Hacker News Reader

Comment by throwme_123 | Hacker News Reader

That's a legitimately good use case for NFTs.

When you sell valuable physical objects that have a high risk of counterfeiting, the secure way is to associate a "digital twin" of the object that has verifiable provenance and this is exactly what NFTs as a technology are good at.

edit: Thanks to everyone that downvoted this to -4 despite the numerous good remarks in comment that spark a solely technical discussion on the topic. Please come over your hate.

View on HN

You don't need NFTs to do this though, you can just use signed commitments stored in some public log.

Yeah, doesn't even make sense for something like this to be decentralized, it should be run by Rolex so they can catch edge cases and correct them by fiat

Yup. If your father dies, and leaves you a Rolex, but does make a way to give you access to the keys to the nft, would the Rolex stop being authentic?

When we are talking about digital proof of ownership of physical goods, any solution that can fail synchronization of the record due to entirely foreseeable events like death, ownership disputes, etc is a failed solution.

Good remark. I think it is simpler to just use a public blockchain that having Rolex properly build "open" cloud services to do that and maintain it themselves over the long run.

Software engineers forget that the general public isn't capable of or willing to generate a private key and keep it secure for the long term. It's a deal breaker. Crypto isn't the answer.

It's also over engineering. A serial number and a registration process can go a long way.

I'm a security engineer and I'm not sure I'm capable of keeping a private key secure for the long term.

This would only work if the NFT was signed by a key kept on the real watch in a Secure Enclave of some kind, but then you don’t need the blockchain, just a database maintained by Rolex. The blockchain doesn’t buy you anything here.

> ... blockchain doesn’t buy you anything...

Near-universally applicable lemma.

Essentially PKI, store a certificate signed by rolex and it's corresponding private key in the enclave.

The only thing you need is the root Rolex certificate and you can authenticate the watch. You also need to have a signed copy of the serial inside the enclave so it can't be transferred (inside the certificate)

We already solved this problem decades ago with certificates of authenticity and standard record-keeping, which if I understand correctly, Rolex (and a number of other high-end watch companies) already employs.

> the secure way is to associate a "digital twin"

Not really, that just punts the problem to another area. This problem has been about as solved as it's going to get ages before the idea of crypto. NFT's don't actually add much other than a different layer and one technique of digital record keeping.

How does having a “digital twin” of the physical object prevent the object from being counterfeited?

The digital owner of the item needs to be synchronised with the physical owner of the item. The authenticity then can be confirmed by crypto.

Synchronized how? Confirmed by whom?

This has the same oracle problem that all these blockchain-for-X dreams do.

Synchronisation is the hard part. I suppose there are a few different ways to do it. One way would be to use a hardware that holds a private key in a secure chip, and whoever has access to the physical watch can sign a message with that key to point to an arbitrary address. This can then be submitted to the blockchain. Confirmation is easy, as the blockchain takes care of that. It would be emitted by a verifiable/trusted public key. If the address is not Rolex's address, the item is fake.

How do you "print" the association in the physical object? What would prevent this association to be faked?

The devices can ship with an embedded hardware security module that holds a private key. The private key has its public key whitelisted by Rolex, and can be used to sign a message transferring the ownership to the current owner's public key. If you can do this transfer action, the device is legitimate. Of course you'd need to check that the public keys/addresses match Rolex's.

To me, it sounds like no manufacturer will ever implement this because 99% of end users have no chance of learning how to use it

That's fair, and manufacturing and UX could very well be a challenge. But the technology does work

At first i thought this was a pretty well done satire, but after reading over it multiple times, i am not sure.

And it imo says more about the general state of discussion of crypto/nft, rather than about your comment specifically.

You shouldn't be able to transfer the NFT yourself. Each transfer should be attested by an official dealer (for a transfer fee).

Wouldn’t that make it easier to make fakes, if everyone could trivially look up what the serial number and features were supposed to be?

Yeah because blockchain and NFTs totally solve the problem of Internet fraud.

And what prevents them from faking the association to the digital token?

You shouldn't be able to transfer the NFT yourself. Each transfer should be attested by an official dealer (for a transfer fee).

Ok so you trust the dealer explicitly, and you are paying them each time to keep providence. What does the NFT buy you when you could just ask Rolex?

What would stop someone from selling the digital twin to scammers to make better fakes, and just keeping the watch?

Because your watch will go down in value since people will assume it's fake when you try to sell it and you don't own the corresponding NFT.

Same reason I wouldn't buy a certified Jordan autograph and then sell the certificate of authenticity.

Reply on news.ycombinator.com