News for hackers. Stuff that matters.
Re:Why I Wrote PGP (1999) by toast0 on Sunday August 08, 2021 @12:23AM (#28104197)
You don't need a clipper chip to trace nuisance calls. You need an authenticated network that records the origin of calls, and hopefully passes that through when calls are forwarded and makes it simple and worthwhile to report nuisance calls and aggregates those reports and takes meaningful action against the origins.

Anyway, we're getting shaken/stir or whatever RealSoonNow(TM), so we'll probably have better CallerID. I don't think it'll be enough to solve the problem, without a reporting mechanism, but I guess we'll see in the next couple years.

Re:Why I Wrote PGP (1999) by dosman33 on Sunday August 08, 2021 @09:26AM (#28106517)
"You don't need a clipper chip to trace nuisance calls. You need an authenticated network that records the origin of calls,"

So where is this magical solution you speak of? We're all products that the phone company sells to telemarketers, there is no incentive for them to give us these tools now.

Again, the clipper chip would have made it difficult for anyone to pretend to be someone they are not, cryptographic signature is part of the deal to ensure you are talking to who you think you are talking to.

Re:Why I Wrote PGP (1999) by warkdarrior on Sunday August 08, 2021 @12:32AM (#28104230)
Would you want the same capability on the Internet? If not, what makes Internet communication different from POTS communication?
Re:Why I Wrote PGP (1999) by lmm on Sunday August 08, 2021 @12:43AM (#28104273)
Internet connections have a more-or-less reliable source IP (spoofing does occasionally happen and we take measures to mitigate it), IP ranges have owners and if an address is consistently used for abuse (attacks, spam email, ...) then people do report this to the owner of that address?
Re:Why I Wrote PGP (1999) by geocar on Sunday August 08, 2021 @03:33AM (#28104887)
> IP ranges have owners and if an address is consistently used for abuse (attacks, spam email, ...)

IP ranges have registrants. Servers usually are assigned IP addresses temporarily by the registrant, or by someone the registrant has assigned the block of addresses to by some other means. This means differs from region to region. In the US the responsible party is ARIN, and registrants can reassign addresses using a database called SWIP. In the EU both registrants and their partners use the same database called RIPE. I have never registered addresses in other regions.

> then people do report this to the owner of that address?

Yes. Registrant again, but yes. And if you don't get satisfaction, then you can (and should) escalate all the way to the region's authority.

Re:Why I Wrote PGP (1999) by geocar on Sunday August 08, 2021 @03:24AM (#28104847)
Yes.

Email has a "from" address that the SMTP protocol (the thing that often carries emails) that is separate from the IP address of the sending server, the exact same way "CALLER-ID" is a separate field from the billing address (called ANI, or Automatic Network Identification) in telephone networks.

Requiring that ANI match CALLER-ID would break many voicemail systems and call-forwarding systems. They can be fixed, but it will be expensive to do so.

Similarly, requiring the email "from" address agree with the SMTP server's responsibilities breaks mailing lists and email-forwarding, and again, this can be fixed, but it is proving expensive to do so.

Re:Why I Wrote PGP (1999) by mjevans on Sunday August 08, 2021 @01:54AM (#28104511)
I would want to require:

1) That the source IP address be from a range 'controlled' by the operator of a given AS. This might be proven, semi Out of Band, for a duration by a PKI challenge with a key representing that authority. (Allows distributed services on the same IP anywhere. Fulfillment can be asynchronous if UDP.) Edit: This would also be how to securely claim an AS route; you might still need a link authorized for this level of service.

2) The mentioned feedback mechanism should be coupled with 'do not forward me anything from IP || net/mask for X time' via a similar mechanism. A reason might be provided, reasons of clear abuse MAY be aggregated and used to isolate misbehaving hosts / networks.