I'm quite new to NFT and still trying to understand the full workflow... the problem I need to understand is ... when someone buys an NFT I think a link with the digital asset is available to allow the download of the content (for simplicity suppose an NFT); as far I've read on an IPFS filesystem, so a CID or a human-readable link will be sent.
Now, if another user holds the same link, he can download the content without authentication I think... is this so?
And is this a possible scenario? :
- I own an NFT with its URL
- Someone takes the URL and downloads the file
- Supposing it's an image file at high resolution, he changes one pixel
- He mints a new NFT for the image I currently have the right on another platform
- He can sell the NFT
Is this scenario possible? I think that platforms such as opensea have some way to verify the property of the NFT, but if the image can be downloaded by anybody, how can this be secured?
Thanks