To me, the obvious solution is to force providers to provide originator information (including name, number/ip, phone company, and country) to the end user to matter what. Then I can block whatever I want with a UBO style list.
This is not a problem you can solve with tech or more info for the consumer. I had an endpoint with two names, IP which could change mid-call, 3 possible origin numbers, and the "phone company" was a blurry concept in that case (ITSP, or its first upstream, or first POTS gateway?). And I was just a consumer. This gets even more complicated for any non-trivial company.
And that's still before name collisions. You can get a valid call from Bill Gates at Microsoft. Just not the one you think.
There are easier ways: whitelisting. Android and iOS already have a ton of shenanigans in their SMS apps to deal with stuff like RCS. A lot of people also now block and ignore calls not from a familiar caller id. Exchanging contacts can be tied with exchanging QR codes to allow auth, a practice that has been normalized by social media companies like Snapchat. This is relatively scalable. Same thing for corporations, they can post their codes online. For the non-technical an additional manual entry code can be added to automated telephone systems. For good or for bad, the mobile operating systems market has generally consolidated around a few big players. Stuff like Sailfish, KaiOS are still very very small players. Software updates can be easily and cheaply deployed OTA.
This is a high tech solution which just won't work for lots of people. Example: The local medical practice uses simple mobile phones. Think old Nokia with 3-line menu to display and no camera. You want a call back from a doctor on call and have no internet access. How would you do any pre-auth/whitelist in that case? How would you do it if you only had a land-line on POTS?
As a consumer, just give me the full stack, and any step that involves something sketchy means I don't want to see it. I'd block anything from outside the US, anything from a network that obscures information, and maybe all VOIP numbers as well. Then at least I'd only be contactable by people subject to United States law.
I already keep my cell phone on silent unless I'm expecting a call, and my voicemail is disabled. It would just be nice to not have to be notified about other calls when I do need to be reachable by phone.
This is not workable for an average person though. Also people just don't get how telephony works today. Here's an example: which of these is a call from out of US:
- call from a person in Canada, legally using a valid US caller id
- call from a US mobile roaming in Canada
- call originating in the US, routed via Canadian telco back to the US
- call from a US mobile in the US, using a VoIP service in Canada, legally using the same mobile's US caller id
(None of these are doing anything illegal, and are valid scenarios)
Yeah perhaps I don't need to block absolutely anything outside the US (and Canada), but clearly at some point there's an initial caller. If at any point I hit a hop that's not trustworthy, I don't want the call. If you can't reach me without resembling a telemarketer, I probably don't need the call. If legal but irritating companies find themselves unable to serve calls, I consider this to be a positive. If the phone system collapses, I consider that the be an improvement over having to sometimes be reachable over the current phone system.
Blocking all of those would be vastly preferable to what we have now. I get about 5 spam calls a day, so the only thing I can do is disable all incoming calls altogether. Blocking all of the things in your list, while hamfisted and far from ideal, is better than that.
