Hacker News Reader

Comment by philipswood | Hacker News Reader

How do you use private key digital signatures on physical products? A signed QR code on the packaging? With a online verification that the key hasn't been reused.

Sort of like old software activation codes?

View on HN

Doesn’t matter. I ordered a pair of sennheiser headphones which came in the original box with all the fancy authentication stickers and it passed the verification process on sennheisers website. Six months later they were sent in for warranty replacement and the headphones I received from Sennheiser had a ground breaking difference in sound quality. I realised then that the ones Amazon shipped were counterfeits.

It works when done right. a) verification code that is big enough under the scratchpad b) verification process on the vendor site shows how many times this code had been checked before.

Six months later they were sent in for warranty replacement and the headphones I received from Sennheiser had a ground breaking difference in sound quality.

...or it could just be that they were originally flawed anyway or somewhat damaged in transit. It's not like manufacturers don't make minor changes to a product after starting production either --- mass production doesn't mean every product is exactly the same.

When I bought a device from team-xecuter for my xbox 360, they placed a bar code and serial number on the packaging. You could then go to a site they had and check the serial number to verify if it was real. I did and the site verified I had a real product. I don't recall if the serial was on the product as well or just the box. But in looking it up just now I see that according to team-xecuter there was an issue with a script and the site was returning genuine product as fake and visa versa occasionally . Also it was stated that it cost approx. one hundred dollars a month to run the service so I guess the fact that they mentioned that shows that a small company might have a hard time verifying their product if it means less for their bottom line.

what stops them from having the same "valid" serial number for 1000s devices.

Usually, it's a scratch-off code that either can only be used once, or tells you how often it has been used.

If it's any form of token, a legitimate product could be obtained and resold or returned without the token or with a fake. (How would it be validated prior to use; and if you did provide that oracle, how would you prevent botfarm abuse checking codes?)

The serial number on the product and a token to claim that number as a pair would work, at least in so far as someone would then have to obtain a large number of units and fake exact numbers. That should increase the chance of tracing a buyer; more so if the unit number is also on the outside of the box and it's registration can be checked prior to opening the box.

https://news.ycombinator.com/item?id=18018448

E-cigarette products are rife with counterfeits and often use the scratchpad-code. It's a cat-and-mouse game still. They used to just spam one code on all the boxes so you could easily see messages like "this code has been checked 300 times" but later there were more codes and you would see they were only checked <10 times. Given that many consumers aren't even checking the codes, they probably get away with a lot.

That's all about reputation. Codes and other authenticity means just help to build - or break - the seller reputation.

By the way, for example, you know that e-cig products marked 'authentic' on e.g. Fasttech are really authentic, because (tens of?) thousands of people bought there, and checked the codes, and if that wouldn't stay true, all the people at all the related forums know that. I find it kind of funny when Chinese shop from Guangdong happened to build better reputation than the biggest American retail corporation.

Reply on news.ycombinator.com