Original title: "Foresight Ventures: Understanding the Other Side of Web3 "Privacy""
Original source: Foresight Ventures
In the era of WEB3.0, users own data on the chain, and the data is open, transparent and traceable. We seem to have found a utopia of freedom and equality, On the other hand, how to protect users' privacy will be another Holy Grail.
Here is the mind map of the article:

In the tenth chapter of the Bitcoin white paper, Satoshi Nakamoto spent the entire chapter describing the Bitcoin network Privacy model. In the traditional banking model, participants and trusted third parties have limited access to information, which achieves partial privacy. But on the blockchain network, transactions must be guaranteed to be open, so the privacy of Bitcoin It is maintained through the anonymity of the public key. Usually we cannot associate who this is from a randomly generated public key (although we now have tools such as giant whale analysis that can infer this information).
< p>In the example given by Satoshi Nakamoto, the privacy design of the blockchain is from "the evolution of the bank to the Bitcoin network". We can extend it from this example to "Web2 to the In the privacy design of Web3". We assume that the underlying network of Web3 will be a blockchain network like Bitcoin. Then the privacy we discuss will have the premise of transaction disclosure, data open source and decentralization. p>

p>
In fact, we have long realized the importance of privacy on the Internet. When accessing the Internet, elementary school information class teachers and parents will ask you not to reveal your real name on the scary Internet. After all, you don’t know the screen Who is behind.
But we also realized the importance of privacy in the Internet very late. Our clipboard is frequently read by third-party applications, our Preferences and actions are sent to Google Analytics from countless websites (if you press F12 now, open your browser's Console, and click on the source, you can probably see it), our data is sold with a clear price, these behaviors are Unknowingly stealing our data and privacy. In recent years, we only realized that we have been destroyed by some Internet companies for a long time, so we started to use Telegram, Duckduckgo, Mirror and other applications...Of course Most importantly, in the Web3 era, privacy has finally been valued by users and developers with the popularity of the blockchain. In the open and user-led Web3 era, privacy protection will be a standard configuration.< /p>
Privacy in the Web3 era = confidentiality+ Anonymity = Data Privacy + Identity Privacy + Computational Privacy
In the era of Web3, assuming that all the interactions we do and the network traces are in the Interact with applications on the chain, then all our data will be transactions and the information contained in the transactions. Taking the transferFrom function in ERC-20 (parameters are _from, _to, _value) as an example, the transaction will It is composed of the following contents: transfer sender, transfer receiver, transfer amount. For these transactions, we can define privacy, anonymity, and confidentiality in the Web3 era.
Anonymity refers to: the sender and receiver of the transaction (real identity) need to be non-public, and the transfer amount can be public (only the _value parameter can be known). Confidentiality refers to: the transaction The transfer amount and other content need to be non-public, and the sender and receiver can be public (only _from and _to can be known). The real privacy (Privacy) should be anonymous + confidential, referring to: all the content of the transaction , including the transaction sender, transaction receiver, and transfer amount need to be non-public.

Based on this, further privacy is , Web3 users need to be given the right to choose whether to disclose data before the transaction is sent, allowing the user to actively choose whether the transaction requires privacy. After the transaction, the user actively chooses the privacy of the transaction execution, which cannot be tampered with Depending on the characteristics, it may be difficult to achieve.
Data privacy is For confidentiality, it mainly includes two parts: control and ownership of data and confidentiality of data content itself.
User data should not be a product. Users have absolute control and ownership of data, which can guarantee the ownership of data and prevent unauthorized operation of data by the platform, which is a manifestation of privacy .

In the Web2 era, the user is the product. Recall, right? Almost all search engines, e-commerce platforms, and video sites have countless advertisements? Companies in the Web2 era regard the number of users as their property, and users are the source of their advertising revenue. From cookie tracking to Google Analytics, every operation you perform , Stay on the page for a few seconds, you will be tracked down. And you may just tick the privacy agreement that no one has ever read. In the future, as the network becomes more popular, more users and data will flood into the Internet , to bring more generous rewards to companies specializing in data theft. In the Web2 era, the default situation is that users have no privacy, and users have no control and ownership of data.
Data should not be products, but information. In the Web3 era, users need Have control over the data, every interaction and transaction made and the data generated need to belong to the user. Only the user can decide how to dispose of the data. The ownership of the data is not determined by the application, but by the subjective wishes of the user Benchmark is also a reflection of privacy for users.
The application of the Web2 platform is like a farmer, which will circle a piece of land for users and monitor it 24 hours a day Let users generate data. They make profits from the data they generate. The application of the Web3 platform is more like a personal butler, helping you manage your data, and will not spy on or misinterpret your data without your knowledge. With the help of an open database such as blockchain, Web3 applications hand over the control of data to users, and what the application does is to help users operate data better.
Data Ownership
According to Vincent's article about Web3 reshaping data value Yes, users can obtain value from all their data. In the Web2 era, data is valuable, but it is the property of the company, and the value does not belong to users, nor will it be distributed to users. In the Web3 era, data on the chain is a golden mine, and it is a gold mine owned by users. The more Web3 applications, the more data, the bigger the gold mine.
Web3 users can bring Surfing the Internet with your own data gold mine in the Web3 era. Imagine bank data exchange, social media data exchange, video website data exchange... In fact, you don’t have to imagine, this has already happened in Web3. Every footprint of yours All stay on the chain, in your address. If you switch to another DApp to interact, you don’t have to start from scratch, because the previous data will always belong to you and accompany you.
When you use chat software on Web2, you are talking with others on Facebook's centralized server; while on Web3, when you use chat software, you will be talking to yourself, and all the data will be stored in your own account, and what the chat software does is to grab the data you own on the chain.
The relationship between data ownership and data privacy is not particularly great , so I won't overextend it here, but I highly recommend you to read the article mentioned above.
Arweave
Arweave is a permanent storage blockchain. In the worst case, Arweave can store data for 200 years (for an average human Say, it’s permanent). Although there is no rival in terms of permanent storage, the real value of Arweave lies in the permanent control and ownership of data.

The data uploaded by Web3 users and developers to Arweave will never be closed (> 200 years), and will always belong to the user and the entire decentralized network. Users have absolute control over the data and will not be removed .Permanent data is only the first step. The real point is that through the entire permanent storage network, all people participating in Arweave share the risk of data being removed from the shelves. The NFT uploaded to Arweave will never be deleted. The real value of NFT ownership to users. An ever-existing NFT and NFT ownership should be a necessary feature of NFT.
Decentralized Arweave In addition An anti-censorship content platform that can be made through open source contract code (as a data filtering and processing tool) and public on-chain data (as raw data), is the Alexandria library that can never be destroyed. This is user data in the Web3 era The last mile of ownership is the perpetuity of data and ownership.
Recently everFinance has created a Mirror search engine on Arweave. Any data in it It is taken from Arweave, a decentralized network. Users will not have to worry about whether their beloved media platform will be taken off the shelves due to various pressures one day. If you want to BUIDL more platforms through Arweave's permanent data, you can try Use this open source library.
Crypto Wallet
Encrypted wallet is a very important point of data control. As the entrance of the Web3 era, encrypted wallet is as important as the Google search engine of Web2 (of course encrypted wallet will not collect and sell your data like Google).< /p>
All encrypted wallets (Metamask, Bitkeep, etc.) embody Web3 users' control over data. Every transaction and operation on the chain is controlled by Signed or agreed by the user. Users clearly know what data will be disclosed and what interactions will be recorded on the chain, and they don’t have to worry about being tracked by the application. This is an aspect of privacy that exists widely in Web3 but is often overlooked. But Web3 users have already quietly enjoyed the privacy experience of controlling data.
Data control and ownership will bring better UX< br>
Under the Web3 trend, almost all user data can be viewed at will, and how to use these data is decided by the project itself. Web2 developers will first To compete for data, let users enter one by one, and let users become cows that continuously produce data, instead of thinking about how to use better apps to attract users. According to DuckDuckGo's analysis of popular free Android applications, 96 % of free apps on Android contain third-party trackers, 87% of which will send data to Google and 68% to Facebook. The homogeneity of data on the blockchain allows Web3 developers to interact and Competing on purpose will directly improve user experience.
In the era of Web3, users are no longer products, and user data is no longer controlled by a single entity and Utilize. The user's data belongs to himself, and the user has independent control and permanent ownership of all interactions. The data of Web3 also belongs to the entire transparent decentralized network. This is definitely an important issue for user privacy. Good thing.
Confidentiality of data content is applied through private transactions To achieve. Through technologies such as zero-knowledge proof and currency mixer, the input, output and amount in the transaction can be protected by privacy.
The confidentiality of data content refers to The main thing is that the specific content of the transaction, or the user's transaction records, are encrypted or not disclosed. We can think that hiding the input and output addresses of the transaction or blurring the specific amount of the transaction is a manifestation of the confidentiality of the data content.
Privacy transaction
Ethereum’s account system itself is No "privacy". If you perform a claim ENS airdrop operation, your address will be exposed on the contract interaction record, and others can review all your transactions. In real life, this is Similar to when you go downstairs to buy coffee, your house purchase and hotel consumption records may be viewed by others. This is also similar to the whereabouts of infected people during the new crown period will be completely exposed. Such exposure will affect the entire health system and the blockchain network. Security is a good thing, but it is a relatively harmful thing to privacy for individuals.
For example, the following picture is the address of a hacker, He crawls the private key leaked by others on the Internet, and then the victim will be transferred by hackers as soon as he receives the airdrop. We can clearly see his criminal process. Although it is very just for us to examine his criminal process, it leaks His privacy...

A very simple and violent method to achieve private transactions is to encrypt all accounts and transactions Then decrypt it. However, this method is very expensive and time-consuming because it involves network verification of the transaction.
It should be noted that the private transaction here Only the originally transparent on-chain data is hidden and not disclosed. The privacy and security of the amount on-chain and off-chain will be discussed in subsequent chapters.
Aztec (zk.money)

Aztec's zk.money is a zkRollup Layer2 on Ethereum that specifically solves privacy issues .
zk.money By directly abandoning the Ethereum account system and switching to the UTXO system to achieve private transactions. It directly uses bills to keep accounts. A transaction is no longer a state change between two related accounts, but a change of ownership of a note. Encrypting a note is much simpler than encrypting a transaction between accounts.
< /p>
zk.money transactions are invisible to third-party users. For the entire Aztec network system, double spending and other issues must be avoided at the same time. The privacy of transactions is guaranteed by zero-knowledge proofs The owner of .UTXO proves that there is such a note in the system and that he owns the note through the proof generated by himself. Users can prove that the transaction is legal without showing their actual transaction amount.
< br>
zk.money The ownership of the notes is stored in two Merkle trees, one contains all the notes that have ever been created, and the other contains all the notes that have been destroyed. When When destroying a ticket, instead of deleting the ticket from the first tree, it is enough to add the ticket to the second tree.
zk.money The usage process is as follows: the user deposits funds from the main network to Layer2, generates a certificate → the user performs a sending operation on Layer2 (with privacy protection) → the user withdraws funds to the main network
< /p>
tornado.cash

tornado.cash is a privacy chain mixer on Ethereum, a bit like DASH's anonymous transaction. Its name is very appropriate, put the funds in the tornado, and then take it out I don’t know who sent it.
tornado.cash Also through zero-knowledge proof, to hide the receiving account of the transaction, left-handed in the case of privacy Invert the right hand to achieve private transactions.
It uses a smart contract as a black box in the middle of the transaction to break the connection between the sender and the receiver. The sender Provide a confidential hash value when depositing, and the receiver (it can be the sender himself) only needs to provide a zkSNARK proof when withdrawing cash to accept the deposit directly.
< /p>
We already have the above mature privacy solutions for the basic token function of transaction transfer. Web3 will be built around tokens with different values and functions. The transaction of tokens Transfer is only a small part of Web3 usage, but it is an operation that is most likely to expose privacy. In the Web3 era, our transactions will be private.
< br>
Computational privacy is a further expansion of transaction privacy in data confidentiality. Computational privacy in smart contract execution is usually achieved through cryptography, AI technology, trusted execution environment and other technologies, but among them It is very difficult to achieve a perfect balance between performance and privacy.
Privacy computing is a step closer to data privacy and privacy transactions, and has been extended to Turing-complete smart contracts. Smart The privacy protection of the contract mainly focuses on the execution process of the smart contract, and shields the data and intermediate states involved in the execution from the third party and the nodes that execute the smart contract. Privacy computing technology is divided into three directions: cryptography (such as Multi-party secure computing (MPC), AI technology (such as federated learning), trusted execution environment (such as SGX).
21.png">
Multi-party secure computing is usually completed with the help of a variety of underlying cryptographic frameworks, mainly including oblivious transfer (Oblivious Transfer, OT), confusing circuit (Garbled Circuit, GC), Secret Sharing (Secret Sharing, SS) and homomorphic encryption (Homomorphic Encryption HE), etc. This article does not expand.
Federal learning is to ensure big data exchange Real-time information security, protection of terminal data and personal data privacy, under the premise of ensuring compliance with laws and regulations, carry out efficient machine learning among multiple parties or computing nodes. In short, without exposing privacy Next, share the data with others, so as to improve the alchemy process of machine learning together. Federated learning is more related to AI content, and this article will not expand.
The trusted execution environment is mainly related to the bottom layer of the hardware. Usually, a trusted and isolated confidential space independent of the operating system is divided in the CPU. Since data processing is carried out in the trusted space, the privacy of data depends on the The realization of letter hardware. The main difficulty lies in how to balance performance and privacy.
Oasis Network
p>
Oasis Network is mainly to benchmark against Polkadot, layer consensus and calculation, and use ParaTime parallel chains to process calculations. Oasis Network adopts a trusted execution environment solution (based on SGX’s Confidential ParaTime) to achieve privacy computing. In a layered and trusted execution environment, it has a better combination of performance and privacy.
Oasis Network’s Ecology has advantages in terms of privacy computing. At the same time, Oasis Network is compatible with EVM, and the ecological scalability is relatively strong.
The use case of Oasis Network mainly lies in data tokenization (mortgage data, obtain income, and support certain authority control at the same time) and as a high-performance EVM L2.
The disadvantage of Oasis Network is mainly low composability, The layered design is too complicated, and different ParaTimes cannot communicate; the contract is stateless, and the application is not flexible; the application scenario is still vague.
Identity privacy is anonymity, which mainly includes two parts: the separation of physical identity and digital identity and the independence of digital identity.
The separation of physical identity and digital identity represents the user's real identity and network A kind of stripping of identity. During the period of Web1, we did not need to reveal our mobile phone number and name to browse, but when it comes to Web2, we have to submit the information to kyc. This is a serious privacy violation, but at this stage it is still Difficult to solve.
The separation of physical identity and digital identity refers to the separation of people's real identity and network identity, which is essentially the separation of people's access to the Internet The identity anonymity in this process.
Sounds like this is easy to do, as long as the giant whale increases its holdings of bitcoins, the name of the institution is not exposed, and the user only needs to not use his real name As a screen name, you don’t need your real geographic location. But in fact, this is the most difficult pain point to improve privacy. We can’t achieve a seamless partition to protect our real identity. As long as we surf the Internet, telecom operators have the opportunity to obtain our identity; as long as When we buy something, the e-commerce platform can get our identity; as long as we use ENS, we may be fleshed out...
In addition , the various third-party logins of Web2 websites actually expose a lot of our online whereabouts and real identities. For the convenience of use, we will directly log in to the website through Google or Facebook, which is actually encouraging the monopoly and centralization of these big companies At the same time, it also violates our own anonymity.
The most appropriate example I can think of for the separation of physical and digital identities may be the dark web. We We must thank the dark web. If there is no such network as the dark web to use Bitcoin and Monero for payment, the industry may not be able to develop and grow to the present. What the dark web is trying to do is to separate the real world from the digital world, but users Buying illegal items on the dark web may still need to be delivered by courier. Therefore, the dark web has not completely achieved this partition.
Physical The anonymity of identities and the separation from digital identities are actually the content of Web1, but we are exposed to the spotlight by Web2. Some apps cannot be used without filling in your name and phone number, which is bad for user experience and privacy is a violation.
In real identity and online On top of the separation of identities, what we can further develop in terms of privacy is the independence of digital identities. If our digital identities cannot be directly independent, it means that digital identities are still "broken" with real identities, and we
A certain authoritative organization defines the metaverse as follows: the metaverse is based on the Internet, and it is different from reality The world is interconnected, and the virtual world that exists in parallel is a virtual space that can map the real world and is independent of the real world. Personally, I think this definition is very in line with my ideal imagination of the metaverse concept. This way "mirroring reality The virtual space where the world is independent of the real world" perfectly combines digitization and privacy. We can not only enjoy the real world built through tens of thousands of years of history, but also "regenerate" in the metaverse world, through Become a resident of the metaverse with an independent and private identity.
Digital Identity Social
< br>
The independence of digital identity and the characteristics of data ownership of the blockchain Web3 complement each other. On the basis of the independence of digital identity, we can develop an independent digital social. During the Web2 period, we have promoted Social or real-time communication products such as Twitter, Facebook, and Zoom, but the social relationships in these software are completely based on real identities and cannot be independent. The independent social interaction of digital identities will be a very important application of privacy, and at the same time It is also the most important part of the Metaverse.
Cultivation and reopening of digital identities
You can take all the data of Web3 users with you at will, which makes it easier to develop digital identities. The intercommunication of data naturally builds bridges between projects and connects data Isolated island. Through your degen score, CryptoPunks avatar, and governance experience on your chain, we can be credible, transparent and easily cultivate an identity. This makes the formation of communities more transparent and efficient, and makes the socialization of digital identities easier .
When you want to jump from real identity to digital identity, you can directly reopen your KOL or idol career to digital identity with a new look Medium. The most typical example is virtual idols. Many times we fully know who the real identity behind this digital identity is, but the people behind the identity can still cultivate new communities and generate more memes through new digital identities. Of course this situation is contrary to privacy.
Even when you don't want this digital identity, you just need to create a new account and start from scratch (Of course your real identity cannot be exposed in this digital identity), and in real life, it is more dangerous to reopen. All the social interactions of digital identities stay in the digital world. What happens in Vegas stays in Vegas .Your real identity will not be affected at all.
Rely
< /p>
Realy is a metaverse project based on street culture combined with urban scenery as the main line, and proposed the concept of City DAO. Realy transfers 3D virtual clothing, virtual concerts, and offline trendy brands to the chain, and will also hold Virtual concerts and support users to perform operations such as City governance in the Metaverse.
The future Metaverse will definitely be a "combination of reality and virtuality". On this basis, It also needs to be able to exist independently without being overly dependent on the real world. What Realy brings is a complete presentation of street fashion culture on the chain, which is very attractive to young people. I personally like the identity in the digital/metaverse Trying a different experience in the game, my social account and the gender in the game are basically set as female. This brings countless possibilities to digital identity and social interaction.
In Realy, you can ignore the restrictions of gender and appearance, and freely embrace trend culture; you can also ignore the restrictions of geographical location, time and epidemic risk, and participate in virtual concerts in a digital form. These are An important way of life and social interaction for Web3 users. All of this can be done without involving physical identity. All the data on the chain, including the purchase of trendy clothing and participation records in concerts, will be accompanied by your digital identity, In other metaverse worlds, your image will also be a fan and trendy player of 88rising.
In essence, social reality and privacy are somewhat contradictory. You To socialize, you must show your face, you must give up some of your privacy, and exchange information with others.
But Blockchain Web3 Endowed users with: independence of data control and ownership and digital identity, and complete privacy of physical identity. We can use the digital identity on the chain to perform consistent interactions with real life. At the same time, the existence of a new digital identity also gives people the first Two lives and a second way of life.
Cross-chain + privacy chain or decentralized applications that specialize in privacy can improve blocks without excessive loss of performance and usability Chain of privacy.
Contradiction:
In an article by BluemountainLabs, it is mentioned that privacy protection needs to be integrated into the underlying logic of the whole. Vitalik also said: "Only a global anonymous collection is truly reliable and safe." This means that perhaps only one on the blockchain network Global privacy protection will be the most effective.
In reality, both Bitcoin and Ethereum have given up in order to retain decentralization and computing costs Some privacy protection. In Bitcoin, by grabbing the data of the accounts of predators, their operations such as selling transfers will be exposed, which causes them to lose part of their privacy. In the design principle of Ethereum, " The word "privacy" is only mentioned in the chapter of account system and UTXO. Ethereum did not adopt UTXO with stronger privacy protection and more scalability, but adopted an account system with stronger performance and more convenient use .
In the impossible triangle of performance, usability, and privacy, ordinary users and developers currently want to solve performance first, followed by usability, and finally It is privacy. In the era of Web3, perhaps the last darkness before dawn will be a privacy issue.
Solution:
In this contradiction, what we want to get is: the global privacy of the blockchain without excessively reducing performance.
One of the most complete but bloated solutions is: by making a dedicated privacy chain (such as Monero), and then matching with various cross-chain tools and various wallets, etc. To achieve privacy. But this is very bad in terms of user experience. It’s like you want to post photos of your tattoos on social media, and don’t want your elders to see, then you need to add and block them one by one , or even go to another younger social media and only add your peers as friends. This is very troublesome in both Web2 and Web3 scenarios.
A way to improve user experience and performance by abandoning part of the overall situation is to implement privacy operations through pluggable decentralized applications or Layer2 (such as zk.money ). This allows users to stay in the The original blockchain network, you can enjoy privacy protection (and even have additional performance advantages). Among them, pluggable decentralized applications are better than Layer2. Because in my imagination, the distant and beautiful Web3 will definitely be multi-chain interconnected. A pluggable multi-chain decentralized privacy application can be more flexible and "decentralized" (not centered on a single chain). In this regard, I am very optimistic about being more flexible The design paradigm can make privacy-related applications, such as SCP on Arweave.
It is impossible to withdraw or hide the transaction information afterwards. However, users can decide whether the transaction is through the privacy option before transaction submission (such as Volition like StarkWare) Open Data.
Contradiction:
First It is the disclosure of blockchain data. The input, output and content of transactions are usually visible in the blockchain browser. This makes data protection extremely difficult.
The second is the immutability of the blockchain data. Once the data is uploaded to the chain and written into the block, it cannot be tampered with. After the user submits a transaction that exposes privacy, it cannot be withdrawn or hidden. Perhaps the address can only be discarded directly. This is actually a violation of EU data protection regulations (all users have the right to be "forgotten").
Solution:< /b>
The disclosure and immutability of data can actually be seen together. We have absolutely no way to deal with the basic characteristics of these two blockchains Compromising like performance, privacy is definitely a second-class citizen in front of these two qualities. Then publicity and immutability cannot be eliminated (we can solve anonymous and confidentiality).
But what we can figure out is that these two characteristics are born for security and openness of the network. We actually have control and ownership of our data. Even if our transaction data can be withdrawn, in Before withdrawing, it is likely to have been crawled by thousands of crawlers. In that case, withdrawing may not be meaningful. The Internet has memory, and an Internet that is open and cannot be tampered with is even more so.
Although it is not possible to withdraw or hide data after the event, it is possible for the user to decide whether to disclose it beforehand. This optional privacy option is very user-friendly, and it can also make privacy really use the blade Above. A similar solution is the Volition data availability mode in immutableX made by StarkWare. Then if you don’t want to disclose the data and keep some privacy on the public network, then the user can directly choose to store the data under the chain.
Actually, most of the time, Your data on the chain is your own wealth and value, but for a small amount of data that needs privacy, I think it is very necessary to protect it through optional privacy options.
No one knows what will happen to Web3, and most Web3 users don’t know what they want at all, just like It has been a long time for Web2 users to realize that their privacy has been violated so unscrupulously. The large amount of financing received by privacy projects has actually increased the exposure of privacy needs, making more people aware that in the future, a better Internet Privacy should be needed.
In the Web3 era, we need data autonomy, data privacy, data computing privacy, and real identity privacy. At the same time, the ideal privacy application is the best It needs to be user-experience-centered, pluggable, lightweight, and mentally burdened.
Web3 = Get + Post + Own.Web3 In this era, everyone will control their privacy.
About Foresight Ventures
Foresight Ventures backs innovative and disruptive Web 3 projects. We believe that future innovation will be defined by cryptographic technologies. As early investors, we want to participate in the growth of projects and provide extensive Support.
Website: https://www.foresightventures.com/
Twitter: https://twitter.com/ForesightVen
Medium: https://foresightventures.medium.com
Original link
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia