Hacker News Reader

Comment by neilv | Hacker News Reader

Flash drives with hacked firmware to pretend to be bigger capacity than they were (along with other evildoing, like counterfeits targeting people paying a premium to get Sandisk quality) were already rampant on eBay IIRC 15+ years ago.

I was still seething over some of the storage ones when, a few years ago, I joined an anti-counterfeiting startup. (Sadly, our successful MVP launch integrated into a high-end factory production line happened just as Covid was breaking out, which spooked our flagship customer, and impacted followthrough we needed, then we ran out of runway while pivoting.)

As a consumer, I can imagine a lot of things that the marketplaces like Amazon.com and Walmart.com could do to improve trustworthiness. I don't know whether those make business sense. I'd love to see consumers reward a marketplace that conspicuously kept out the scammers.

Ideally, the solution would protect integrity of all brands, not only house brands.

View on HN

I think a key thing is that a marketplace should be held liable if the actual seller cannot be held to account. They shouldn't be able to use "just a marketplace" as a shield to avoid liability when they're the only ones in a position to have vetted the real seller.

This is how it works with credit card companies where I live. The credit card company is jointly liable with the supplier. It works fine and the consumer is protected. "Marketplaces" are still in the relative wild west when it comes to liability here.

The flip side is then it becomes much harder for small companies to get their products approved on such marketplaces (to the benefit of larger competitors). There's a tradeoff and, like most things, some middle ground is probably best.

> There's a tradeoff and, like most things, some middle ground is probably best.

This is a question of whether there should be any real accountability at all. We're currently at one extreme and debating whether to take the smallest step away from that; a real middle ground is a long ways off.

> The flip side is then it becomes much harder for small companies to get their products approved on such marketplaces

So long as the marketplace can confirm that someone will take responsibility for product quality, I don’t see an issue. Smaller companies will be able to be more hands on with a marketplace. As in, actually having a person to communicate with customers and/or the marketplace.

The problem only is an issue for fly by night sellers that just generate new identities when a marketplace delists them. Having a little bit of due diligence added to the marketplace is a good thing for both buyers and sellers.

It doesn’t have to be anything super onerous.

If the marketplace is jointly liable, it could be as simple as them then requiring sellers to have a typical $2m liability policy from a licensed insurance company naming the seller and marketplace and provide proof of insurance before selling. If anyone shows up to sue over the product, you just direct them to the insurance company.

If you’re not doing anything dumb and don’t have a history of doing anything dumb, getting some basic liability insurance should be cheap and trivial.

It completely outsources the costs and moderation and probably _saves_ the marketplace money versus the current arrangement.

The only way you continue to sell a bunch of fake / dangerous products is if the insurance companies are taking losses on this. And they’ve shown themselves pretty adept at avoiding losses.

> when they're the only ones in a position to have vetted the real seller

I've yet to see any evidence that marketplaces are actually interested in vetting sellers ... or buyers, for that matter.

Marketplaces are basically all about taking their % of the sale, yet getting to shrug and walk away if the transaction goes south.

I wish there was some kind of builtin tool in mainstream operating system to validate the real capacity of an external storage.

Right now I use h2testw on all storage I purchase, but you kinda need to know this is a thing.

Yesterday I read another analysis of what seems to be the same drive which tried to verify the real capacity, but the issue was that the drive was throttled to a low-speed connection so that validating it by writing and re-reading the full volume of data would take something like 250 days. So it's kind of obvious that it was bad, but you can't easily prove it in a reasonable time.

I suppose the issue is that the only real way of doing that is to write as much random garbage as the drive supports and then verify that you can read it all back again. That should probably be a thing, but it would be incredibly slow and waste your limited write cycles.

The combination of regulations and buying from reputable sellers should be enough IMO... though most people would probably view Walmart as a reputable seller, so that clearly doesn't work.

Yeah, and it's not enough to do e.g.

    d = random_block()
    for block in capacity:
      block.write(d)
      if block.read() != d:
        fail("fake disk")

Since that would be fooled by a device mapping all reported blocks to the same actual storage. I guess you basically have to write unique data to all reported blocks first, then read them all back to verify.

Since storage devices are often bigger than RAM, the data is probably best to generate procedurally (but deterministically) from the block number.

That sounds like fun!

I believe f3 (Fight Flash Fraud) already does random numbers with a preset seed: https://github.com/AltraMayor/f3/blob/master/f3read.c#L144

So they put that code on the drive controller, detect when f3 is being used, and generate the pattern dynamically in the drive controller.

Yes, that would be possible, but that would require effort on the counterfeiter's part. Any additional hardware in the drive controller is going to reduce the counterfeiter's profits. So why would they bother? H2testw, which f3's algorithm is based upon, is more than a decade old at this point with the same RNG generator and no one has made such a drive controller to trick it.

Ooh, I just did something with this, and I should finish the draft blog post for it:

* write encrypted zeroes

* decrypt it and count the zeroes

I think cbc mode is enough. I see a possible computational loophole, which I want to check before I post.

You could do that, but doesn't it seem easier to: 1) initialize a CSPRNG to a known seed; 2) generate random numbers and write them sequentially; 3) initialize a new RNG to the same seed and compare numbers you generate to numbers you read from the storage? That way, you even get to point at the exact byte where the first divergence happens, which might let you say, "this drive which claims to be 30TB seems to be 1GB".

Once you find the exact byte where you know the storage ends, you can actually format the drive it's completely usable. F3 can do this with f3probe and f3fix.

https://fight-flash-fraud.readthedocs.io/en/latest/usage.htm...

I've used it on a 2GB microSD that came with a 3d printer that turned out to be 100MB. I continued to use it to transport files to my 3d printer for a bit with this.

I think that would avoid the potential loophole I was worried about! I'd be careful with the periodicity of the RNG though.

I was on a machine with limited user space. I used OpenSSL, no new binaries, reading and writing at close-to-wire speeds. "Counting zeroes" would track down where they don't match, doesn't it?

CSPRNGs don’t have that issue.

I've been using f3probe rather than full f3: https://fight-flash-fraud.readthedocs.io/en/latest/usage.htm...

The documentation does mention it is possible for more advanced fake firmware to bypass this, but I don't think anyone has bothered yet. It's labelled experimental because of that, but I believe that was at least 5 years ago.

In order to sell on those platforms companies should have to place $5 million in escrow and Amazon promises to test at random a certain percentage of your products and if failed you lose your money. I laughed at a client when he told me he bought a 1TB hard drive off of Wish. I told him well good luck with that hope you didn't just get scammed. Saw him a week later and he told me the drive wouldn't work on his new PS5. I told him I would bet him the cost of the drive it was a fake and probably couldn't hold even half of what it is reporting and told him to use the tools to see it's actual size. He didn't take the bet so I will never be sure but no way in hell I would be a $25 storage from Wish.

> $5 million in escrow

Nestle have no problem putting up $5M, but most good small companies just can't.

So the end effect is that you enable big monopolies.

You need to invent some kind of reputation system. Small towns (and communities) have this builtin as everybody knows almost everybody. Amazon is missing the ability to say "this is a new seller without solid reputation".

But I'm guessing this would be bad for short-term thinking, the wish for "the everything store".

You can't be quality store and "everything store". Everything is mostly junk (Sturgeon's law).

Like bonds for construction work. The usual way that small companies do that is insurance; the insurance companies look into how likely a company is to be able to perform and charge appropriately. The risk assessment function rides on them with commercial incentives instead of corruptible government. In theory.

HN likes to believe that any sort of monetary entry barrier automatically equals big player monopoly and that it will prevent the smaller guys from entering but as in your example this is just not true. In fact like you say has sprung up secondary markets like insurance companies.

Reply on news.ycombinator.com