1

What is STIR/SHAKEN?

STIR/SHAKEN is a set of telephony technologies. These technologies can help with authentication and verification of caller ID data. Eventually, STIR/SHAKEN may be available to most or all cellphone and landline phone users in the US and Canada.

How do wireline telcos implement STIR/SHAKEN?

Different landline providers may implement STIR/SHAKEN technology using different techniques.

For example: If you're in Canada, and if your phone company is Shaw Communications, you can see STIR/SHAKEN data as part of an incoming Caller ID name string. When you receive a signed call from an authentic phone number, the network will add the word "VER" to the Caller ID name information included with the call. (Source.)

An advisory committee in the US recommends that other phone companies use a similar technique. (PDF source.)

The problem with Shaw's technique

Let me explain why I think Shaw's technique is suboptimal.

STIR/SHAKEN can only verify a caller's number. However, it cannot verify their name. (PDF source.) A scammer could make a call from a genuine Skype account to a landline. The Skype account might be registered with the name "Internal Revenue Service". If so, the called party might see something like "[VER] Internal Revenue" on their landline phone's display screen. The called party might mistakenly think that the caller's name has been verified, and so might be more likely to fall prey to fraud.

My proposed solution

I think it would be better for landline providers not to add any text at all to verified callers' names. Instead, they could modify the names of unverified callers. They could add "[U]" to the beginning of the name. If there's enough space, they could also add "[spam?]" to the end of the name.

Conclusion

Do you agree with my proposed solution? Why or why not?

Edit

Cross-posted to these Reddit threads.

2

2 Answers 2

3

Your solution follows the same trajectory as HTTPS in browsers. Initially, they too had the idea of Extended Validation which would show the trustworthiness of a website:

various browsers showing EV certificates

But between non-EV SSLs also getting the green lock, and it being quite trivial to do the paperwork (and/or identity theft) required for an EV certificate, it didn't really do much.

These days, the reverse happens: HTTPS, EV or not, is not particularly highlighted anymore, while broken HTTPS or plain HTTP gets warning messages that it's insecure.

a "not secure" warning in chrome

So, your point of putting [spam?] into the name when they couldn't verify likely is the way to go here. I wouldn't use [U], as that requires the user to have memorized the relevant section in the handbook; [spam?] is clearer.

1

Re 'the network will add the word "VER"':

If I as a SW developer and power user read "VER" I only think of:

Something unambiguous and in addition not abbreviated like [spam?] seems to be better to me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.