Has Web3 got its priorities wrong?

Category: General

Has Web3 got its priorities wrong?

Sergio Barbosa, CIO, Global Kinetic

Co-founder and CIO of enterprise software development house, Global Kinetic, Sergio directly heads its open banking platform, FutureBank. A skilled software engineer, innovative product developer, and keen business strategist, he has participated in several notable fintech milestones, including building the southern hemisphere’s first digital-only bank all the way back in 2002.

Surveying the sorry state of consumer privacy a couple of years ago, Alan Rusbridger hypothesized a privacy “techlash” in the Guardian. In it, he nodded to a Washington Post tech journalist’s description of us “gleefully carrying surveillance machines in our pockets”, but he wasn’t calling on us to throw our phones into the Thames just yet. He felt encouraged by developments like edge computing, encryption, and blockchain:

“One estimate is that there may be 200 or 300 startups, SMEs and entrepreneurs rethinking the ownership and value of data. Finland’s MyData project is just one high-profile attempt to let individuals regain control of their own data. Other players are exploring how blockchain can strengthen privacy as a basic consumer right. The jury is out – and doubtless will be for a while yet.”

Yes and no. It’s two years later – we’ve seen an explosion in use of Signal, DuckDuckGo, DeFi, and NFTs – but the jury’s still hotly debating that exact question: the role of blockchain in protecting PII.

Enter witness for the prosecution Moxy Marlinspike.

For those who don’t know, Moxy Marlinspike is a highly respected cryptographer and digital security specialist, a former head of security at Twitter and the founder of Signal, the privacy-optimized answer to WhatsApp. In January, Marlinspike wrote a blog post on his impressions of Web3 in its current state and his thoughts about where it would go.

Given his high profile, technical expertise, and articulate, deliberative style of communication, the post was always going to draw readers from the techie scene. His negative assessment, relying in part on his own eye-raising, real-world experiences, meant it got a lot more attention than that. It seems anyone and everyone has said something on the piece – now, me included.

Read Sergio’s earlier blog post on Web3 here.

Web3 and the problem with servers

Web3’s idealists hope that by jumping the shiny tracks laid by the Big Tech companies, we will snatch back our privacy and reestablish personal autonomy and control within decentralized networks of computers owned by, well, just about anyone. But, in his post, Marlinspike points to a flaw in the plan:

“When people talk about blockchains, they talk about distributed trust, leaderless consensus, and all the mechanics of how that works, but often gloss over the reality that clients ultimately can’t participate in those mechanics. All the network diagrams are of servers, the trust model is between servers, everything is about servers. Blockchains are designed to be a network of peers, but not designed such that it’s really possible for your mobile device or your browser to be one of those peers.”

Servers are everywhere but in consumers’ hands. Since the average Joe or Jane only has clients (browsers and mobile devices) at their fingertips, their access to the system must be mediated by third-party–owned services provided through servers called nodes. “They’re like the gateway to the blockchain realm” says QuikNode, a provider.

Gateway or gatekeeper? Jack Dorsey and the Bitcoiners believe that already powerful crypto ventures have made accommodations for the sake of speed and functionality, which has weakened security and consolidated power in only a few hands – by making setting up and running independent nodes difficult, for instance. The benefits of the blockchain are being wasted in attempts to kickstart new network effects and maximize profits for VCs and early adopters, they say.

Marlinspike may or may not agree – he’s playing philosopher king or elder statesman to Dorsey’s freedom fighter here. It’s just that he doesn’t see control of nodes as the problem per se. He’s adamant that no-one – not even “nerds” – wants to run their own servers and it’s by ignoring that fact that we risk repeating history: “To make these technologies usable, the space is consolidating around… platforms. Again. People who will run servers for you, and iterate on the new functionality that emerges. Infura, OpenSea, Coinbase, Etherscan.”

He makes the case for a re-do:

“We should accept the premise that people will not run their own servers by designing systems that can distribute trust without having to distribute infrastructure. This means architecture that anticipates and accepts the inevitable outcome of relatively centralized client/server relationships, but uses cryptography (rather than infrastructure) to distribute trust.”

He believes this will help prevent Web3’s platformication, something that is already well underway. At present, OpenSea has around 95% of the global NFT trading market cornered, with volumes 12 times its closest rival. Ethereum had a similar stranglehold on decentralized finance at the start of 2021 but has lost share as it struggles to scale. Infura and Alchemy control almost all of the market for node services. Coinbase has over half of bitcoin trading wrapped up. It’s no surprise that Coinbase didn’t make a splash at Bitcoin 2022 this year, the biggest crypto event in the world. There’s no need.

OpenSea has around 95% of the global NFT trading market cornered, with volumes 12 times its closest rival. Ethereum had a similar stranglehold on decentralized finance at the start of 2021 but has lost share as it struggles to scale. Infura and Alchemy control almost all of the market for node services. Coinbase has over half of bitcoin trading wrapped up.

Defenders of the evolving crypto ecosystem say that there are more and better alternatives to these providers popping up all the time, but that’s missing the point. As CoinDesk reporter Will Gottsegen wrote in October last year in relation to NFTs: “Decentralized computing doesn’t necessitate a decentralized market structure.”

It’s Wild West stuff, this

Published a month ago and with 5.5 million views and counting, Dan Olson’s YouTube demolition job “Line Goes Up – The Problem With NFTs” might put him up there with Marlinspike in the rankings of influential cryptocynics. It’s “viral”, if something over 2 and a quarter hours long can be called that. Discussing the video, Casey Newton at Platformer wrote :

“[I]t’s undeniable that today web3 is a mess — and not just in a ‘we haven’t finished building it’ sort of way. Web3 is a mess of a kind that it could take five or more years to fix, and that assumes the work gets started soon. And the thing is … I’m just not sure people are working on these things.”

Like, what things? Well, privacy and security. “It’s hard to imagine a bigger hurdle to the mass adoption of blockchain technologies than the absence of basic trust and safety features, and yet to date, we’ve seen very little,” says Newton, suggesting that few crypto insiders really care enough to prioritize solutions.

When Time asked economist, crypto investor, and Twitter influencer Tascha Che to answer Olson’s charge that aspects of blockchain technology encouraged fraud, she replied that blockchain was no more secure than centralized databases: “The point of the system is a revolution in how we distribute value. The point is not inventing a system that is more secure than the centralized system.”

Security – and particularly fraud prevention – ought to be hard-baked into a system like Web3 where transactions are irrevocable. It needs mechanisms to ensure only legitimate transactions take place.

I’m not sure that’s something you want to put in the brochure. Security – and particularly fraud prevention – ought to be hard-baked into the Web3 world where transactions are irrevocable. It needs mechanisms to ensure only legitimate transactions take place. There isn’t anything like this currently (apart from Bitcoin itself, of course).

Remember the businesses running nodes to which consumer-side clients must connect in order to access the blockchain and use Web3 applications? On a “zero-trust” system, their word is taken for gospel, for no other reason than that Web3 apps almost never authenticate the information they pass to and from the blockchain. Marlinspike blogged:

“These client APIs are not using anything to verify blockchain state or the authenticity of responses. The results aren’t even signed. […] So much work, energy, and time has gone into creating a trustless distributed consensus mechanism, but virtually all clients that wish to access it do so by simply trusting the outputs from these two companies [Infura and Alchemy] without any further verification.”

These apps aren’t using even the most basic security best practices, and it’s the same for wallets, the actual stores of value, because they’re clients too. Information may have been tampered with; it may not even be coming from where it should. You wouldn’t know.

Web3 is still small and dominated by relatively few companies. It does seem odd that they haven’t yet taken the opportunity to address a matter so central to its future success: security.

Finding alignment on large-scale security issues among many stakeholders is a challenge at the best of times; in a decentralized system, it can seem impossible. But Web3 is still small and dominated by relatively few companies. It does seem odd that they haven’t yet taken the opportunity to address a matter so central to its future success. In the minds of consumers, FOMO doesn’t apply to being hacked. An app isn’t going to replace the need for collaboration.

Safety first

Despite a decade of work and the enormous amounts of money being thrown at it, Web3 remains an insecure if not dangerous place for the initiated and uninitiated alike. Marlinspike is one of many who have made the point, and it is arguable whether its vulnerability to recentralization is a bigger threat to adoption than that.

A look into the Web3 job jar

  • Institute a central authority to document and communicate its systemic weaknesses and current vulnerabilities.
  • Agree on a process to address security incidents and make system-wide design changes to head off more.
  • Develop a mechanism through which all stakeholders can collaborate on managing emerging problems.
  • Provide an avenue for victims of fraud to find recourse and mitigate the results of hacker attacks.
  • Formulate standards for encrypting data and authenticating transactions before they take place.[1] 

For financial institutions exploring Web3, it certainly does look like the next version of the Internet – soon to enter its tweens – has a lot of growing up to do.

Most banks and credit unions will act towards Web3 as prudently as they always have; I probably don’t need to advise them to make any investments in technology very carefully. Similarly, I don’t have to remind them that it isn’t necessary to risk it and build it themselves. Platforms like FutureBank can provide them a highly-secure native integration to the freewheeling new world of opportunity and set them up fast to take advantage of fast maturing use cases like embedded finance.

Wondering about doing business on Web3?

Contact Global Kinetic for our assessment of the risks and rewards.