STIR and SHAKEN use digital certificates, based on common public key cryptography techniques, to ensure the calling number of a telephone call is secure. Each telephone service provider obtains their digital certificate from a certificate authority who is a trusted authority. The certificate technology enables the called party to verify that the calling number is accurate and has not been spoofed.
The problem is there's still the opportunity for corrupt CAs to sign "legitimate" phone numbers for illegitimate purposes and for that matter for spammers to simply sign up for new phone numbers as fast as they can get them. This doesn't stop Totally Legit Homeopath Enterprises from still calling me every 5 mins even if the caller ID reads "TLH, INC." which will mean nothing to me.
Much like many people simply block IP traffic regionally, we'll end up with the same for telephony and block all numbers from corrupt CAs. With rare exception I don't need people calling me from land lines any more - almost all phone calls are cell to cell. And on a cell phone there are plenty of opportunities for our phones to handshake and establish an out of band trust.
Frankly I think at some point this problem will be solved or at least mitigated for cell phones and land lines will die a slow terrible death. In fact when Apple, Google or Signal/Whatsapp/whatever solve this I predict a mass exodus to the app or platform that whitelists trusted callers only. Although with Whatsapp that "trusted" will be in air quotes as I'm sure advertisers will have the ability to purchase their way past a block.
Regardless, I have zero sympathy in all this for phone companies as they've done nothing to solve the problem.
Are you listening, Google? Want to make Duo happen? Whitelisted + trusted callers only. Otherwise Duo will be the next Google+.
Of course, the FCC would insist on this by 2019 -- they wouldn't want anything to interfere with the election hijacking.
Only after the election will they make sure to close the barn door -- after the horse has left, the barn has burned down, and the entire planet has turned to ash.
3 comments
[ 2.6 ms ] story [ 15.7 ms ] threadThe problem is there's still the opportunity for corrupt CAs to sign "legitimate" phone numbers for illegitimate purposes and for that matter for spammers to simply sign up for new phone numbers as fast as they can get them. This doesn't stop Totally Legit Homeopath Enterprises from still calling me every 5 mins even if the caller ID reads "TLH, INC." which will mean nothing to me.
Much like many people simply block IP traffic regionally, we'll end up with the same for telephony and block all numbers from corrupt CAs. With rare exception I don't need people calling me from land lines any more - almost all phone calls are cell to cell. And on a cell phone there are plenty of opportunities for our phones to handshake and establish an out of band trust.
Frankly I think at some point this problem will be solved or at least mitigated for cell phones and land lines will die a slow terrible death. In fact when Apple, Google or Signal/Whatsapp/whatever solve this I predict a mass exodus to the app or platform that whitelists trusted callers only. Although with Whatsapp that "trusted" will be in air quotes as I'm sure advertisers will have the ability to purchase their way past a block.
Regardless, I have zero sympathy in all this for phone companies as they've done nothing to solve the problem.
Are you listening, Google? Want to make Duo happen? Whitelisted + trusted callers only. Otherwise Duo will be the next Google+.
Only after the election will they make sure to close the barn door -- after the horse has left, the barn has burned down, and the entire planet has turned to ash.