Re:FCC to require anti-robocall tech after “voluntary” plan ...
by DaiPlusPlus on Friday March 06, 2020 @05:44PM
(#22508076)
I built and run a popular prank-calling website (with spin-offs for wake-up calls and call-my-phone-because-I-lost-it amongst others) and the prank calling site allows for caller ID spoofing (disclosure: the site only lets you use a number you’ve verified ownership of) and this “just works” because there’s nothing in SIP and SS7 that’s equivalent to SPF/DKIM/PKI/TLS. Any and all anti-spoofing measures take place between my upstream SIP trunking carrier and the recipients’ service provider.
Such as it is, the entire PSTN/SIP/SS7 ecosystem and infrastructure was designed without any notion of authentication or verification of Caller IDs (just like SMTP’s From: header); I suppose everyone assumed back in the days of landlines that because there’s physical links and an accounting paper-trail then _surely_ the phone companies would dutifully investigate reports of spoofed numbers and disconnect/disable abusers.
I’m unsure how this will pan-out. I’d wager the majority of on-prem PBX and Asterisk boxes are sitting there unmaintained for possibly decades - and many of those systems (e.g. legitimate call-centers) will be entirely dependent on Caller ID “spoofing” to work as-intended.
What’s frustrating to me is how mobile phone networks live in their own separate bubble with minimal interoperability. I’m sure we’re familiar with VoLTE/Wideband-audio on our smartphones - but that’s only supported for calls to recipients in the same network. If you have a fancy on-prem all-IP SIP infrastructure that supports every Wideband audio codec ever made - and have a great trunking provider - you’ll still get nasty analog phone quality if you try to call someone on T-Mobile. If we can’t get things like preserving call quality right then I’m very doubtful we’ll get Caller ID authentication working.
Such as it is, the entire PSTN/SIP/SS7 ecosystem and infrastructure was designed without any notion of authentication or verification of Caller IDs (just like SMTP’s From: header); I suppose everyone assumed back in the days of landlines that because there’s physical links and an accounting paper-trail then _surely_ the phone companies would dutifully investigate reports of spoofed numbers and disconnect/disable abusers.
I’m unsure how this will pan-out. I’d wager the majority of on-prem PBX and Asterisk boxes are sitting there unmaintained for possibly decades - and many of those systems (e.g. legitimate call-centers) will be entirely dependent on Caller ID “spoofing” to work as-intended.
What’s frustrating to me is how mobile phone networks live in their own separate bubble with minimal interoperability. I’m sure we’re familiar with VoLTE/Wideband-audio on our smartphones - but that’s only supported for calls to recipients in the same network. If you have a fancy on-prem all-IP SIP infrastructure that supports every Wideband audio codec ever made - and have a great trunking provider - you’ll still get nasty analog phone quality if you try to call someone on T-Mobile. If we can’t get things like preserving call quality right then I’m very doubtful we’ll get Caller ID authentication working.