Use case · Reviews & marketplaces
One real device, one rating. Hardware-enforced.
The fake-review economy drives an estimated ~$770B in annual consumer harm (Amazon alone blocked 275M fake reviews in 2024). The structural defense is one rating per real device per period — a cryptographic check, not an ML signal you can spoof.
Economics
Where the math breaks.
A fake review trades for $5–$18 (premium markets up to €15). The $30+ hardware floor exceeds per-review yield by an order of magnitude. A farm running $0.10 VMs is profitable; a farm running real $60 Chromebooks at one review each is not.
Marketplace fake reviews
$5/review, €15 premium
Per-identity yield
$5 – $18
Rational ceiling
< $5 per identity
Hardware floor exceeds yield by an order of magnitude.
Integration
One review per device per period.
Appraise with rh.verify() at submission, bind (device.ueid, productId), enforce a uniqueness window. The same chip can review a different product, but can't post ten reviews of one product across ten accounts.
import { RootHerald } from "@rootherald/node";
const rh = new RootHerald({ secretKey: process.env.RH_SECRET_KEY }); // rh_sk_…
// Earlier: rh.issueChallenge() -> relay nonce to your dumb client, which
// collects the opaque evidence and posts back { challengeId, evidence }.
const verdict = await rh.verify(evidence, {
challengeId,
policy: "rootherald:builtin:strict-hardware",
});
if (verdict.device.verdict !== "pass")
return res.status(403).json({ error: 'device_check_failed' });
const existing = await db.reviews.find({ deviceId: verdict.device.ueid, productId, since: '90d' });
if (existing) return res.status(409).json({ error: 'one_per_device_per_window' });
await db.reviews.create({ deviceId: verdict.device.ueid, productId, body, stars });Adjacent applications
Marketplace reputation, dating, rideshare.
The same primitive solves adjacent problems where a single "real user" signal is the structural defense:
Banned-seller return
A banned chip stays banned across emails, names, payment methods, and shipping addresses.
Dating-app re-signups
One account per device per period closes the spam-account spigot that defeats email/phone verification.
Rideshare re-onboarding
Deactivated-user re-onboarding cycles defeat email and phone changes; hardware doesn't change.
The cross-tenant signal
Opt-in reputation contribution.
Tenants can opt into cross-tenant reputation: if a device flagged for review-farming at one marketplace shows up at yours, we surface the signal, under strict opt-in/opt-out controls, never sharing PII (Shield mode has none). The deviceId is tenant-scoped, so the lookup uses our internal reputation primitives, not raw EKpub correlation.
One device, one rating. Hardware-enforced.
Free up to 10K attestations a month, no card.