Partnered With:

Here's what the Internet giants don't want you to know about data privacy

Read this article in 15 Minutes

In the trillion-level information market, only privacy can guarantee your entry right.

Tesla's recent release of driving data has brought a key issue in the digital economy -- user privacy -- to the forefront after the company's recent "brake malfunction" incident.

In the context of COVID-19, people have become more dependent on the Internet in their daily lives, and many companies that were not involved in online business have been forced to explore new channels online.

People interact with different platforms, businesses and applications to generate a large amount of data, and the algorithm uses the data to more accurately meet user needs.

With the progress of science and technology, the shift of business paradigm, the way of data realization has become geometric leap, which also makes data become the biggest market in the 21st century. He who gets the data gets the world. However, data without privacy is like strewn gold, and Internet platforms are greedily devouring and abusing valuable "raw materials" to which they have no ownership.

This is a problem that cannot be ignored.

When it comes to data privacy, the first reaction of most users is: I don't want to give out private information, but I can't help it.

Indeed, Web applications in the Web2.0 world are now essentially about users exchanging personal data for services. To put it mildly, how do you get your food to your house without providing information? How can apps serve you more comprehensively without providing information? Forced to have no choice but to run naked in the Internet.

What's even more frightening is that everything is becoming connected. Internet applications are no longer limited to your computer and mobile phone. Increasingly, everything you can see and touch around you will become an application that is constantly acquiring data, and users will no longer actively and selectively provide data but passively "monitored".

This should not be the case. Data should be owned by the data producers, not the data users (application service providers), and the service providers should not use user data for rent-seeking.

Is there a privacy solution in the Web2.0 world?

Insufficient technology, manual remedy. Over the years, when technology doesn't allow it, manual manipulation has been the only compromise, as with all issues, including privacy.

The solution to privacy problems in the Web2.0 era is to improve legislation.

All countries have established relevant departments of data privacy protection and carried out legislation. In China, the Civil Law protects the rights and interests of data, the Criminal Law defines the crime of infringing personal information, the Economic Law regulates data sharing and circulation, and the anti-monopoly guidelines on platform economy issued by the State Administration for Market Regulation, etc.

But do these laws really guarantee privacy? Can user data really be protected from abuse?

The answer is no.

Last December was exposed to the "star health treasure photo leak" event, in a generation of photo group, at the beginning is 1 yuan to buy a star health treasure photo, then appeared 3 yuan can pack "TNT Times Youth League" 7 people's health treasure photos, and then, appeared 2 yuan package more than 70 artists health treasure photos, More than 1000 artists' ID cards are only sold for 1 yuan. It's not just stars that can be searched. A search for a name will show a person's face and nucleic acid test information.

Even on a food delivery platform, for the same order, the same merchant, the same delivery address, and the same time period, members spend more than non-members. The platform uses big data to price different groups differently, and it is common to see cases of waging rent-seeking.

What's the problem? Unclear legislation, asymmetric information, and insufficient punishment ultimately lead to difficulties in discovery, proof and identification, and the platforms take risks.

There will always be flaws in the mechanism, there will always be blind spots in the law, and manual control will not be a long-term solution.

The world of Web3.0 gives privacy back to users

Imagine if the user doesn't need to provide any information, or if the platform doesn't have any of your information, but it can still serve you?

It all sounds magical, but it's really math. Yes, zero-knowledge proof can do all this.

Zero-knowledge proof is an encryption protocol that allows the prover to convince the verifier that an assertion is true without providing the verifier with any information about the verified message.

After reading this short story about Alibaba, you can intuitively understand what zero-knowledge proof is.

Ali Baba met robbers, robbers want to get into the cave from the mouth of the spell, but Ali Baba was afraid that after the spell of the robbers do not leave it alive. How, Ali Baba thought, could he prove that he knew the spell without revealing it?

Alibaba had an idea. Ali Baba kept the robber far enough away from him to be unable to hear his incantations. Ali Baba will make the cave door open when the robber raises his left hand, and Ali Baba will not recite the mantra when the robber raises his right hand. After repeated verification, the robbers decided that Ali Baba did know the magic to open the cave. Ali Baba also proved to the robber that he knew the incantation without revealing the incantation itself.

In real life, the user is the certifier and the service provider is the verifier. Thus, the zero-knowledge proof allows the service provider to still provide the service without leaving any trace of data that can be extracted.

There are already many applications on the chain that use zero-knowledge proof, most notably the well-known anonymous coin Zcash. Zcash uses ZK-Snarks (concise non-interactive zero-knowledge proof) consensus proof to enable users to transfer money under the condition of complete encryption of information, and guarantees the verifiable performance of transactions for verification by nodes. Specifically, Zcash addresses are classified as "z-addresses" and "t-addresses", and transactions between those addresses appear on the chain, so everyone knows that a hidden transaction has taken place and a fee is paid to the miners. But the address of the transaction, the amount of the transaction and the note field are all encrypted and invisible to the public. Owners of addresses can also choose to disclose hidden addresses and transaction details to trusted third parties to meet audit and regulatory needs. A transaction between two transparent addresses is no different from a Bitcoin transaction, and money can be transferred between a covert and a transparent address.

Back to the recent case of Tesla's public release of driving data. In order to prove its innocence, Tesla released the data of the accident to the public without the user's permission. If the information is encrypted by zero-knowledge proof and transmitted to the Tesla algorithm protocol, Tesla will not be able to obtain the metadata. If Tesla wants to use the user data, it must obtain the user's permission in advance. After the accident, if the judicial department needs data to collect evidence, the user is willing to cooperate with the investigation, the encrypted information can be made public.

Imagine a future in which, with the help of zero-knowledge proof, users can prove that they are healthy without having to provide their name, photo, or whereabouts, or they can prove that they are immune to a novel coronavirus without having to provide information about how they were immune (antibodies or vaccinated). One day, robots will be able to deliver food to people's doorsteps without having to provide their name, phone number or address to the platform.

Zero-knowledge proof is not entirely new. As early as in the early 1980s, the theory of "interactive zero-knowledge proof" was put forward by Goldwasser et al. At the end of the 1980s, Blum et al further proposed the concept of "non-interactive zero-knowledge proof". But why aren't today's Internet platforms adopting this technology?

First of all, from the perspective of technology, any innovation needs to go through decades of efforts and precipitation from theory to practice. In recent years, zero knowledge proof really becomes an applicable technology. However, compared with traditional solutions, the use cost of zero-knowledge proof is still too high and inefficient, which is unacceptable to both the platform and the user.

From the economic point of view, users have formed a fixed thinking that they must provide information in order to get services, and it is natural for platforms to obtain information now. In the face of huge interests, it is difficult for the platform giants to compromise. From a user perspective, most users do not yet realize the importance of privacy and the value of the data they generate, so they do not have a strong desire to promote privacy solutions.

Aleo is a good example of a facilitator in terms of technology solutions. Starting with on-chain applications, Aleo reduces the development threshold and use cost of privacy applications, making privacy the default property of applications. This is important for privacy applications to be adopted on a large scale, just as the Cosmos SDK and Substrate have been instrumental in driving the app chain paradigm.

However, user education may be the most important of all issues. If users don't understand the importance of privacy, they will always be under the control of the Web2.0 platform, and any extra cost will be rejected. Users should understand that ultimately the platform is only the provider of the algorithm, not the owner of the data, and has no right to abuse the user data.