> What is stopping hackers from purchasing one game legitimately and just spoof the data after?

If you mean "spoof" in the sense of duplicating the certificate/ticket: Because two consoles would try to use the same cart certificate/ticket.

If you mean "spoof" in the sense of making a fake certificate/ticket: The certificate/ticket are signed by Nintendo, so they can verify on the server side if it's fake or not.

If you mean spoof the console data: As far as I know, you require an NNID to go online, which the console is tied to. So the pirates would have to share login data and chain all the carts/tickets to that one console and login combination. That's probably going to be practically infeasible. Even if it wasn't, Nintendo could probably notice an odd amount of sign-ins coming from a single console, yet also all over the world.

Didn't read the reddit post, but usually the way these things work is there are two cert checks. One for the console and one for the game. The game cert is signed (or there is a signature somewhere) by both the console cert and Nintendo's game-cert CA (not to be confused with Nintendo's console-cert CA which may have the same root but are unlikely the same) in that order. Both are checked server side.

You can't spoof the data, it's generated unique to each game then signed by Nintendo in a way that isn't reversible to anyone else.

Yeah, i have read the reddit post now [1].

If i understood correctly, Nintendo only allows access to online features of the game specified in that particular certificate.

[1] - https://www.reddit.com/r/SwitchHacks/comments/8rxg26/psa_str...

This does mean that you can buy a game, hack it using a modded console, and play online.

This doesn't prevent cheating in online games, just piracy.

> signed by Nintendo in a way that isn't reversible to anyone else.

Well, now you're just challenging people.