By Simon Woodhead
I had an email yesterday and it made me very very cross. In fact, it really made me question how our values as a company relate to the industry we operate in.
You see we really care about the consumers of communications services, and our mission is to improve their lives with great technology. Of course, we supply ISP/ITSPs and you supply end-users, so we depend on you to add value and give them the best service possible. We’re blessed to work with some of the best ITSPs in the business who respect what we’re about, and we respect them. Thankfully, the boneheads are more drawn to the shiny suits and ‘sell sell sell’ of bland commoditised half-functional crap available elsewhere.
In some respects though, we get frustrated across the board and encryption is one such area. It is frustrating because we passionately believe end-users deserve it, and we’ve worked hard to make it available, both many years ago and newly improved in the new stack. We’ve also banged on about it in an effort to encourage a move away from the factory defaults of unencrypted UDP/5060. Yet implementation remains pitifully low.
We know most other wholesalers don’t offer it. We also know ‘me too’ doesn’t offer it so their shiny suits will proclaim that the market doesn’t want it, but instead seek to sell a ‘PCI Compliance’ solution typically ignorant to the fact that a tenet of PCI/DSS compliance where VoIP is concerned is that all calls traversing the public internet must have encrypted RTP (e.g. SRTP) over a TLS transport. Simply adding a shiny box that takes card details away from an agent’s ears does not overcome this.
But does there being limited supply and no ‘market’ for something make it unnecessary, or, going back to this email thread “pointless”?
I would argue not because I would suggest that your end-users expect full encryption and they certainly deserve encryption. I strongly believe that given recent revelations if the general public discovered that their phone calls were transiting the Internet unencrypted, or that their signalling was so open to interception, I think there’d be uproar. And rightly so!
Of course, the clueless may argue that because you can’t encrypt end-to-end from one PSTN caller to another, why bother at all. Call it social responsibility, call it being professional, call it giving a shit, but at any level this is utterly unacceptable. Beyond unacceptable, it is a fundamentally flawed argument.
Those same people might drone the current establishment meme that encryption is bad and only used by terrorists or those with something to hide. Both arguments presume that the only reason to encrypt is to hide something bad from authorities, and thus good people don’t need to, and service providers don’t need to bother because an intercept can happen elsewhere. At the risk of offending anyone reading: wake up!
So, let’s look at this from two perspectives, the user first, and you the ITSP second. In both cases let’s avoid the use of ‘terrorist’ or any kind of implication of that use, and let’s see why you might want encryption.
The user
I spend a lot of time travelling, making use of hotel (or coffee shop, airport etc. etc.) public WiFi. I use a soft-phone that uses the Simwood Registration Proxy so that all calls both in and out are encrypted all the way to us. Regardless of whether they are encrypted all the way to, for example, the mobile phone I might be calling, they are encrypted over the access channel, the WiFi. I take comfort from the fact that when I speak to my kids before bed-time there isn’t some pervert 3 doors down playing with himself or live-streaming it to fellow perverts abroad! That’s an objectionable thought, right? Don’t your users deserve better? Worse still, don’t they deserve telling if you can’t give them better so they can at least use one of the up and coming services that’ll replace yours in years to come – these all have mandatory encryption baked in.
The ITSP
Ok, so you don’t care about user privacy and maybe even are of the ‘sell sell sell’ nature we describe above. But you do care about staying in business, right? So, let’s think about all those remote users registering to your equipment completely unencrypted. You might even up-sell some of your users private connectivity and think that avoids it going over the Internet. It is relatively trivial for a bad actor to hijack all of that traffic and pass it back to you, i.e. insert themselves in the middle. So you don’t care about your end-users’ audio privacy or meta-data, but what about their credentials? So that bad actor chooses to insert a fake proxy and via that discern your end-users credentials, they do this perhaps in the early hours of the morning on successive nights. You won’t notice because the traffic still gets to you, your customers are unlikely to notice, but they build a library of all of your user credentials (even those you’ve sold private connectivity to unless you’ve taken other measures) as well as some juicy recordings. Would it be harmful to your business if all of those credentials made it into the public domain? Would it be harmful to your business if those credentials were used to perpetrate VoIP Fraud but across your entire customer base? Still don’t care? How about if I make myself available as an expert witness to explain this vector the next time an ITSP is in Court with a defrauded end-user? Do you care now?
Thankfully a good number of Simwood customers get this, and a small number of select others do too. We applaud you and any effort to raise awareness of this because there is no excuse for encryption technology to be denied to end-users.
All that said, there are some challenges. Support in phones is pretty mixed; some plain don’t do TLS/SDES, others are pretty flaky. But as ITSPs you ship and pre-provision phones, so just buy different ones! Similarly, there’s a few options to configure on your B2BUA to enable both TLS and SRTP, but you’re an expert in your field or the people who wrote the software you use would very much appreciate some paid consultancy! There really is no excuse.
Finally, we’d remind you that TLS and SDES, for both inbound and outbound calls is available on Simwood. They were in the old stack but are greatly enhanced in the new stack and our Registration Proxy enables you to configure inbound or outbound calls for your end-users through our API with full encryption of media and signalling.
This isn’t a sales pitch for Simwood, we’d greatly prefer not to be the only operator banging this drum or making what we consider a basic human right in the Internet age available. Whether you use us or manage to get honest sense out of a shiny suit, please please embrace encryption as your customers deserve it.
If I haven’t convinced you, below is an old video from a great friend of ours Olle Johansson on our other great friends at the VUC promoting #MoreCrypto
