# The Evolving Landscape of Privacy in Web3 By [Crypto Nomad](https://paragraph.com/@thecryptonomad) · 2023-04-06 --- > **_DISCLAIMER: The original article has been produced for Efiko DLT, as part of my internship with them. You can find it at efikodlt.substack.com. Kudos to Elliot Garreffa, Marjin Van Der Laan and Marco Marinelli for their pivotal help in reviewing the entire article._** Context ------- Since the early 90s, we have witnessed the Internet fail at protecting people's privacy, exposing us to mass surveillance and recurrent data breaches. That is understandable, considering that the Internet infrastructure was not designed with privacy principles in mind. Even applications and protocols developed to encrypt data (like Signal or TLS) cannot effectively hide _metadata_ from network listeners. The revelations about the NSA's massive surveillance program by Edward Snowden are a prime example of how metadata is visible and can be misused. > **_Metadata_** can be used to identify users, track their online activity, and reveal private and personal information. In addition, AI algorithms can be used on metadata to predict individuals' preferences, associations, and other aspects of their personal lives. This context has inspired the cyberpunk counter-revolution, from which the current blockchain ecosystem took its philosophical foundation, placing anonymity at the center of the first concrete application: Bitcoin. However, blockchains, including Bitcoin and "Layer-2" solutions like the Lightning Network, were initially conceived with an "original sin": the lack of privacy at the network level. This unsolved vulnerability allows private companies like Chainalysis to monitor the data available on blockchains and the metadata of the peer-to-peer traffic. Therefore, it is possible and easy to discover the network addresses that broadcast transactions, identify users, and make inferences about private transactions, even in systems with on-chain protections such as Zcash or Monero. It is time to give privacy the primary stage it deserves, putting these values at the center of future web3 development to build a sustainable environment that respects fundamental human rights and avoids surveillance dystopias. [Subscribe](null) Initiative around web3 privacy ------------------------------ The **_Universal Privacy Alliance_** aims to “advance the understanding of privacy as the basis of free and flourishing digital societies”, bringing together actors like Secret Network, Nym, Oasis Foundation, Status, Aztec, and Orchid, among others. The **_Leading Privacy Alliance_** is an effort where Dusk, Hopr, Block Wallet, and other players join forces to find solutions and protect web3 users from data exploitations. They have also launched a DAO where more projects can convene around the shared desire of making web3 a better place by enhancing privacy. Even individual initiatives are taking off, such as the web3privacy research project led by Mykola Siusko on [GitHub](https://github.com/web3privacy/web3privacy/), from which I have taken inspiration in drafting the present article. In the current web3 state-of-the-art, the following tools can be outlined: * **Privacy-focused blockchains** which implement features like confidential transactions, shielded addresses, and more * **Smart contracts’ secure designs** that entail cryptographic techniques to conceal sensitive information: **zero-knowledge proofs** (e.g. ZK-SNARKS), ring signatures, etc. * **Specific Tools** that leverage the aforementioned tools In the following sections, I will delve deeper into the various areas where these efforts are being pursued: * **Layer-1s and Layer-2s** * **Financial** (cryptocurrencies, wallets, DeFi) * **Digital Identity** * **Data Storage and Messaging** * **Tools and Analytics** * **NFTs and DAOs** Finally, I will end with some examples of projects which enable on-chain **anonymity** followed by our reflections. Layer-1s and Layer-2s --------------------- Many layer-1 blockchains are building the technology that could make web3 privacy a reality: * **_Concordium_**: a science-backed blockchain designed around an ID layer that balances privacy with accountability * **_Oasis Foundation_**: a layer-1 platform for open finance and a responsible data economy * **_Secret Network_**: a blockchain that enables customizable privacy * **_Nym_**: infrastructure that protects packet’s metadata at the network and application layers * **_Horizen_**: a Zero-Knowledge network of blockchains * **_XX Network_**: a quantum-resistant blockchain ecosystem Other projects aim to bring privacy to popular blockchains, such as Ethereum and EVM-compatible layer-2 solutions like **_Obscuro_** or **_Zecrey_** , but also **_Light Protocol_** (Solana) or **_Calamari Network_** (Polkadot – Kusama). The blockchain privacy space is not going unnoticed by investors. We are witnessing multi-million-dollar rounds for projects like Aztec ($100M), Secret Network ($400M), Nym ($300M), Starkware ($273M), Oasis Foundation ($160M) and so on. Privacy across fields --------------------- ![AI image create by the author with DALL-E 2](https://storage.googleapis.com/papyrus_images/d5cfc389d9794cb72899a65c72cd27fa10e94879fb0bc007ab4168bd15370554.png) AI image create by the author with DALL-E 2 Besides the infrastructural stack, privacy-preserving solutions are popping up across all the main web3 application areas. The most significant ones are: Financial Realm --------------- Financial data is one of the most desirable targets for both surveillance proponents, such as authoritarian governments, and malicious actors. A clear picture of an individual’s financial movement can be depicted as the Holy Grail for mass surveillance programs. Additionally, connecting the dots on someone's economic activity can pave the way for fraud, blackmail, and other personal attacks. These reasons have led many blockchain projects to provide an array of solutions that balance legit transparency and personal privacy. ### Currencies **_Monero_** is the most well-known example in this field: by leveraging technology to obfuscate transactions, the renowned privacy coin promises to deliver absolute anonymity. However, the currency’s success is controversial: on the one hand, many users praise the developers who make such a level of protection possible, while on the other hand, regulators and some public figures criticize the anonymity approach that allows criminals to carry out international financial operations and money laundering. The difference between anonymity and regulatory compliance can be a thin line, with several players operating in this area like **_Dero, Pirate Chain, Epic Cash, DeepOnion, PivX, Iron Fish_**, and many more. A more sustainable approach is taken by **_Zcash_**, which uses ZK-SNARKs to remain compliant while maintaining maximum user privacy. ### Wallets The recent controversial update to ConsenSys' privacy policy has raised concern: the most used non-custodial wallet, MetaMask, can collect users’ IP addresses when transacting. Today, numerous alternatives guarantee users’ full control over personal data: **_Frame_** is an excellent example for eth wallets, but also **_Lunar_** (the only wallet based on a built-in integration of TOR). Multi-sig wallets like **_Nucleo_**, DeFi wallets like **_Edge_** or **_Railway,_** and **_Starshell_** on Cosmos ecosystem are other examples. We can’t forget to mention the bitcoin wallets: **_Wasabi_** for instance, cold wallets like the **_Foundation’s Passport_**, and even DIY solutions like **_Seed Signer_** and open-source firmware (**_Krux_**) for more tech-savvy users. ### DeFi Some of the most influential and promising privacy-preserving dApps and protocols are: * **_Dusk Network_**: an open-source and secure DLT that businesses use to tokenize financial instruments * **_Panther Protocol_**: a metaprotocol that enables confidential, trusted transactions and interoperability * **_Shade_**: a suite of privacy-preserving DeFi applications built on Secret Network * **_Penumbra_**: a shielded, cross-chain network that allows anyone to securely transact, stake, swap, or market-make crypto assets * **_Silent Protocol_**: it enables compliant full-stack privacy smart contracts and dApps at scale Other privacy-focused solutions in the DeFi space include bridges like **_Aztec_** or **_ChainPort_**, and even validators services (see **_ZKValidator_**). There are also companies building privacy-preserving smart contracts and dApps, such as **_Findora_**, **_Nulink_**, **_Dero,_** and **_Aleo_**. [Subscribe](null) Digital Identity ---------------- Thanks to cryptography and other technology advancements, concrete digital identity applications are finally emerging. However, the construction of such applications demands careful attention to privacy and the handling of sensitive data. Not by chance, the leading web3 players in the identity space are paying obsessive attention to users’ privacy protection: many of them believe that a fundamental technology could be **Zero Knowledge proofs**. > In this cryptographic method, A (the prover) can prove to B (the verifier) the truth of a given statement without revealing any information apart from the statement being true. **_Polygon ID_** is a fierce advocate of this method, as are\* **Findora CR**\*, **_Holonym, zCloak, Verus ID, Notebook labs,_** and more. Other projects aim to maintain anonymity by implementing biometrics, like **_Anonybit_**. Meanwhile, **_Shyft_** sticks to the strictest legal compliance to simultaneously deliver blockchain identity data and user privacy. Also, **_Cheqd_** enables individuals and organizations to fully control their personal data, creating an infrastructure level for decentralized identity. Others focus on specific services, like **_Sismo_** (a ZK badge provider) or **_Litentry_** (a decentralized identity aggregator). This space is rapidly evolving and is the subject of ongoing international debate, as evidenced by the recent [recommendation](https://www.w3.org/TR/did-core/) of the W3C (World Wide Web Council), one of the most important standard-setting bodies for the whole internet infrastructure. Storage and Messaging --------------------- In the modern world, cloud service providers, data silos, arbitrary data retention policies, data breaches, and leaks are all around us. Because of that, the **_Skiff_** suite is soaring as an encrypted and secure alternative to Google Drive; the **_Sia foundation_** has created a trustless cloud storage marketplace; and other decentralized data storage platforms (**_Storj, Swarm, Crust_**) follow the “privacy-first” narrative in order to compete with the sector leaders Filecoin and Arweave. Prior to being stored, data is also transmitted. In the communication industry, security and privacy have always been crucial. Even WhatsApp has implemented end-to-end encryption, but more is needed. In web3 communications, **_Session_** minimizes sensitive metadata; **_Status_** raised $100M to build a secure messaging app; **_XMPT_** partnered with Lens Protocol; **_Verida_** is developing a multi-chain protocol; **_Zion_** is building on Bitcoin Lightning Network; **_Telios_** encrypts metadata; **Waku** provides tech foundations. The industry is dynamic and constantly changing, with many avenues to explore. ### Analytics and Tools It may look like a paradox, but analytics and similar tools can still respect user privacy, even while tracing on-chain actions. **_Oasiis Insights_** put into practice such a philosophy, being the first user-centric cookie wallet that creates actionable insights for commerce. It allows users to see how organizations are using their personal data and enable them to control whether or not those organizations can access it. **_Mask Network_**, instead, brings privacy and benefits from Web3 to social media like Facebook & Twitter with an open-source browser extension. Many other interesting tools are being developed, and platforms such as **_Mysterium_**, **_Automata,_** or **_Arcana_** are some to consider. NFTs and DAOs ------------- Activeness in decentralized organizations (e.g. voting in DAOs), digital art collections, or NFT certificates can tell much about a person’s identity. Since blockchain data is public, one may wish to keep this information private. **_Semaphore_** allows users to prove their membership of a group and send messages such as votes or endorsements without revealing their original identity, thanks to ZK proofs. **_Stashh_** is the first NFT marketplace with privacy by default; **_Geniish_** is a protocol for confidential NFTs; **_LegenDAO_** is a play-to-mint NFT platform powered by Secret Network. **_Automata_** also works well in these areas with cutting-edge products like**_NFTFair_** and **_AnyDAO_**. Anonymity and the transparency-privacy spectrum ----------------------------------------------- ![AI image create by the author with DALL-E 2](https://storage.googleapis.com/papyrus_images/dabca459d9bd256c601422cb7e1bf55f6643f0fd4590812f068bd99359029cad.png) AI image create by the author with DALL-E 2 At the extreme side of the transparency-privacy spectrum, we find projects and services that pursue complete anonymity without any compliance compromise. We can classify them into two macro-families: Mixers and VPNs. ### Mixers Coin mixers, or crypto mixers, are services that blend coins from multiple users together to obscure the funds’ origins. Since the **_Tornado Cash_** shutdown, coin mixers have gotten much media attention. Other services still running are **_Unijoin, Void Protocol, Coinomize, MiX BTC, 0xTIP._** ### VPNs VPNs (Virtual Private Networks) establish a secure network connection by providing encrypted servers and hiding IP addresses, making it difficult for third parties to track users’ activity. VPNs also enables a censorship-resistant and location-independent internet access. Some of the best decentralized VPNs include **_Sentinel, Boring Protocol, Orchid, KelVPN,_** and **_Lokinet._** **Anonymity** offers the most extreme interpretation of user privacy and has long played a critical role in countering mass surveillance. Still, it’s a common and widely shared value throughout the cyberpunk philosophy from which we can derive today’s Web3 community. On the other hand, anonymity is often associated with illegal activities. This is the narrative followed by the SEC when it ordered on August 8th the shutdown of the famous crypto mixer Tornado Cash, drawing a debated legal precedent and paving the way for a moot state interventionism. Finding the ideal balance in this situation is challenging. Thus, I adhere to Aristotle's dictum: “Virtus in Media Stat”. [Subscribe](null) Conclusions ----------- Blockchain technology promises to revolutionize privacy through its decentralized and distributed nature, enabling individuals to retain control over their data and determine who can access it. However, while blockchain's inherent transparency and immutability enhance its security, it simultaneously presents formidable challenges for users’ privacy. The strategies employed may vary depending on the circumstances. Governments, companies, and users hold differing perspectives on privacy, having different needs and preferences. Privacy and transparency are often seen as two competing interests, with more privacy usually coming at the expense of transparency and vice versa. However, balancing these two interests is possible by adopting strategies to increase transparency while respecting privacy. Many companies, associations, individuals, protocols, and services across all the web3 areas are building and developing solutions to the privacy conundrum. I have counted roughly **400 ongoing projects**. However, builders in this space are currently grappling with regulatory challenges that could lead to prosecution, censorship, and sanctions because of their work or on-chain activity. The recent case of Tornado Cash is a prime example of the harsh consequences that can result from law enforcement actions. While the Tornado Cash case has demonstrated that Zero Knowledge proofs are not a panacea for all the privacy-related issues, 2023 is expected to be a major turning point for Zero Knowledge technology, with significant advancements in development, adoption, and testing. However, it is worth noting that other promising technologies such as Fully Homomorphic Encryption (FHE) and Multi-Party Computation (MPC) are also being explored, with new ones likely to emerge in the coming weeks, months, and years. It is crucial to remember that privacy-preserving tools are currently available. Individuals can utilize them immediately; the inclusive list of projects cited is an excellent starting point. Hence, there is no better moment to contemplate one's privacy and taking the necessary steps to secure it. Let’s build, privately! --- *Originally published on [Crypto Nomad](https://paragraph.com/@thecryptonomad/the-evolving-landscape-of-privacy-in-web3)*