Re: [stir] current draft charter

[Henning Schulzrinne <[e-mail]>]

While you can spoof the caller ID, you (generally) cannot spoof the calls that reach you, unless you can get the real number holder to redirect calls to you.

According to a brief discussion at the FTC robocalling workshop [http://www.ftc.gov/bcp/workshops/robocalls/], the latter is actually not too far-fetched, particularly since many such redirection settings are now just web configurations or are done via apps on a cell phone. Thus, you don't have to compromise the carrier infrastructure to redirect calls, just an end user. Probably not a major threat yet for a call center or large-business number at the moment, but possibly for an individual or small business.

> With regard to ViPR, I was under the impression ViPR's entire foundation for trust authority rested on the PSTN, with the original PSTN call and its caller-ids being part of the shared secret for later use in ViPR peer discovery and authentication.  If the caller-id's in the PSTN can be faked, ViPR would have been in very big trouble, because it would have enabled incorrectly finding and authenticating a malicious peer for that spoofed number and making all future calls back to that malicious peer for the number.  No? (maybe ViPR changed after I stopped following it)
> 
> -hadriel
> 
> _______________________________________________
> stir mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/stir
>