Hacker News Reader

Comment by simonw | Hacker News Reader

Web3 will divide the world into two categories: people who can remember and secure their passwords, and people who cannot.

The latter group will outnumber the former group 20 to one. I expect them to reject the whole thing once the initial speculative sugar rush wears off.

View on HN

I feel Web3 security has regressed heavily on what used to be the norm. When I first played with Bitcoin, it was basically the expectation everyone had an air gapped desktop with an offline wallet, and a "watch only" wallet online. Then hardware wallets showed up and improved things further and people often still normalised that you only plugged it into a known clean machine if and when you needed it.

The standard these days seems to be "install a browser extension on your daily driver desktop and let it manage your wallet". I know people are going to say "Metamask supports x hardware" or "actually no, I still recommend..." but that doesn't take away from what's been the recent norm.

I blame Ethereum - it's designed as a platform, which means developers build things on it, but those things then require users to interact with them - and every single interaction is an opportunity for something insecure to happen.

> I blame Ethereum

The problems all started because of Ethereum. The scams, hacks and rug-pulls across, ICOs, NFTs, Tokens, DAOs, DeFi and now you have web3.

Put all of that together and you have tons of things that can go wrong and duck-taped that are not designed to work together which causes security issues and millions of dollars worth of losses. Now it is not just about payments, it's now complex dApps that are riddled with smart contract vulnerabilities.

Even when the team already pre-mined their bags from the start, it was compromised as a project; everyone relying on and trusting a team and individual. The moment that the DAO hack happened, the chain was forked and the people at the top orchestrated it.

When it goes to proof-of-stake, it will be even more centralized and no different to the other cryptocurrency projects out there.

People who couldn't read and write would have rejected a world in which writing is everywhere, but if being able to use writing is enough of an advantage, then it will win anyway, and eventually everyone is taught to read and write from a very young age.

I'm not saying Web3 is enough of an advantage to matter, but the fact that some people are currently incapable of using it doesn't mean it will be that way forever.

The irreversible loss of everything if you forget your password isn't a minor inconvenience that will be fixed in the future - it's fundamental to how the whole thing is designed to work. And it's a catastrophically bad idea!

I'm constantly shocked that this isn't held up as one of the biggest flaws. This is a technology that's meant to be "the future" which is incompatible with how regular humans actually work.

I pretty much second that this is one of the biggest flaws. I'm often assured by people invested in web3 that this is a problem that's going to be solved soon by the flood of designers entering the space, but my doubt is growing with each passing day. It seems more likely that this flaw in the system is going to persist for many years to come and very sadly, many people are going to lose a lot of money through it.

And we've had internet connected home computers for at least 20 years, yet we still have issues with security literacy.

Unless you force everyone to use the system, very few people will bother.

Let's make something people actually want to use before being worried for web3 literacy.

How long did we have writing before the median person could read and write?

Either that or a few companies will, in practice, have custody of everyone's cryptocurrency credentials and assets and, in practice, things will be largely the same as they currently are.

That I see as a likely outcome. Though companies may still offer an option to have a secured wallet (non-custody) for longer term storage of value. There aren't many but there are a couple of options like that out there where you give custody of the funds where you want ease of use or automation (trading, savings plans, etc.) and then have non-custody as part of the same service where you store whatever you don't want to give the custody of.

Reply on news.ycombinator.com