Slashdot Mirror
New Google Service Manipulates Caller-ID For Free
Lauren Weinstein writes to raise an alarm about a new Google service, Click-to-Call. As he describes it, the service seems ripe for abuse of several kinds. One red flag is that Google falsifies the caller-ID of calls it originates for the service. From the article: "Up to now, the typical available avenue for manipulating caller-ID has been pay services that tended to limit the potential for large-scale abuse since users are charged for access. Google, by providing a free service that will place calls and manipulate caller-ID, vastly increases the scope of the problem. Scale matters."
Not exactly new....
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)
Finally, technology that gives power back to the teenage prankster. Now "Hey, did you know your refridgerator is running?" calls will be answered with "Yes Mr. President, I did ... Oh, and by the way, your voice sounds so much younger in person" instead of "Johnny, please hangup the phone before I tell your mother".
Crack - Free with every butt and set of boobs
Scale matters. But control matters too. This is not like the spam problem where the cooperation of thousands of entities with different motives would be necessary to prevent abuse. The service is controlled by a single party that can make changes easily.
It would be very easy for Google to implement a verification mechanism. An automated system could simply ring any added Caller ID number and verbally present a verification code (or ask for a response). If a user can answer a certain number, it's not unreasonable to assume that they could also originate regular calls from that number. In the worst case, it still ties the user to an organization or physical location.
I agree with Weinstein that verification really should be a standard feature. Whoever runs even a simple mailinglist without user verification is considered a spammer these days; the ideas are not new. So it's fair to expect Google to carry out this verification.
However, Google is known for technological innovation so I'm not turning off my phone just yet. They'll probably fix it. Of course, a little public attention may help if they seem unresponsive.
( ^_^)/
This is stupid. It's a non-issue. The advertiser has to opt-in. Hell, I'm guessing that the advertiser is going to have to pay for it (it's part of AdWords). If the advertiser chooses to try it, and gets too much crap, the advertiser can stop it.
As a business owner, if I used AdWords (I don't... too much click fraud), I'd try it, because any way that customers can contact you easier is generally good. But if it gets abused by a bunch of 12 year old's, I'd cut it in a heartbeat.
It's not opt-in anymore. Take a look at maps.google.com - search for a business and they'll ALL have the click-to-call thingy on them.
Comparing CallerID to SMTP is a pretty good analogy. However I don't agree that either of them are "broken". Neither of the two were designed with authentication in mind, nor were they ever advertised as a means of security. Before CID, you had to actually answer the phone to see who was on the other end. CID was introduced as a conveniance feature, not a security feature. It's people's expectations that are broken, not the technologies.
Entrepreneur : (noun), French for "unemployed"
However, the problem the blogger is concerned about is not the abuse you're thinking of. The problem is that a nefarious user could put click the "Call" link on a Business listing, but put in someone else's phone number. The "Caller-ID spoofing" part comes in here: Google's service calls the phone number entered, but the Caller-ID shows the number of the business that the "attacker" chose.
If, when the person picks up the phone, they are immediately connected to the business, they would assume that the business called them. The blogger is apparently envisioning something of a "Joe job" style attack.
However, this is easily protected against. Instead of connecting to the business directly, all Google has to do is play a recording along the lines of: "This is Google, calling since you entered your phone number on the "Click to Call" service, please press 1 to connect to the business you selected. If you did not initiate this, please hang up or press 2 to disable this service for this phone number."
How pleased would the rest of us be if people would refrain from splitting the first sentence of their post between the subject line and the comment box?
800 type numbers do not get Caller ID data - they get Automated Number Identification data which is much hard to change and, as far as I know, click to call doesn't change the ANI information.
Yes, that's for sure. We shouldn't even have subjects, the subject is the article. People most of the time end up doing stupid things like splitting the post between the subject and the comment, or leaving it as "Re: Subject that doesn't make sense" Because the subject refers to something 3 levels up and the subject has changed by this point. Nobody reads subjects, and hardly anybody puts in a useful subject anyway. It's nice for email, because you can scan your messages and tell which message is about what, but when you're reading posts, it's not worth your time to read all those subjects because 98% of them are Re......
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
I think that even the laziest person in the world wouldn't find pressing buttons on a telephone to be too hard of a task.
but what if their fingers are too fat?
ôó
Well I think it's even more annoying...
I only mod funny =D
I agree with both of you. It is annoying that it screws up the 1st-sentence-preview of the experimental forum, but it's also annoying when you don't have the context.
The obvious solution, of course, is for slashdot to add an official method of quoting (rather than right now, where some people italicize, some prefix with >, some put it in quotation marks, and some just paste the text normally) and then have the experimental forum display the first line of non-quoted text.