Research Summary - What is in Your Wallet? Privacy and Security Issues in Web 3.0

Privacy
, , ,
21

Great comment @cashkid18, your view on the pros and cons of data privacy is quite keen.
@tolulope, a great question I think it largely depends on the priorities as a society.
@cashkid18, your response is succinct they are both imperative but as a society where do you think our priorities lie based on your view and can you give more suggestions to the core question- What requirements do DeFi sites need to ensure user privacy and security?

2 Likes
22

Hi Tolu

Your summary inspired an article Iā€™m working on at the moment. Currently, Iā€™m reading through while researching the subject matter.

Just like I thought, there is a huge disconnect between the security beliefs in DeFi and the current reality. And it pains me to know that many users are ignorant of these issues.

This part paints a vivid picture of how our beloved decentralized finance is not without elements of centralization. It also reminds me of a Twitter space I joined two weeks ago, where I learned that MetaMask, TrustWallet, and other dubbed Web3-native dapps are more centralized than we think.

Which brings me to my question?

Will Web3, Crypto, and DeFi be permanently rid of the centralization which evidently complicates and puts users at potential risk?

Additionally, how can users be made aware of these risks and how they can better secure themselves?

1 Like
23

Thanks for your comment @Harvesto. Canā€™t wait to read your article!

Centralization does put users at potential risk considering the high level of third-party involvement, control in central authority, single point of failure, lack of transparency and so many other issues. Will it end? Well, we will have to wait and see as some people will always favor centralization over decentralization.

I think there can be two approaches to this - first, from the DApps and second, from the general public. DeFi Apps could take on the responsibility of researching associated risks and educating users about them on their platforms. Also, people in the general public who are knowledgeable about these risks could do so by creating awareness, writing articles, and hosting webinars for other people who may not have the same level of knowledge.

4 Likes
24

When I signed up for the SCRF badge, I was told to connect my MetaMask wallet to the right website. If the websiteā€™s security is breached, will there be a threat to the assets I own?

If yes, what extra protection do you recommend?

2 Likes
25

Can you throw more light on the centralized nature of MetaMask, TrustWallet and other dubbed Web3-Native dapps?

3 Likes
26

As noted in the research and summary, these so-called Web3 native dapps have some form of third-party scripts embedded in them - mostly because they interact with protocols.

Furthermore, Metamask and TW data are hosted on cloud software like AWS which poses a huge risk.

What if the servers go down temporarily or permanently?

What will happen to user funds?

Then, you have the issue of hacks, which could result from the third party scripts or other possible attack vectors the hacker figures out.

3 Likes
27

Discussion Summary.

  • De-Fi has been perceived as a more secure, private, less centralized alternative to traditional financial systems, but De-Fi applications may not be as secure as previously thought.
  • Third-party applications embedded in DeFi applications and services may result in data leaks; script blockers can help to prevent trackers from operating but are not a permanent cure.
  • The authors proposed a remedy to identified vulnerabilities by designing an in-browser patch for MetaMask to prevent third-party address leaks.

Tags.
Security, Privacy, Web3, Wallet, and De-Fi.

Points of Disagreements.

Differences in Functions.

Unresolved Question.

  • To the original point that was part of the summary, however, do the developers of DeFi projects also have an obligation here? Would the user advice that you are providing here be sufficient to identify things like the third-party scripts being discussed here?
  • What requirements do DeFi sites need to ensure user privacy and security?
  • What will happen to user funds?

Points of Consensus.

Offered Solution.

Identification of Consequences.

  • Web 3.0 addresses many of Web 2.0ā€™s privacy problems regarding identity, yet anonymity and decentralization have drawbacks. For one thing, anonymity makes it harder to hold bad actors accountable for their acts and provides little to no consumer protection. Furthermore, anonymity makes regulation more difficult while also making money laundering and terrorist financing easier. Furthermore, decentralized identification challenges current requirements such as GDPR and makes it harder for data controllers to determine user identity.

Key Resources

3 Likes
28

Depending on the level of access you have granted the website, I believe if there is a security breach, you will be affected in one way or another, but the security of your assets will depend on the security measures implemented by MetaMask. However, in the event of a security breach, you will be exposed to many threats including social engineering attacks, which can inadvertently lead to a loss of assets as well.

3 Likes
29

Great points to consider, it has become even more clear recently that although the optionality for private transactions or increased security is available, developers might not have the right incentivization for improving their infrastructure.

Most instances of this have occurred when communities warn team members of potential security risks, yet these warnings are ignored until they become exploited.

The better a projectā€™s chances are of preventing a DeFi breach, the quicker it installs these security patches.

To this point, I think there are many instances where human errors hinder any effective solutions being made. Instead, users tend to warn protocols of failed audits but eventually pay the price when a project feature becomes exploited.

2 Likes
31

Human error is one of the main reasons why solutions arenā€™t implemented well. One big problem with smart contracts is that they canā€™t be changed. There is no way to fix bugs or flaws in the code after it has been deployed. Before smart contracts can be used, the code must be checked for bugs and tested to see how well it works.

When smart contracts interact with each other and with real-world systems like financial institutions, there could be risks and holes. So, itā€™s important for people who work with smart contracts to be aware of the risks and take steps to reduce them. We can use access restrictions, encryption, and multi-signature authorization to make sure that only the right people can get into smart contracts.

Like any other software, smart contracts need to be updated and patched regularly to fix security flaws in the code so that they canā€™t be used in bad ways.

Lastly, to make sure smart contracts are safe and reduce the chance of a mistake being made by a person, research should include thorough audits and testing, an understanding of real-world risks and weaknesses, security protocols, and frequent code upgrades.

It will interesting to explore smart contracts and AI or the integration of both