Cool authenticity check system
 

I got some Phillips DS1 headlight bulbs for the BMW and in researching how to put them in I ran across how to authenticate them. Box has a QR code that you scan and takes you to the Phillips web site that says they are good. Pretty neat.

http://forums.pelicanparts.com/uploa...1662154767.jpg

Interesting. I guess it's serialized? Of course, your avg Joe probably isn't going to bother checking. I scanned and it took me to a website to "start verification." I didn't go any further. Did you have to put in any identifying information (probably doesn't matter that much since they get your browser fingerprint or whatever they get from your browser)?

This is a good thing. I hope we see more of this and I've often scanned a code to get more info.

So what's in place to keep someone from copying the QR code and including it on knockoffs?

Like I said in my post, I assume it's serialized, ie, every QR code is a little different.

This is the last bit of the URL that Shaun got.

?code=05A6D78334D3059654D447738546C394B

I'll do it again later today for the whole process. I think QR codes aren't copied because you would have to have access to them, take a picture of them, import and make sure it's a perfect reproduction meaning camera would have to be in perfect placement, etc. That's a lot of work and difficult to manage.

Normally, a QR code can be in any orientation, and can be damaged, missing a bit and still provide the correct information (they have error correction built in). I suspect the QR could be "pretty close" and still work pretty well.

OK, thanks Steve.

My question exactly. I guess they could check if suddenly the same one was scanned a few hundred times that they could trigger a "probably fake" rule.

...I guess you could test this by having 10 different people scan the QR and see what happens...

That said - I just scanned your code and its asking me to take a picture of the front of the box.

So I just pulled a random picture of the DS1 box off the internet - uploaded that and...

http://forums.pelicanparts.com/uploa...1662237288.jpg

So I just defeated it...

Here's the process:
Point the camera at the code
Message pops up to go to philllips.com
Go there, click start verification
Tells you to click and take a pic of front of box
Take the pic, web page refreshes saying it's OK

http://forums.pelicanparts.com/uploa...1662237240.jpg

Except I just defeated it with a screen capture on my cell phone from a random internet picture. How could mine be authentic when I don't even have them?

Here's the link from your QR Code:

https://original.philips.com/cs/product-found?code=05A6D78334D3059654D447738546C394B&cultu re=en

Here a picture of a box I downloaded off the internet and used as verification.

http://forums.pelicanparts.com/uploa...1662237624.jpg

It should give you that since my QR code was Phillips generated.

But your question is well taken, how many times and from how many IP addresses can a single QR code be used before something is triggered?

Or would it ever be triggered. I am generally disappointed with programmers' in terms of thinking processes through.

I would presume a certain number of checks against a single QR would trigger fraud eventually - but These two images allowed me to fake the whole thing.

Its not even the same box and I just screenshot the QR code above.

http://forums.pelicanparts.com/uploa...1662238229.jpg

I just decoded the QR above to a new one - wonder if this will also work:


http://forums.pelicanparts.com/uploa...1662238443.png


EDIT: YES. My self generated QR and an image off the internet gave me the "its authentic page". Try it.

These are examples of "damaged" QR codes that still scan.

http://qrcode.meetheed.com/images/qrdamaged.png

https://datagenetics.com/blog/november12013/q12.png

https://www.prepressure.com/images/q...correction.png

If I have time this week I'll call Phillips and let them know the bonus they gave some middle manager for creating their QR authentication system was probably (OK certainly) not justifiable. :D

Haha, I "hacked" it in 5 minutes with a cell phone so.....

Well you still would have to print the Phillips boxes. And print and affix the QR code labels. At some point is it really worth it? Fake lights still work they just aren't as bright and don't last as long. And then you've got to sell them. So while their authenticity system is junk, I don't think counterfeiters are buying seized Russian yachts with their ill-gotten gains.

Seriously, busy week but if I can I'll try calling Phillips.

The nice thing about restoring anodized frames is you can have your earbuds in and work for quite some time while on hold.

I work in the data space with some Pharma and CPG companies. Counterfeiting is a huge issue for them, both in lost sales but also lawsuits and brand protection. They’re investing lots of money into stemming the tide.