Slashdot Mirror
T-Mobile, Comcast Turn on Call Verification Between Networks in Latest Robocall Fight (usatoday.com)
pgmrdlm shares a report: Calls between T-Mobile users and Comcast's Xfinity Voice home subscribers will now be "verified," the latest move in the ongoing fight against robocalls. The two companies announced Wednesday that they have launched cross-network verification, allowing users to know that the calls they are receiving is from an actual person and not a spammer or robocaller.
They use a handoff system recommended by the FCC where the caller's network verifies that a legitimate call is being made with a "digital signature." The recipient's network then confirms the signature on its side. A number of major wireless and traditional home voice providers have pledged support for the verification method, including Verizon, AT&T, Sprint, Charter, Cox and Vonage, with several announcing plans to roll out or test the feature in 2019.
They use a handoff system recommended by the FCC where the caller's network verifies that a legitimate call is being made with a "digital signature." The recipient's network then confirms the signature on its side. A number of major wireless and traditional home voice providers have pledged support for the verification method, including Verizon, AT&T, Sprint, Charter, Cox and Vonage, with several announcing plans to roll out or test the feature in 2019.
This seems like something that should have been done...forever?
How many robocalls were transiting between these two networks? Personally, I'd prefer if Verison would simply verify calls that were supposedly coming from their OWN network.
Which has more power: the hammer, or the anvil?
I've pretty much learned to live without answering my phone at all now...as have so many other people. Phone is dying. It'll be a long slow death for sure, but this whole unmitigated explosion of spam calls is just speeding it along.
What if the large carriers all implement FCC's SHAKEN/STIR between them but then refuse to do the same thing for all the small carriers ?
Then start marking all non-verified calls as SPAM ?
Don't say it could not happen.
1% APY, No fees, Online Bank https://captl1.co/2uIErYq Don't let your $$$ sit in a no-interest acct.
Germany has made it illegal, for anybody but private people to call or mail somebody that you don't already currently have business with.
(E.g. politicians count as businesses.)
Combined with other data protection laws, that also means nobody contacting you in the name of somebody else.
Since that makes contacting somebody and making money off of them mutually exclusive, we simply don't have a robocall problem.
I wonder if we also have some form of verification for caller phone numbers. ... Given that we only had state-based telecom services (now privatized as Telekom, owner of US T-Mobile), until the 90s, it's highly. likely.
We also need make our politicians to be tougher on robocalls.
https://www.youtube.com/c/BrendaEM
Normal people without traumata or anxiety illnesses, always prefer to talk in person. Since people generally have a harder time being cowardly psychopaths when having to look somebody in the eyes, and risk getting their assey kicked.
And if that is not possible, a phone call is the next best thing. Including a voice mailbox for asynchronicity.
Everything else is only for emergencies, way too crippled and causes miscommunication and loss of the ability to empathize.
It seems like that if robocalls are a problem, it is too easy to get access to the phone network without anyone to hold accountable?
Also, it seems like a phone number is becoming more and more irrelevant these days. It's more like a node number, an IP address for your device. :D
L'Idiot
95% of the robocalls I get are in Chinese(always the same message, never the same number), 4% had a heavy indien accent and the last 1% is fraud related, like someone claiming to be from CRA or a mortgage or some other crap.
> so when someone calls a number they know which destination network to switch the call to
Yes, and TO is the operative word. A phone number is technically known as a DID number - Direct Inward Dial. A DID (phone number) indicates which service (not station aka phone) a call is being placed to. There is no such thing as a DOD, Direct Outward Dial number. Consider this very simple case:
You are logging in to your bank web site, Second National Bank.com. Your bank doesn't suck, so it has multifactor communication. The web server triggers a call to your registered phone number. The logical caller ID of the call would be the bank's customer service or security phone number, a number you can call back.
The call is coming from a server in one of four data centers the bank has, based on a web request. You're not going to have customer service reps in the datacenter. Customer service reps are in a different state, with a different regional phone company. The call is coming from the bank's rack in a Level 3 data center, or maybe their servers are in AWS. In any event, they aren't likely to be in the same place as the customer service department.
Customer service gets their phone service from Cincinnati Bell. The servers are in AWS Oregon and Virginia.
A call comes FROM a station, it doesn't come from a DID. The networks used to call into a company (Cincinnati Bell in this case) are very often not the networks they use for all of their communications. Even my three-person company had two separate service providers for DIDs (numbers) and bandwidth (used for outgoing calls).
The FCC should step up and make this MANDATORY!
I've abandoned my search for truth; now I'm just looking for some useful delusions.
Then don't fucking spoof your own customer service number into the call.
I'm a good cook. I'm a fantastic eater. - Steven Brust
What direct inward dial number would you prefer?
Web servers don't take incoming phone calls, they take incoming web requests; they don't have DIDs, they have names like www27.1stbank.com
Interesting, the DID vs DOD information. Is email in this same boat? I've always wondered why phone spam couldn't be fixed with a hybrid of things that resemble DMARC for email, and Autonomous systems for networks.
Email has from and to addresses, in the envelope as well as the headers. So it doesn't have the same issue in terms of fundamental logic. Emails from from some address, phone calls don't come from a "phone number" (DID). So that's a fundamental difference.
Note that like the phone system, email addresses can be something like customerservice@acme.com - a role or service, NOT a device, and certainly not a person.
So you can't identify a particular device as customerservice@acme.com, and similarly you can't say a certain phone is 979-580-6540.
On my phone, I can check three different email addresses. I can also check the same email from my laptop. So we recognize that an email address doesn't identify a device.
What some people don't realize is that my phone I'm typing on right now can be reached from three different numbers, and one of those numbers can also be answered from a different device. My phone isn't identified by a phone number any more than it's identified by an email address.
For PRACTICAL purposes, some of the same issues apply. An email from your bank doesn't necessarily come from the same place they answer emails. Consider password reset for the web site. The web server can send email, it can't receive email. So you can't verify the From by reversing the route.
Email has mechanisms such as SPF to verify the From address. Phone has no such mechanism and can't because fundamentally there is no from phone number. You'd need to switch the world 's 10 billion phones to a different protocol in order to introduce a "station from" or "service from" identifier.
In addition, they need to do a lookup of a telephone # and if the phone companies dbms says its not in service (that is being subscribed to by a real person) then the phone # can't connect to the phone network.
Both the digital signature and the phone # active lookup need to be done not just in the US, but worldwide.
So if I get a phone call from another country, that countries phone company does digital signature and makes sure the phone # has been subscribed and paid for by a live person. If a company does subscribe, I should have the ability to prevent any company from calling me since that other phone is marked as commercial and not non-commercial. This also applies to people in foreign countries using call back #'s to US phone numbers to reduce their charges.
I was speaking of PTSN, vs SIP.
The SMTP standard, RFC 5321, states that the sender initiates an email with the line:
MAIL FROM email@address
The email address used in MAIL FROM (the envelope) is specified as the route for errors to be returned.
Also RFC 2822 requires a From address in the message itself.
Yes, and TO is the operative word. A phone number is technically known as a DID number - Direct Inward Dial. A DID (phone number) indicates which service (not station aka phone) a call is being placed to.
DID is actually the service, not the individual BTN/WTN being forwarded into a PBX, but a lot of people use the term interchangeably.
There is no such thing as a DOD, Direct Outward Dial number.
Actually, there is.
0 day telephony signature exploit for sale. Outfarm your robocall competitors and avoid Auto screening by interfacing thesame way illegitimate call would.