Our private lives have turned into a public asset. Today, the web’s business model is to offer free services in return for personal data. Web services then monetize that data. Users are not really offered a choice; instead, they are pushed to surrender their data in exchange for the services they want, and often in exchange for nothing, at the expense of personal privacy. As web services become more personalized, this model increasingly pits those services against their users.
The obvious reaction is to look to regulation to solve the problem. In recent years, fresh rules such as the European Union’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) have been introduced, requiring web services to give users the option not to be tracked and to have their data deleted. These requirements, however, have created perverse incentives for web services. Users are shown consent banners that are at best confusing and at worst misleading. Each web service follows its own convention; some prompts default to opt-in tracking, while others default to opt-out. Over time, users stop paying attention to these banners and choose the default, handing their data to web services.
At a more basic level, the incentives of users and web services must be brought into alignment if change is to be genuine, effective, and durable. Fortunately, we are about to see a shift in the way the web operates. New cryptography-based technologies are making possible a class of web services that align more closely with users’ incentives. And beyond simply addressing data ownership, these technologies enable new capabilities that can make the web fairer and more centered on users.
Blockchains + serverless computing = user control
Over the past decade, consumer devices have become much more powerful, making it possible to run applications with rich user experiences directly on-device. Alongside the increasing globalization of web services, the need for quicker loading and processing has made serverless computing a new application norm. This shift has moved business logic from servers to clients.
This seemingly small shift matters a great deal. At the center of the serverless revolution are blockchains, which are public, immutable ledgers that enforce the scarcity and proper ownership of data and logic. Fundamentally, blockchains let users interact directly with one another, without centralized servers or third parties needed to broker and enable services.
Blockchains give users ownership and control. Their introduction has made it possible for assets and public resources — including financial assets, domain namespaces, and even works of art — to be owned and administered by users themselves.
Conventional server setups are vulnerable to crashes, and are run by third parties who usually keep custody of user assets and data. For the first time, blockchain-based services can deliver 100% uptime and availability, supporting a user experience that is consistent, seamless, and borderless. Users gain control of their assets through direct ownership of their blockchain accounts, without third-party mediation. Although blockchains offer many advantages for users, they also bring three major drawbacks:
- Major scaling challenges. Because these open networks require every participant to store and validate ledger state, the network’s own capacity to handle a large number of transactions is limited. Current designs are prone to congestion, expensive transaction fees, and low transaction throughput. Limited-execution environments. Since all participants are presently required to re-execute every transaction in order to verify ledger state, every service on a blockchain is effectively sharing a single global compute resource over time. This means most web applications today cannot run on existing blockchain architectures. Loss of privacy. Services on blockchains today are pseudonymous, meaning they reveal account state to every participant in the network. So while users can reclaim control of their assets, that may come at the expense of personal privacy if links between that activity and other metadata reveal more than people realize.
For any broadly used application to rely on this technology at scale, these three issues have to be solved. Cryptography — techniques for secure communication and private information exchange — offers a path for blockchains to support practical applications.
Zero-knowledge proofs
In recent years, a new technology known as zero-knowledge proofs has become practical for real-world use. At its core, a zero-knowledge proof is a protocol that lets one party (the prover) persuade another party (the verifier) that they hold some private data without disclosing that data to anyone.
This technology, which has existed for decades and only recently became practical thanks to modern computing, has far-reaching consequences. Unlike most web technologies today, zero-knowledge proofs let users run business logic on their personal data and demonstrate to others the correctness of the computed result (again, without exposing their personal data) — and they also let users know with certainty how their personal data is being used while keeping full control of it. These qualities are essential for addressing many of the data and privacy issues the regulations above have tried to solve, with a less blunt instrument.
When zero-knowledge proofs are used to support services running on blockchains, applications can scale without limit because participants in the network no longer have to re-execute every transaction in the ledger. Instead, participants only need to verify a succinct proof that is both constant-time and constant-size. This not only means applications executed with zero-knowledge proofs are faster to process, but also that applications can be arbitrarily large without hurting blockchain throughput. These qualities make it possible to scale applications that were once considered impractical in peer-to-peer web architectures.
New web standards built on zero-knowledge proofs and blockchains will therefore give users choice by adding a new privacy layer to the web. What if our private lives could no longer become a public commodity, and the web were private by default? Let’s look at the possibilities.
Making web services more secure
Think about web authentication standards today. When a new user creates an account, they enter their password and send it to the server. The server receives the user’s password and then “hashes” it, storing that hash in a database and creating a fingerprint to compare against the next time the user signs in.
But this standard is flawed. For one thing, even experienced web services mishandle passwords and leave users’ information exposed. Second, some web services use poor practices by requiring weak password rules, failing to hash users’ passwords, or simply selecting a weak hashing algorithm. This means that if a web service experiences a data breach, users’ passwords are more vulnerable to dictionary attacks (whereby commonly used passwords are easily broken) or immediate compromise.
With zero-knowledge proofs, however, users can now hash their password on-device, meaning without ever needing to send their password to any web service. Imagine never having your password compromised again because of other people’s mistakes, malicious actors, or circumstances outside your control.
No web service can do this today because there is no way to confirm that a user correctly hashed their password on the client side. Given the shift from server to client mentioned earlier, this is where we are practically today. But by adding a new technology that lets services verify the correctness of all computations on the user’s device, without needing to pass through someone else’s server, web services will know with certainty that the password was hashed with the correct algorithm.
Increasing compliance, and fairness
One of the most discussed uses of blockchains is programmable money and decentralized finance (DeFi) — including decentralized exchanges, where users can trade value directly with one another over open, public networks. Rather than limiting financial services to traditional banks and brokerages alone, blockchains open the door to a financial revolution that can include more people in the system.
The difficulty is that although users can now directly own their assets, their financial transactions in this model are also visible to anyone. This means their trades could be exposed to frontrunning and arbitrage by anyone watching the exchange. Not only is this an issue for users, it also conflicts with exchange regulations and banking privacy laws. With zero-knowledge proofs, however, exchanges can handle users’ trades privately, receiving a zero-knowledge proof that attests to the validity and legitimacy of each completed trade. This means only the users who are carrying out an exchange can see the contents of the trade; not even the exchange knows the trade details.
So wouldn’t that create yet another set of problems by hiding this information from important know-your-customer and anti-money laundering compliance laws (KYC/AML)? That’s the advantage of zero-knowledge proofs: At the moment of use, they create an audit trail that lets users (and regulators) verify the honesty and correctness of each trade that occurs on an exchange.
The near future of the web
The web has changed in many ways — we moved from HTTP to HTTPS, which sparked an explosion of ecommerce, trust, and exchange on the web. Yet we are still at the start.
The next stage, the next decade, will center on the ability to engage with anyone, anywhere, at any time — privately, without exposing one’s data, and with more control in the user’s hands. For this to occur, however, zero-knowledge proofs and blockchains will need to reach standardization across web ecosystems and web developers. Zero-knowledge proofs will need to keep improving performance to support large-scale applications. And blockchains will need to adopt zero-knowledge proofs to scale and gain real-world adoption. This means web services will need time to integrate these technologies, and users will need to learn the guarantees and implications of these new standards.
And while regulators will be equipped with new tools to protect users on the web, they will need to embrace the opportunities these technologies provide for security, privacy, compliance, and fairness. For example, enforcing compliance at the time-of-use instead of after-the-fact log inspections introduces a new level of auditability and traceability for web services. Regulators will need to develop new frameworks based on these technologies for private money and private applications.
But what these technologies can do for us will be genuinely transformative. Zero-knowledge proofs will reshape the privacy guarantees that web services provide, and flip the model for how users handle their personal data. Blockchains will let users truly control their financial assets and personal data, without needing third parties to keep control in ways that do not always benefit users. As more and more people rely on the web for their daily lives, this paradigm will fundamentally alter how users around the world relate to one another … and in ways we have yet to fully understand. Just as smart devices became integral to our daily lives, a privacy layer for the web will be the basis for how we interact and share, and it will change everything.