Hacker News Reader

Comment by pshc | Hacker News Reader

> Couldn't Rolex issue a PGP signed CSV of all valid Rolex serial numbers once a month on IPFS and you'd get the exact same security and trust profile without having to involve any "web3" feature?

A serial number can be copied and engraved onto a forged watch, so not really.

A more analogous scenario would be if Rolex embedded an NFC hardware chip with a private key inside the watch, such that anyone could wave their phone over their watch and verify that the chip’s cert was indeed signed by Rolex.

View on HN

Well sure but that's the "analog gap" problem. NFTs don't fix that, do they? In the end there'll have to be something that will tie a given NFT to a given watch, and one way or the other it'll be the same issue as tying my CSV to a given watch.

I agree, one can’t easily tie an NFT to a physical object. Nothing guarantees that the watch and NFT change ownership in tandem.

All I’m saying is that a serial number doesn’t really prove anything because it’s trivial to copy. A private key inextricable from the object would be better, because it could generate timestamped signatures as proof.

But whatever you use would still be easier to implement using traditional tech than web3, because the problems they solve are orthogonal.

Yes. I regret not being more clear in my original comment, because the scheme I alluded to is an application of public key cryptography, such as Certificate Authorities, and is not about cryptocurrencies specifically.

Even with time stamped signatures you can clone the signature onto a fake watch.

The point of a signed timestamp (and/or challenge string) is that it demonstrates the signature is freshly generated, proof that the device is authentic right then and there. An old copied signature would not have this property.

This is sort of true. In the case of the watch, if you read the blockchain for the serial-number on the Rolex, you could engrave that too? The storage medium of the data wouldn't make a difference. The same could be said for the NFC chip. Those are copied all the time. Just purchase a blank and overwrite it with an original.

> NFC hardware chip with a private key inside the watch, such that anyone could wave their phone over their watch and verify that the chip’s cert was indeed signed by Rolex.

This is an excellent idea and I am now wondering why luxury brands haven't started doing this. It would be super hot. One would do it and suddenly they would all be doing it. Watches, handbags, shoes, whatever

Luxury watch brands prevent copycats by making the watches hard to copy using special alloys (Rolex), glass techniques (AP) etc.

And fashion brands iterate quickly on their designs so when you see fake LV bags it already looks dated.

This is one of the few usecases of crypto that kinda make sense. If those certs were on a blockchain, Rolex could fold and people in the future might still be able to check for authenticity.

There's more steps involved that I'm not sure could be solved, like, who controls the authenticity Oracle? Is it an API that gets pinged? Do you have to pay a gas or network fee to check authenticity? Could a smart contract be made to automate the work? Maybe it could work like credit card chips, which give out a one-time code to the retailer, who then gets it checked by an online service... except somehow replace the web API with a smart contract.

For larger scale operations, tagging individual items with NFC chips might be cost prohibitive.

So the idea would be to create a giant file of every Rolex transaction made in the future. And then search through that file for a given NFC tag to determine authenticity. Doing all of this in case Rolex goes out of business and can no longer maintain a hypothetical authenticity server?

Gotta say, it sounds kind of crazy

This is about as good as it gets with crypto.

Couldn't agree more. Supply chain verification is inherently authority-based... if only at some point in the creation of the internet we had invented a system for verifying authoritative claims on things ;) Not to mention that with certificates... Rolex can totally disappear into the wind, yet you can still verify the certificate provided you know Rolex's root. And all this for <$300M year in mining fees!

>Rolex could fold and people in the future might still be able to check for authenticity.

That's why I mentioned distributing the file over IPFS so that it could be easily backuped by anybody forever. If eventually there's no longer any interest in this database it could be lost to bitrot of course, but this is also true of blockchains.

> Rolex could fold and people in the future might still be able to check for authenticity.

Well, what if Rolex folds and sells their private keys, and an unscrupulous buyer then starts minting Rolex NFTs for fake watches? What if this happens surreptitiously, and not out in the open?

Further, it's far more likely at the moment that Rolex will exist 50 years from now than that Ethereum or Bitcoin will.

Reply on news.ycombinator.com