The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/phreak/sysinfo/risks_cn.txt

INI File | 2003-06-11 | 12.2 KB | 261 lines

[From RISKS DIGEST 16.50]


Date: Tue, 25 Oct 94 18:01:25 PDT

RISKS-LIST: RISKS-FORUM Digest  Tuesday 25 October 1994  Volume 16 : Issue 50

----------------------------------------------------------------------

Date: Fri, 21 Oct 94 20:46 PDT
From: [e-mail] (Lauren Weinstein)
Subject: CNID (numbers vs. names)

The assertion has been made that perhaps calling number ID would be more
acceptable if something other than numbers were sent.  In fact, that is
already part of the CNID spec (calling name delivery), though it is not
implemented in all CNID systems.  In most implementations I've seen *both*
name and number are delivered--which rather kills the idea of delivering "who
is calling" info rather than "where are they calling from" info.

There isn't much enthusiasm among the commercial end-users for name-only
delivery.  The reason is obvious--you can't collect phone numbers for return
sales calls when you're just handed a name.  While the telcos have touted CNID
as being for individuals, the real focus has always been on commercial use as
the real money maker.

At this point, the CNID controversy boils down to the seemingly simple
question, "Since it is mandated that everyone must have per-call blocking
available, why can't per-line blocking be made available?"  Once again, I
think the reason is obvious.  Most people aren't on PBX systems that are
easily programmed to dial the three digit blocking code on each call, nor will
most people want to spend money for add-on gadgets to do this.  So the hope of
the telcos is that most people will forget or won't bother to use the per-call
code most of the time.  If per-line blocking were available (and surveys show
most subscribers would want it--people want to know who's calling, but don't
want other people to always know *their* number!) then CNID's commercial value
would be significantly lowered.

--Lauren--

------------------------------

Date: 22 Oct 1994 02:44:36 -0400
From: [e-mail] (Michael D. Sullivan)
Subject: Re: CNID (Preece, RISKS-16.47, Klossner, RISKS-16.48)

Andrew Klossner objects to the proposal to assign each phone a second unique
number solely for CNID; This would be accessible only through an 800 number.
Klossner claims this would be impractical because "Almost all area codes in
North America are more than half populated. In order to double the number of
phone numbers, most area codes would have to be split."  This does not present
a major obstacle, however.  The pseudo-number would not have to be a valid
phone number.  [This was also pointed out in a subsequent message by Scott
Preece himself.  PGN]  Such a number could fit within the existing CNID
transmission system if it utilized the same number of digits as a valid US
number (10 digits), but there are no valid 10-digit numbers beginning with 0
or 1 (20% of the numberspace), no valid 10-digit numbers with 0 or 1 as the
fourth digit (20% of the numberspace, overlooking overlap with the foregoing),
no valid 10-digit numbers with 11 as the second and third digits (reserved for
911, 411, and other service codes) (1% of the numberspace), no valid numbers
with 11 as the fifth and sixth digits (same reason) (1% of the numberspace),
no valid numbers with 00 as the fifth and sixth digits (to avoid confusion
with 800, 900, etc.) (1%), no valid numbers with 200, 300, 400, or 600 as the
leading digits, etc.  Over 40% of the numberspace is reserved, and the
remaining 60% is far from fully occupied -- only recently have a handful of
area codes with 0 or 1 in the middle been assigned (20% of the numberspace
remains relatively vacant), and likewise phone numbers with a 1 or 0 as the
fifth digit (i.e., in the middle of the NXX "exchange" group) have been
assigned only in major urban areas.  It is very unlikely that anywhere near
50% of the numberspace is actually assigned -- keep in mind that there are 10
billion unique numbers available in a ten digit numberspace.

Clearly, then, it would be technically possible for the foreseeable future to
assign each telephone number in the North American Numbering Plan a unique
second number.  This number would not be usable as a telephone number, but it
would only work through an "800" number, which would decode it.

Moreover, there is no reason why such a non-dialable number should be uniquely
assigned to each number.  The telephone companies could use the non-dialable
subset of 10-digit numbers as a pool of codes for one-time use in each area
code.  The real dialable number is actually transmitted between central
offices, but is not transmitted to the end user.  If the "privacy" bit is
toggled on, the central office could store the real number and transmit a
non-dialable number from a one-time pad, and it would only be mapped to the
real number for a limited time, such as 48 hours, if keyed into the "800"
number associated with the same telephone company and dialed from the number
that was called (i.e., from the phone that received the non-dialable number).
There is no reason for a permanent association between the non-dialable number
and the real number; in fact, that would defeat the purpose of CNID and
unpublished numbers.  Calling the pseudonumber, through the 800 gateway, would
be a one-time deal.  There's no major technical obstacle to that.

Michael D. Sullivan | INTERNET E-MAIL TO:  |also: [e-mail] |
Washington, D.C.    | [e-mail] |   [e-mail] |

   [Various astute messages from
      [e-mail] (Paul T. Keener),
      "john (j.m.) clarke" <[e-mail]>,
      George Swan <[e-mail]>,
   and others tend to make similar observations, and are omitted.  Please
   forgive me if I have oversimplified the points made by the omitted plethora
   of messages.  I think you would all be overwhelmed if I included
   everything.  PGN]

------------------------------

Date: Sun, 23 Oct 1994 13:18:42 +0000 (GMT)
From: Tim Duncan <[e-mail]>
Subject: Re: CNID and Don Norman -- CNID can be private (Wells, RISKS-16.48)

|> [Don Norman] suggests that other information should be sent instead of a
|> telephone number. ...

This is currently being tested by British Telecom in Edinburgh.  Subscribers
have been given the option of submitting their own identifying string (16
characters) instead of the default which is their name as it appears in the
phone book.

Tim Duncan, AI Applications Institute, Univ. of Edinburgh, 80 South Bridge,
Edinburgh EH1 1HN, Scotland, UK  Tel: [phone]  Email: [e-mail]

------------------------------

Date: Tue, 25 Oct 1994 09:26:24 +0000 (GMT)
From: "B.M. Cook"  <[e-mail]>
Subject: Calling Number ID - in the UK

We're about to get calling number ID in the UK, too - from British
Telecommunication (BT) at least.  It is being promoted on the benefits to the
subscriber, e.g. "This service has already been available in North America for
some time, where it has had a major impact on malicious and fraudulent
calls.".

The fact that lines for which information has been previously withheld
(ex-directory numbers) will send information is hard to spot in the
literature!

The features listed in DIGEST 16.46 appear to have implemented, but not well
publicised - I get the distinct feeling that the service will be of most
benefit to companies who want to create lists of 'phone numbers!

We will be getting -
1. Per-line blocking - FOC, just call and ask for it.
2. Per-line unblocking - the default unless you change it.
3. Per-call blocking - dial 141 before the number you want.
4. Per-call unblocking - dial 1470 before the number you want.

1. and 2. need a phone call but it costs nothing.
3. is advertised in the literature.

BUT 4. took some discovering!  I want to block outgoing ID by default and
allow it only on certain calls (e.g. friends, certainly not businesses who
will record it, sell the lists etc.) so per-line blocking with per-call
unblocking is the answer.

This option is not mentioned in the literature, I phoned the further
information freefone number to be told that what I wanted is not possible.
Rather than give up here, as I guess most people would, I asked them to record
my requirement so that if enough other people also wanted it they might think
about providing it.  They said they'd get someone to call me back which they
did the next day.  A very pleasant call from Edinburgh from someone who knew
rather more about the system (it had been on trial in Scotland before being
introduced elsewhere).  No problem, he said, we already have what you require,
just have the line blocked and put 1470 in front of calls you want to unblock -
I'll put the line block on for you. The next day we had confirmation, by mail,
that it had been done.

So, it looks as though we will be getting a decent service (it goes live on
November 5th) - but only if you know what you want and work a little to get
the information!

------------------------------

Date: 24 Oct 1994 05:05:25 GMT
From: [e-mail] (J. Eric Townsend)
Subject: Bypassing CNID in an emergency

I see a big RISK in "ignore all phone numbers I don't recognize".  At least
once every 6 - 12 months, I get an emergency call at my house from a friend or
family member.  The call usually comes from a pay phone, but has originated at
a business or a residential line as well.

By blocking "unknown numbers", I would have missed calls with the following
content in the past year.

- "best friend severly injured in a vehicle accident, come immediately"

- "we broke down coming back from a late nite concert, it's 0230 and
   we're stuck in the middle of a really bad section of town with no
   transportation.  can you come get us?"

- "my flight was canceled, so I caught one that arrives 3 hours earlier
   and at a different airport.  come get me before I'm bored to death!"

And, most importantly to *me*:

- "Hi, I just got your resume from a friend of yours, and we'd like
you to come in for an interview."

I ended up getting a great job from that one...

I don't see what is signifcantly gained by CNID that isn't gained by
using an answering machine to screen calls.  I do see what can be lost
by ignoring calls from numbers one does not recognize, however.

J. Eric Townsend [e-mail]  USA 415.335.7463 aka [e-mail]
work: [e-mail]      AT&T PersonaLink: [e-mail]

------------------------------

Date: Mon, 24 Oct 94 10:45 GMT
From: [e-mail] (Michael Jampel)
Subject: Caller Number Identification in the UK

British Telecom is starting a CNID (Caller Number Identification) in the UK.
If you do nothing, your number will be sent out every time you make a call.
But if you dial 1471 (I think -- anyway, some 4 digit code) before dialling
the number you want to call, then your number will not be sent out.

Or you can ask for your number _never_ to be sent out. But in this case it is
_not_ possible to dial, say, 1472 to have your number sent out occasionally.

So if you don't particularly want to tell life insurance companies your phone
number, and if you don't trust yourself not to forget to dial 1741
double-bucky, you are put in the situation where you can never send out your
number, which will usually not matter, until the day that it does matter.

I feel that BT are not serving the needs of their domestic customers here:
CNID is great if someone you know is getting dirty phone calls, but otherwise
its main function is to benefit commercial customers. But there is nothing we
can do about it.

Michael Jampel

------------------------------

Date: Mon, 24 Oct 1994 09:03:41 +0800
From: [e-mail]
Subject: Re: CNID and Don Norman -- CNID can be private

It would not take the database miners of the world long to build a cross
reference between user selected call number ids and the real phone numbers.
To keep off the list, you would have to never let a company associate your
real phone number with your id. This would be hard to do if you use credit
cards, mail order outfits, etc.  Also, given the penchant for phone companies
to charge a few bucks for every trivial service change, like changing an id,
the cross reference would tend to remain up to date.

Although, I should add that if people conspire to choose the same id,
like PRIVACY, we can give the marketers a real headache.

  -- Mark

------------------------------

End of RISKS-FORUM Digest 16.50
************************

END-----------------cut here------------------