Re:FCC will require phone carriers to authenticate calls by ...
by emiliosic on Wednesday April 01, 2020 @08:47AM
(#22748004)
It's going to be a problem for some systems for sure, but as the STIR framework is used to attest the number, the caller itself doesn't need to do anything. The originating carrier then attests with a level certainty A, B or C who the caller is, and adds a crypto signature to the signaling.
The key here is the attestation. If the calling carrier (usually the provider of the DID in retail but in commercial, not necessarily the same carrier) can attest by the caller, then the call will go through regardless. So tele-center company can agree with the calling carrier that, basically, tele-center company really owns the number (A) or it's more or less certain of it (B) and the call will be sent attested.
Question you might know the answer to: I've noticed it's a pretty common practice to get appointment reminders with caller ID from the doctor's office. I like that feature. I'd imagine there are plenty of other legitimate use cases for caller ID spoofing as well. Do you have any idea how that's going to work with STIR/SHAKEN?
I'd guess it's going to be some kind of oauth for your phone number, where you own it and can grant spoofing access to other entities?
Google seems to be supporting it: https://ecfsapi.fcc.gov/file/1119583115056/2018-11-19%20Goog... (via https://www.fcc.gov/call-authentication)