to break the system. But, hey, we get +1 as our international code, so there's that.
Re:Verified by Twilio by bradknowles on Friday August 30, 2019 @05:18PM (#20842808)
I use the Firewall app on iPhone.

All phone numbers in my Contacts app go into a whitelist that is maintained only locally on my phone.

When a call comes in, a notification gets fired off to the Firewall app, and it checks the number against the whitelist. If the number is on the whitelist, then it actually uses a functional replica of the iPhone Phone app UI to "ring" the call through.

If the incoming call is from a number not on my whitelist, then it checks the blacklist of known bad actors. If the caller is on the blacklist, then the call just gets blocked. I get a notification from Firewall that a call from a known bad actor was blocked.

If the incoming call is not on the whitelist or the blacklist, then it goes to voicemail, where it gets transcribed, and I get a notice that Firewall sent a call to voicemail.

I'm hoping that this is basically the same workflow we will see with iOS 13, just built into the basic iPhone Phone app. Then I should be able to stop using Firewall.

But I certainly don't need Nomorobo or any other such tool. Firewall solves all those problems, and does so better than any of the alternatives.

Re:Verified by Twilio by rsync on Friday August 30, 2019 @12:53AM (#20836052)
"2. I have a phone number I share with companies / loyalty programs / etc."

How does this one work and who provides this number ?

I ask because a twilio number is not a mobile number and therefore cannot receive 2FA from "short codes".

I am sure you know what I am talking about and have run into this ... so I ask, if you have a number that you give out to "companies" (as I also do) do you have a mobile number that can accept SMS from shortcodes ?

Re:Verified by Twilio by js2 on Friday August 30, 2019 @01:57AM (#20836258)
I don't have any trouble receiving SMS messages from short code senders to either my Google Voice or my VoIP number. Is this problem specific to Twilio?

Sometimes sites want to know my mobile provider (why does it matter?), so I just choose Verizon or Other.

The only site that won't accept my GV number is att.com. Oh the irony...

Re:Verified by Twilio by DuskStar on Friday August 30, 2019 @02:08AM (#20836286)
I find sites that won't accept my Google Voice number on a semi-regular basis. I think the most recent was Uber, which I discovered when moving phones a few months back.
Re:Verified by Twilio by js2 on Friday August 30, 2019 @02:23AM (#20836334)
I wonder if I have more success because my GV number was originally a cellular number (many many years ago). I've used it with Uber and Lyft successfully.
Re:Verified by Twilio by astura on Friday August 30, 2019 @08:56AM (#20838081)
Yeah, Uber blocked my GV number.
Re:Verified by Twilio by SomeOldThrow on Friday August 30, 2019 @09:53AM (#20838594)
It’s alright they just locked me out of my account when they transitioned away from email. I use lyft now. Then they did the same thing. When did technology get so shitty?
Re:Verified by Twilio by SomeOldThrow on Friday August 30, 2019 @09:52AM (#20838579)
What do you mean? You can filter by the number type in their api. They do offer mobile numbers.
Re:Verified by Twilio by rsync on Friday August 30, 2019 @12:12PM (#20839948)
No, they don't. There is a proper industry definition of what a "mobile" number is and only "mobile" numbers can accept SMS from shortcodes.

All of the 2FA from FANGs and banks and so on come from shortcodes so you can't do a lot of those 2FA workflows with a twilio number (or a number you port to twilio).

As per engineers at the Signal conference, there are no plans to make proper "mobile" numbers available at twilio.

Re:Verified by Twilio by SomeOldThrow on Friday August 30, 2019 @02:42PM (#20841338)
Ahh, receiving short codes is a niche I've not yet encountered, that makes sense.
Re:Verified by Twilio by dmix on Friday August 30, 2019 @03:15AM (#20836515)
Which SIP client do you use? I'm having trouble finding a good voip client. The telecom world is full of bad software with 1990s designs.

Endless confusing configuration forms with vague repetitive labels.

Re:Verified by Twilio by HugoHobling on Friday August 30, 2019 @08:52AM (#20838044)
I use Bria, and it's decent. It supports push notifications for calls, which is necessary on iOS. The app costs money, but comes with excellent support if you run into issues. There are free and open source apps, and the quality of these are hit and miss.

The push notification necessitates the app sharing SIP credentials with Counterpath (the company that makes Bria), so it's good to have some fraud protection for the extension in Asterisk in the event that Counterpath gets breached. They are a publicly traded company, so hopefully they have decent security.

Re:Verified by Twilio by xorcist on Friday August 30, 2019 @01:59PM (#20840930)
The one built into Android is basic but functional. It's a bit hidden in the user interface but here's how to configure it: https://support.google.com/phoneapp/answer/2811843

It's not useful over the open Internet but on a local WLAN or over a VPN call should work fine. Unless you use a damaged phone book storing SIP URLs for your regular contacts should work too. No messaging or fancy codecs though.

Re:Verified by Twilio by badrequest on Thursday August 29, 2019 @11:59PM (#20835879)
Out of curiosity, how much does this setup cost you to run per month? My main aversion to Twilio is their awkward pricing scheme.
Re:Verified by Twilio by HugoHobling on Friday August 30, 2019 @12:02AM (#20835885)
Hardly anything.

SIP calls through Twilio are $1/month plus $0.004 per minute for incoming calls. The spam scoring APIs are "costly", and maybe cost $0.01 combined per lookup.

Google Speech Recognition and TTS are virtually free for my use case. Asterisk can easily run on a $5/month VPS.

Re:Verified by Twilio by chrisbroadfoot on Thursday August 29, 2019 @11:47PM (#20835840)
Very cool. How do you route your legacy number? Did you port it to Twilio?
Re:Verified by Twilio by HugoHobling on Thursday August 29, 2019 @11:55PM (#20835860)
I ported the legacy number to another SIP provider. Twilio is still cheap ($1 a month or so per DID, plus $0.004 per minute), but other providers are less than half that. For that price difference, I had no reason to choose another provider so I mostly did that for fun and experimentation.
Re:Verified by Twilio by fortran77 on Friday August 30, 2019 @09:44AM (#20838515)
I provision fresh DIDs all the time from my VOIP vendor. Robocalls don't work off a list of numbers, they just call every number in order.

The best strategy -- get an area code that's not local and where you don't know anyone. That's what I have on my personal cell phone. Any call that comes in from that area code I know is spam. I don't answer it.

Re:Verified by Twilio by bradknowles on Friday August 30, 2019 @05:21PM (#20842835)
I am strongly inclined to switch over to using a 900 number as my official public number for everything. Anyone who really wants to call me can afford the small charge it would require.

Everyone else can just hang up.

Re:Verified by Twilio by underdown on Friday August 30, 2019 @10:43AM (#20839091)
Robocalls absolutely work off a list of numbers. Sure you could just load up a list of all numbers.
Re:Verified by Twilio by mttyng on Friday August 30, 2019 @01:57AM (#20836259)
How did you set this all up? It’s really interesting to me. Is there an article somewhere?
Re:Verified by Twilio by HugoHobling on Friday August 30, 2019 @08:54AM (#20838060)
I'm not aware of any documentation that's all in one place. It all uses basic Asterisk functionality with FAGI scripts to do anything with advanced logic.
Re:Verified by Twilio by mttyng on Friday August 30, 2019 @09:59AM (#20838646)
Is that via Twilio? Or something else?
Re:Verified by Twilio by HugoHobling on Friday August 30, 2019 @12:32PM (#20840120)
Twilio essentially provides the phone number. Calls to and from are sent over the internet using the SIP protcol. Twilio can talk to Asterisk or Freeswitch or any similar project. Asterisk has incredible customizability, so that's where I do everything.
Re:Verified by Twilio by soneca on Thursday August 29, 2019 @11:56PM (#20835862)
Impressive. But what's the need of number 4? Why not just give up that number?
Re:Verified by Twilio by HugoHobling on Thursday August 29, 2019 @11:57PM (#20835871)
I have a mobile phone, and don't want to use the carrier's voicemail. I use Asterisk instead, and also use Speech Recognition to get an email transcript of voicemails.
Re:Verified by Twilio by awwstn on Friday August 30, 2019 @11:55AM (#20839793)
Request for startup! I would happily pay $20/month for a service that makes it easy to replicate this setup.
Re:Verified by Twilio by HugoHobling on Friday August 30, 2019 @12:29PM (#20840097)
I can see the appeal of this, and have given some thought to it.

However American Telco regulations are a huge barrier to entry. There are various state and federal rules, so it wouldn't be an easy side project.

Re:Verified by Twilio by darynaop on Friday August 30, 2019 @06:18PM (#20843218)
Hey! We might be just what you're looking for :)

www.openphone.co

Happy to answer any questions and talk about my own setup!

Re:Verified by Twilio by doxavore on Friday August 30, 2019 @08:26PM (#20843908)
I'd be interested in hearing about other setups. I use GoDaddy's SmartLine today - could you speak to how openphone.co is different?
Re:Verified by Twilio by boring_twenties on Friday August 30, 2019 @02:21AM (#20836325)
Wow.

I've been praying for a Google Voice replacement for around a decade now, I guess this it it!

Re:Verified by Twilio by r_singh on Friday August 30, 2019 @02:26AM (#20836346)
https://www.openphone.co is a 2019 YC company trying to make a replacement.
Re:Verified by Twilio by shaklee3 on Friday August 30, 2019 @10:01AM (#20838665)
What's wrong with Google voice? Afaik it's not being deprecated.
Re:Verified by Twilio by boring_twenties on Saturday August 31, 2019 @10:33PM (#20850199)
AFAIK it isn't, but it's Google, so there's a 50/50 chance it could be deprecated tomorrow.

I'm dying to jump ship whether or not it's deprecated though, because the web and Android apps are just unbearably shitty.

The web app simply fails to keep up with my typing speed (I can't even imagine how they accomplish this), and the unread counts are usually incorrect.

The Android app doesn't even handle the compose SMS intent, so you can't use it as the default for outgoing messages... this was briefly fixed when they folded Voice into Hangouts, but then broken again 6 months later or so when they decided to roll that back.

Re:Verified by Twilio by boring_twenties on Sunday September 01, 2019 @07:55PM (#20855750)
Oof, I don't know how I forgot about this one, but attachments. I just got a "text/x-vcard" attachment from someone. Google Voice helpfully displays it as "file type not supported" -- there is no way to download it, view it as text, or do anything other than tell the sender that I'm using a shitty Google product and please copy/paste the info out of it manually and send it to me.
Re:Verified by Twilio by chaostheory on Friday August 30, 2019 @11:00AM (#20839254)
I hope it gets even more popular soon to keep it from getting killed. Even in the valley, very few people I know are aware of Google Voice let alone use it. Google deprecation is always on my mind which causes me to stay away from any new Google products.