Comment by dangero | Hacker News Reader

Comment by dangero | Hacker News Reader

Having worked with factories in China I'm not sure the sleuthing relating to glue types, etc really mean a lot. Our vendors regularly changed things like that, sometimes without even consulting us first. (Although they should have). Also, we made running changes on things like that all the time as well.

There is no reason why silk screen printing on a counterfeit product should be any less sharp, so I don't understand the relevance of saying the Canon logo will be a little blurred on a fake one.

The premise "How to spot a fake Canon flash" is nonsensical because as mentioned by gaius, often fakes are made in the same factory. In the case of a company I used to work for, their product was copied which included identical custom board layout and a copy of our firmware burned into the chips too. Obviously someone on the inside of our factory took all our designs and ip and was using it to build exact replicas. The only recourse, which worked for us, was to notify the Chinese government and they took action to shut down the people making the counterfeit products.

Congrats on successfully getting the government to step in!

Depending on the nature of your product and your supply chain, you could try to only flash the firmware once the finished products arrive in America (assuming the packaging isn't sealed yet). And do your best to make it hard to completely dump the firmware (maybe make part of it encrypted with a key that's in a one-time programmable memory that can't be read except by the decrypter, if one of your chips has this feature).

Follow-up question:

What types of intellectual property did you have that gave you any Chinese legal right to exclusive use of your designs?

Chinese parents? Anything else, such as Chinese copyright or Chinese NDA?

I don't know exactly because I wasn't involved in that side. The general thing I realized is that it's in the Chinese government's best interest to make sure large scale counterfeit operations are stopped. When looking for a factory you now have options beyond China, so if fakes in China marginalize your business, you're just going to move your manufacturing elsewhere.

I wonder if these companies could burn a "watermark" into their firmware, or create subtle differences of internal components. Then you give a slightly different variation to each factory; when the counterfeits come out, you know who to stop doing business with.

Great idea, I'll bet a lot of companies do this.

Sounds like a Canary Trap:

http://en.wikipedia.org/wiki/Canary_trap

See also: Paper towns, trap streets, etc. - https://en.wikipedia.org/wiki/Paper_town#Maps

Some products I know need to be given key material in order to work properly (e.g., games or other software). It's relatively easy to control the product then.

Perhaps the "fakes" are actually QA rejects from the very same line the real products roll off of.

I have been to a shop in China that was very up front about the fact that everything they sold was a qa reject. (mostly department store stuff, not electronics).

Clothing is a lot easier to judge, though.

What prevents factories from implementing some online verification mechanism for serial IDs? At least for products which cost a few hundred bucks, this should be economically feasible, no? Then, before buying, you could scan a QR code and have the site tell you if it's a valid serial.

I had always presumed this was where NFC would gain adoption within $BrandName.

One could easily and non-invasively (preserving packaging) check authenticity against $BrandName's website. It would cost less than printing UUIDs outside the packaging and maybe make a dent in knock-offs by both increasing cost of reproduction and fear of being 'shamed' by others being able to validate your items in-person. It would also allow Marketing folks to provide backstorys on their products and a way to directly interface with people realizing their goods are fake...

Then all the counterfeiters have to have is one valid serial number, and print it on all their products. The online lookup says it is real!

If we're talking about online lookup, then there's a simple countermeasure: if the system has already seen the same serial number 50 times, or it sees the serial number in Shanghai then fifteen minutes later in Frankfurt, or any number of other heuristics, it'll report that it's a fake. True, this might inconvenience the one legitimate customer who had that original serial number.

Also, you need to make sure that the serial numbers are long and random-looking, so that they are not auto-generated.

I don't know if this will inconvenience the one customer unless they bought it used. Someone with connections to the counterfeiters would have owned that valid product for some short period of time and probably kept it.

Just link it to some kind of database like the hard drive manufacturers do.

Some do, Kingston for example[1]. Although I don't know how they defend against serial numbers being copied too.

http://www.kingston.com/en/support/product_verification

If the same serial number keeps popping up, you can generally assume it's been compromised.

IIRC nokia used to do this with their batteries.

A friend is working on something very similar, with the exception that instead of a QR code, it's something that requires special printing equipment.

To expand slightly on this point: I worked for a sub-contract manf company, and we made commercial flash units for a (now defunct) well known UK manufacturer.

We were idiots, and the products we made were not the quality a customer would have expected. But we were fully legit.

I suspect that a team of people creating extra units, skimming those off and selling them via ebay or such, would have been achievable for some products. There'd need to be coordination across a range of departments.

Reply on news.ycombinator.com