One rating per real device
Fake ratings bleed the trust your buyers place in your reviews, and once shoppers stop believing them they stop buying on them. The structural defence is one rating per real device per period — a cryptographic check, not an ML signal a farm can spoof.
The economics you are changing
A fake review sells for $5–$18, and up to about €15 in premium markets. Making one now costs a real $30+ machine — an order of magnitude more than it earns. A farm running $0.10 cloud servers turns a profit; a farm buying real $60 Chromebooks for one review each does not.
For scale: the fake-review economy drives an estimated $770B in annual consumer harm, and Amazon alone blocked 275 million fake reviews in 2024.
Marketplace fake reviews
$5/review, €15 premium
Per-identity yield
$5 – $18
Rational ceiling
< $5 per identity
Hardware floor exceeds yield by an order of magnitude.
Verify at submission and bind device to product
Verify with rh.verify() at submission, bind (device.ueid, productId), and enforce a uniqueness window. The same chip can review a different product, but cannot post ten reviews of one product across ten accounts.
import { RootHerald } from "@rootherald/node";
const rh = new RootHerald({ secretKey: process.env.RH_SECRET_KEY }); // rh_sk_…
// Earlier: rh.issueChallenge() -> send the one-time challenge to your app,
// which collects the sealed hardware proof and posts back { challengeId, evidence }.
const verdict = await rh.verify(evidence, {
challengeId,
policy: "rootherald:builtin:strict-hardware", // real physical chips only
});
if (verdict.device.verdict !== "pass")
return res.status(403).json({ error: 'device_check_failed' });
const existing = await db.reviews.find({
deviceId: verdict.device.ueid, productId, since: '90d',
});
if (existing) return res.status(409).json({ error: 'one_per_device_per_window' });
await db.reviews.create({ deviceId: verdict.device.ueid, productId, body, stars });A 90-day window is a starting point, not a rule. Shorter windows catch burst farms; longer ones catch slow drip campaigns. Because the device id is stable indefinitely, you can change the window later without re-collecting anything.
Adjacent problems with the same shape
The same check solves neighbouring problems where “one real user” is the structural defence:
- Banned-seller return — a banned chip stays banned across emails, names, payment methods and shipping addresses.
- Dating-app re-signups — one account per device per period closes the spam-account spigot that defeats email and phone verification.
- Rideshare re-onboarding — deactivated-user cycles defeat email and phone changes; hardware doesn't change.