Top all-time · #3735
TransNexus
Company blog · transnexus.com/blogsystemssecurity
TransNexus is the company blog at transnexus.com, writing about systems and security. Since 2018, 21 different Hacker News readers have linked it 27 times, most often “Understanding STIR/SHAKEN – New Anti-Robocalling Protocol”. No feed was found, so read it on the site itself.
Too few sampled comments (23) to say how often HN recommends it.?
Why HN links it
HN readers link TransNexus pages as references on STIR/SHAKEN caller ID authentication and robocall statistics, usually to support their own points about spam calls.
Summarised by Claude from a sample of 23 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
TransNexus offers powerful software to manage and protect your telecom network.
Most-linked posts?
- Understanding STIR/SHAKEN – New Anti-Robocalling Protocol9 people · 11 mentions · first linked 2019-01-18
- /whitepapers/stir-and-shaken-overview/5 people · 5 mentions · first linked 2018-12-26
- /blog/2022/shaken-statistics-november/2 people · 2 mentions · first linked 2022-12-27
What Hacker News says?
https://transnexus.com/blog/2024/ftc-dnc-report-2023/
Comment linking /blog/2024/ftc-dnc-report-2023/
on “FCC rules AI-generated voices in robocalls illegal”Submitted Understanding STIR/SHAKEN – New Anti-Robocalling Protocol as a story · 109 points
HN discussionI hope this addresses the abuse. See [1] It basically asks the telecom operators to implement digitally signed certificates. So it would work, if I understand it conceptually, like your web browser, when it receives https traffic unsigned certificate, or https traffic from a domain that's not part of the certificate chain. Therefore, this mandate will prevent 'spoofing'. And without spoofing, the spammers would nece…
Comment linking /whitepapers/understanding-stir-shaken/
on “FCC will require phone carriers to authenticate calls by June 2021 [pdf]”Submitted Understanding Stir/Shaken – Industry Response to Robocalls as a story · 2 points
HN discussionArchitecturally there's no binding between phone number and subscriber identity except at the very edge of the network, for the very smallest retail customers. There is a design to federate this binding throughout the ecosystem using a PKI called STIR/SHAKEN [0], but it's absolutely a hard technical problem to get that rolled out 100% without breaking things. [0] https://transnexus.com/whitepapers/shaken-as/
Comment linking /whitepapers/shaken-as/
on “The FCC Has Fined Robocallers $208M, Collected $6,790”Submitted Understanding Stir/Shaken (Industry Response to Robocalls) as a story · 1 points
HN discussion>I really hope AT&T starts censoring these damn spam calls. I've had 5 today. I got one (Verizon) just as I started reading the comments for this post. :( There are solutions[1], but you'll need to wait until next July[0],at least in the US. It's not a complete solution, but it should take care of the vast majority of scam calls. [0] https://www.fcc.gov/call-authentication [1] https://transnexus.com/whitepapers/stir…
Comment linking /whitepapers/stir-and-shaken-overview/
on “Facebook, Twitter block the NY Post from posting”Submitted Stop Spoofed Robocalls with STIR and SHAKEN as a story · 1 points
HN discussionWe have a lot of progress under the form of STIR/SHAKEN. Now it doesn't prevent all types of spoofing but it makes the calls traceable back to the originating carrier. What happens is scammers get numbers with small carriers who interconnect with major ones. Eventually the reputable carriers notice spam from these smaller carriers and start dropping their calls (or banning them altogether). So the smaller carriers d…
Comment linking /whitepapers/understanding-stir-shaken/
on “USPS text scammers duped his wife, so he hacked their operation”Spammers have currently defeated SHAKEN/STIR. A signed call is more likely to be a robocall than not a robocall. This is thanks to shady phone companies that will sign calls for anyone or intentionally cater to scammers. https://transnexus.com/blog/2022/shaken-statistics-september... This is like when DKIM was first being deployed spammers adopted it first.
Comment linking /blog/2022/shaken-statistics-september/
on “FCC to remove companies from robocall database for non-compliance [pdf]”More info on SHAKEN/STIR: https://transnexus.com/whitepapers/understanding-stir-shaken... http://nymag.com/intelligencer/2018/05/how-to-stop-spam-robo...
Comment linking /whitepapers/understanding-stir-shaken/
on “FCC threatens carriers with 'regulatory intervention' over robocalls”SHAKEN/STIR https://www.zdnet.com/article/at-t-comcast-successfully-test... https://transnexus.com/whitepapers/understanding-stir-shaken... Doesn’t solve the problem entirely, but makes it easier to identify and blacklist robocall operations using heuristics, rate limiting, etc.
Comment linking /whitepapers/understanding-stir-shaken/
on “U.S. files lawsuits over robocall scams”There already is a proposed technological solution to this: https://transnexus.com/whitepapers/stir-and-shaken-overview/ The FCC has recently "demanded" US telecoms to implement this [0], but at this point I don't believe there is actually a regulatory requirement to do so. [0] https://docs.fcc.gov/public/attachments/DOC-354933A1.pdf
Comment linking /whitepapers/stir-and-shaken-overview/
on “Apple needs to change iPhone’s call UI because robocalls are killing us”The eventual fix will be adopting ATIS SHAKEN and STIR protocols, which is, very roughly, signed caller ID. The FCC is now demanding it of carriers: https://docs.fcc.gov/public/attachments/DOC-354933A1.pdf (Background and open letters to carriers: https://www.fcc.gov/document/chairman-pai-demands-industry-a... ) How it works, short version: https://transnexus.com/blog/2017/stop-spoofed-robocalls-with... How it works…
Comment linking /blog/2017/stop-spoofed-robocalls-with-stir-and-shaken/
on “Apple needs to change iPhone’s call UI because robocalls are killing us”> a technology designed to prevent robocalls altogether, recommended in a report more than a year ago and currently set to be implemented in Canada in 2019, has no such date here in the States. What’s the technology? Edit: https://transnexus.com/solutions/stir-and-shaken/stir-and-sh... ”STIR and SHAKEN use digital certificates, based on common public key cryptography techniques, to ensure the calling number of a tel…
Comment linking /solutions/stir-and-shaken/stir-and-shaken-overview
on “FCC fines robocaller record $120M”SHAKEN/STIR is the answer to this and is being worked on. https://www.fcc.gov/call-authentication https://transnexus.com/whitepapers/understanding-stir-shaken...
Comment linking /whitepapers/understanding-stir-shaken/
on “The FCC has fined robocallers $208M and collected $7k”There's a protocol being worked on called STIR/SHAKEN to address robocalls [0]. It's more like website / browser certificate PKI than spam filtering. Some of the major US telcos are working toward implementation already. [0] https://transnexus.com/whitepapers/understanding-stir-shaken...
Comment linking /whitepapers/understanding-stir-shaken/
on “The FCC has fined robocallers $208M and collected $7k”Change might be coming. The SHAKEN/STIR framework to authenticate calls is making decent progress: https://transnexus.com/blog/2018/providers-responses-shaken-... Once implemented incoming calls can be handled differently (e.g. UI differences on dialer, dropped to voicemail) based upon the attestation.
Comment linking /blog/2018/providers-responses-shaken-without-delay/
on “The FCC has fined robocallers $208M and collected $7k”It looks like Canada is moving in this direction. Here is a PR piece (by a telecom technology vendor) that explains that the Canadian telecom regulator will require non-spoofable caller id by March 2019 [1]. The technology is called STIR and SHAKEN. (That's all I know; I'm no expert). The US FCC doesn't seem to be moving as quickly, if at all. [1] https://transnexus.com/blog/2018/canadian-regulators-mandate...
Comment linking /blog/2018/canadian-regulators-mandate-caller-id-authentication/
on “Voice Phishing Scams Are Getting More Clever”There's already work underway to authenticate the actual source phone number of a caller: https://transnexus.com/whitepapers/stir-and-shaken-overview/ And to make sure the source is set to a value that the caller is allowed to possess. The problem isn't spoofing of numbers--because the utility is quite high for legitimate uses, like PBXes and after-hours doctor return calls for two examples--but the ability to spoof…
Comment linking /whitepapers/stir-and-shaken-overview/
on “Robocalls are overwhelming hospitals and patients”At best, they could require the U.S. to implement STIR/SHAKEN [1], maybe. There will be significant technical and legal challenges in this. Overhauling or upgrading the existing switches is non trivial. This is just my opinion, but I predict this will result in legal battles and legal stalling on the part of the telcos. Even if all the telcos agreed to do this, there would be a period of time that nothing is enforce…
Comment linking /whitepapers/stir-and-shaken-overview/
on “FCC orders phone companies to help trace illegal robocallers”This is feasible if first responders and medical offices use SIP/VOIP providers who support SHAKEN/STIR. https://www.zdnet.com/article/at-t-comcast-successfully-test... https://transnexus.com/whitepapers/understanding-stir-shaken...
Comment linking /whitepapers/understanding-stir-shaken/
on “The DOJ Is Finally Suing US Telecom Providers for Robocalls”Shaken/stir isn’t a panacea however: https://transnexus.com/blog/2022/shaken-statistics-november/
Comment linking /blog/2022/shaken-statistics-november/
on “Americans lost $10B; caused by illegal Indian call centres in 2022”Spam filtering for phone calls is in its infancy. Only 20% of calls are signed https://transnexus.com/blog/2022/shaken-statistics-november/ . Some robocalls are signed. Many legitimate calls are blocked. I ignore all unknown callers.
Comment linking /blog/2022/shaken-statistics-november/
on “Americans lost $10B; caused by illegal Indian call centres in 2022”I believe international telecom industries are working[1][2] on it. I don't know an ETA. I signed up on their mailing list without knowing what to expect. The content of each email is beyond me but looking at the clout on the email signatures convinced me this was a serious and viable movement. TLDR; this is a technical approach to preventing number spoofing except where authorized. Presumably to be implemented by t…
Comment linking /whitepapers/understanding-stir-shaken/
on “Ask HN: What can we do about spam calls with spoofed numbers?”There's not much you as an individual can do to stop it. I have the same issue with Comcast filling my PO Box with shitloads of junkmail. The phone system is designed to accept anyone calling on it, and there's no authentication mechanisms in place for securing it since it all has to interoperate and is built on dated standards. There are basically two solutions to stopping the problem (instead of treating the sympt…
Comment linking /whitepapers/stir-and-shaken-overview/
on “Ask HN: What can we do about spam calls with spoofed numbers?”We're still very early in the process. 1) Deploy caller ID signing. <--We are here. 2) Deploy policies to make inter-telco tracebacks easier and increase liability for carrying too much spam. 3) Drop unsigned traffic and shutdown spam friendly portions of the PSTN (analogous to open email relays). 4) Use the tracebacks and KYC to deter robocalling operations from getting onboarded and ban current customers who are r…
Comment linking /blog/2023/shaken-statistics-july/
on “FCC allows blocking traffic from robocall-friendly provider One Owl”
