How Web3 apps and wallets inevitably depend on centralized services like OpenSea, Infura, and Alchemy, which don't even provide authenticated responses

Despite considering myself a cryptographer, I have not found myself particularly drawn to “crypto.” I don't think I've ever actually said the words …

Moxie Marlinspike 2022-01-08

Context & Ripple Effects

Earlier coverage had already identified wallet security and onboarding problems as barriers to Web3’s next generation of users. This critique narrows the problem to the infrastructure layer: apps and wallets depend on OpenSea, Infura, and Alchemy for data they cannot authenticate.

The later split between a skeptical view of crypto-based self-sovereign identity and a defense of blockchains’ payments potential makes this dependency consequential: decentralization claims depend on how users receive and verify network information.

First-order effects

Web3 apps and wallet users relying on OpenSea, Infura, or Alchemy must trust those providers’ responses, because the services cited do not authenticate them.
OpenSea, Infura, and Alchemy become operational trust points for applications that present marketplace or blockchain data to users.

Second-order effects

Wallet and application developers face a choice between accepting provider-supplied data or adding verification paths, making infrastructure design part of the user-security burden.
Infrastructure providers that can offer verifiable responses gain a clearer basis to compete with the centralized services named in the critique.

Third-order effects

If Web3’s interface layer continues to concentrate around a small set of data providers, control over trustworthy access may consolidate even when underlying networks remain decentralized.
The gap between self-sovereign identity ambitions and centralized data delivery strengthens the case that verification—not chain access alone—is the limiting layer for user autonomy.

The trend: Web3 is confronting a verification bottleneck in which decentralized networks still rely on centralized, user-facing infrastructure to supply trusted data.

Discussion

@moxie Moxie Marlinspike on x
Wrote some notes summarizing my first impressions of web3: https://moxie.org/...
@evgenymorozov Evgeny Morozov on x
This is such a great analysis of how the political economy behind Web3 actually drives it *towards* centralization and *away* from privacy. A spectacular job by @moxie https://moxie.org/...
@matthew_d_green Matthew Green on x
What Moxie doesn't realize is that all the centralized services in crypto eventually get hacked, or exit scam. That keeps things decentralized.
@brian_armstrong Brian Armstrong on x
3. I agree there is an overall move toward using platforms. But there is a big difference between using a platform that also owns all the data also (web2) and a platform that is merely a proxy to decentralized data (web3).
@carnage4life Dare Obasanjo on x
Good post from @moxie on his experience writing web3 apps and some key observations ⁃Blockchain isn't friendly to mobile apps as you need to run a node on a server. This implies every mobile app has to talk to an API on a server to use blockchain. https://moxie.org/...
@gwenckatz Gwen C. Katz on x
This is a Banksy-level stunt. I doff my hat to you. https://twitter.com/... https://twitter.com/...
@nicoleperlroth Nicole Perlroth on x
An incredibly lucid discussion of web3. Tldr: It's not as decentralized as you were led to believe. Thanks for this @moxie https://twitter.com/...
@argvee Heather Adkins on x
A nice write up. TL;DR - out of necessity, web3 is already experiencing necessary platform centralization (and below-par privacy - eek), despite design goals to be decentralized; it's early days but likely has the momentum to continue. https://twitter.com/...
@brian_armstrong Brian Armstrong on x
Really great post by my friend @moxie https://moxie.org/... Raises some valid points. However a few notes...
@anildash Anil Dash on x
It's very very important but listen to credible, experienced technologists who actually do the work of trying to use the tech. https://twitter.com/...
@timbray @timbray on x
“My first impressions of web3” by @moxie: https://moxie.org/... Very, very smart stuff, and considers issues I haven't seen anywhere else.
@lcamtuf @lcamtuf on x
This is a very good technical analysis: https://moxie.org/... I'd note, though, that technical novelty, merit, or fidelity doesn't necessarily matter much. Transmeta vs Twitter. Your odds are better if you inspire millions than if you impress dozens of us nerds.
@levie Aaron Levie on x
Too much of web3 discourse has remained at high level vision statements. Posts like Moxie's help break why these visions are much harder in practice, and why software architecture decisions really matter. https://moxie.org/...
@brian_armstrong Brian Armstrong on x
General thoughts: It's still difficult to build things in a decentralized way (nascent tools), so you are seeing various apps/companies revert to using more centralized web2 techniques when they run into a hairy technical problem.
@alexhern Alex Hern on x
It's just increasingly impossible to believe that smart people honestly think there is a there there https://moxie.org/...
@seldo Laurie Voss on x
An excellent lower-level look at how NFTs and other crypto tech are already consolidating rapidly, even at the lowest levels, into a handful of centralized platforms. https://twitter.com/...
@dalperovitch Dmitri Alperovitch on x
“Eventually, all the web3 parts are gone, and you have a website for buying and selling JPEGS with your debit card” Terrific post on how web3 isn't really decentralized (or uses much cryptography) and, to the extent, that it is, it makes everything more expensive and unwieldy htt…
@athertonkd Kelsey D. Atherton on x
“Blockchains are designed to be a network of peers, but not designed such that it's really possible for your mobile device or your browser to be one of those peers.” https://moxie.org/...
@gramofdata @gramofdata on x
This is a wonderful summary of NFTs and blockchain tech in general. NFTs generally sound dumb at first, but if you really dig in and learn more about them you'll find that they are actually very dumb. https://twitter.com/...
@vvuk Vladimir Vukicevic on x
I already retweeted this, but I'll do it again — this is an excellent writeup of “web3”. If you're wondering what this is, how it actually works, and regardless of what you may believe, why it's currently a house of cards: read Moxie's writeup. https://twitter.com/...
@carnage4life Dare Obasanjo on x
I basically argued this was what was going to happen as many apps would rely on OpenSea's API instead of the blockchain. Didn't realize major wallets were already doing this. In conclusion, web3 architecture is incompatible with mobile apps and there's excess centralization.
@craigmod Craig Mod on x
“When you think about it, OpenSea would actually be much ‘better’ in the immediate sense if all the web3 parts were gone.” https://moxie.org/...
@mchrisriley Chris Riley on x
This is a fantastic engineering takedown of the fundamental fragility of what's being so hyped right now as “web3”. It's really not decentralized, it's just shifting consolidated power onto less efficient blockchain tech. Should be called “web2-blockchain” instead. https://twitte…
@anildash Anil Dash on x
This is the best technical analysis I've seen of web3, and the one I wish I'd had time to write. When I found out about the architecture of how blockchain interactions get translated in actual practice to user-accessible experiences, I thought I had to be wrong. I wasn't.
@can @can on x
Maybe this is gatekeeping but so much of the Web 1/2 people were those who built it. Web3 seems like mostly people creating “content” about it without having zilch technical background and it's infuriating
@_mg_ @_mg_ on x
This is the first look at web3 & NFT that has been worth reading. Normally this topic is incoherent buzzword bingo and/or “I have big emotions”, with a whole lot of predatory opportunity created by the wide rift. But @moxie actually dove in & examined it. https://twitter.com/...
@davidu @davidu on x
It's worth reading @moxie's “My first impressions of web3” to understand where things are today so that the future can be built better. Really good read, and still wagmi, of course. https://moxie.org/...
@moyix Brendan Dolan-Gavitt on x
Very nice article from @moxie; I feel like this is the first thing I've read that gave a bunch of thoughtful and solid technical critiques of web3 as it exists today? [NB: I have spent ~0 time looking into web3] https://moxie.org/...
@jakewharton Jake Wharton on x
Smart people writing factually about NFTs and web3 is like deadpan comedy. I always think we're at peak dumb shit with these technologies but they always find innovative ways to out-dumb shit each other. https://twitter.com/...
@tomchatfield Tom Chatfield on x
Very good, this. “So much work, energy, and time has gone into creating a trustless distributed consensus mechanism, but virtually all clients that wish to access it do so by simply trusting the outputs from... two companies without any further verification.” https://twitter.com/…
@stephenpiment Stephen Pimentel on x
A key takeaway: “We should accept the premise that people will not run their own servers by designing systems that can distribute trust without having to distribute infrastructure.
@jeffseibert Jeff Seibert on x
When I tweeted 2 weeks ago that Bitcoin and Ethereum are both “more centralized than you imagine”... And @jack teased me about it... THIS is exactly what I was referring to! Huge props to @moxie for being far more thorough and more eloquent than I: https://moxie.org/...
@kennwhite Kenn White on x
The current state of Web 3.0 distributed crypto is mostly neither distributed nor crypto. It is, however, pretty clearly a gold rush & nerd paradise. This technical analysis by @moxie is the best I've seen. https://moxie.org/...
@can @can on x
the part where almost ETH “clients” are basically an API calls blew me away when I figured out. It was already pretty suss that most DeFi crap happened on web apps / mobile phones but I thought they had their own backends / ETH clients. But no. They are all basically shims.
@villi @villi on x
This is an excellent and required reading for anybody looking at web3. I am smarter for reading this. Thank you ⁦@moxie⁩ for this thoughtful essay. https://moxie.org/...
@carnage4life Dare Obasanjo on x
⁃Based on @moxie's analysis, we can argue access to blockchain is centralized as most dApps go through APIs from Infura or Alchemy ⁃NFTs are already so centralized around OpenSea's API that when they delist an NFT it disappears from popular wallets like MetaMask & Rainbow.
@erickschonfeld Erick Schonfeld on x
“People don't want to run their own servers, and never will” https://moxie.org/...
@brian_armstrong Brian Armstrong on x
These points aside, the post is great and I basically agree with the overall premise. Thx for posting it @moxie and welcome to web3 (sort of) :) We could def use your help figuring out the client pieces (which Signal has done a great job on) and a bunch of other stuff.
@lmorchard Les Orchard on x
Yeah, this stuff has vexed me somewhat in the small bits of quiet reading & tinkering I've done with things web3. Every tip of a toe I've dipped and I'm like, really? This is really how it's working? But that can't be right... https://moxie.org/... https://twitter.com/...
@mgsiegler M.G. Siegler on x
🎵 Meet the new boss. Same as the old boss. 🎵 https://twitter.com/...
@grady_booch Grady Booch on x
An excellent, deeply technical analysis. “Almost all dApps use either Infura or Alchemy in order to interact with the blockchain...virtually all clients that wish to access it do so by simply trusting the outputs from these two companies without any further verification.” https:/…
@posco P. Oscar Boykin on x
This is a great discussion of “web3” because 1. you can't say @moxie doesn't get the value of privacy, cryptography or protocols, 2. he actually built two apps himself as part of his exploration. Lastly, the fact that NFTs don't even include a hash 🤯 https://moxie.org/...
@levie Aaron Levie on x
Eventually we'll be reminded again why “centralization” is valued by consumers, and why a mixed state of decentralization + centralization is the worst of both worlds.👇 https://twitter.com/...
@mgsiegler M.G. Siegler on x
This is just a brutal beat down. But just as “Finish Him” shows up on screen, he pulls back slightly with the notion that “it's fun” to thinker with this tech. Sure. But the underlying thesis is that this is all completely antithetical to the current hype, mantra, and rhetoric.
@brian_armstrong Brian Armstrong on x
If a platform is merely a proxy to data it doesn't own, and it turns evil, people will switch. Not owning the data counts for a lot.
@brian_armstrong Brian Armstrong on x
2. I agree with the overall point that clients don't behave like full nodes. However, there has been quite a bit of discussion about “light clients” in the crypto community even going back to the early days of Bitcoin/Ethereum, so i wouldn't say it hasn't been an area of focus.
@jmorse_ Jack Morse on x
These deep dive on “Web3” from @moxie, the founder of @signalapp, is spectacular. “All this means that if your NFT is removed from OpenSea, it also disappears from your wallet.” https://moxie.org/... https://twitter.com/...
@amasad @amasad on x
Moxie is clearly not a hater, so I think people should read this. The last part spoke to me. No amount of decentralization will be worth making software harder to build. https://twitter.com/... https://twitter.com/...
@jack Jack⚡️ on x
“It seems like we should take notice that from the very beginning, these technologies immediately tended towards centralization through platforms in order for them to be realized, ..., and that most participants don't even know or care it's happening.” https://twitter.com/...
@aeyakovenko @aeyakovenko on x
Something @solana ecosystem has been doing well. 1. Arweave is used for majority of nft data 2. Servers are such a pia, ironically there is a dozen providers 3. Wallets, exchanges, ramps, all use their own rpc infra What we could do better 🧵 https://twitter.com/...
@nixxin Nikhil Pahwa on x
Incredible depth & breadth of understanding in this piece from @moxie on Web 3...the kind you get from exceptional cybersecurity folks. Something I've been concerned about too: centralisation around Web3 platforms. & so much more. Already read it twice. https://moxie.org/...
@jeffseibert Jeff Seibert on x
“When you think about it, OpenSea would actually be much “better” in the immediate sense if all the web3 parts were gone. It would be faster, cheaper for everyone, and easier to use.” - @moxie The elephant in the room.
@joshelman Josh Elman on x
The best article I have read on Web3 in a while. The concept of distributing trust *without* distributing architecture is a fundamentally important one for the future of Web3. And one that Moxie gets so well wrt Signal https://twitter.com/...
@brian_armstrong Brian Armstrong on x
As a result, there are a lot of “hybrid” web2/web3 apps during this phase of web3 development. That doesn't mean the overall trend is bad though. I think it's great that more and more web3/decentralized technologies are being developed.
@brian_armstrong Brian Armstrong on x
1. For NFTs, some keep their data in IPFS (decentralized file storage) or in the smart contract itself for procedurally generated images. We (as a community) should probably move more to solutions like this over time, since it is indeed more decentralized to build them that way.
@gladstein Alex Gladstein on x
“All this means that if your NFT is removed from OpenSea, it also disappears from your wallet. It doesn't functionally matter that my NFT is indelibly on the blockchain somewhere, because the wallet (and increasingly everything else in the ecosystem) is just using OpenSea API” ht…
@stephenpiment Stephen Pimentel on x
This critique of web3 from @moxie is the best I've read so far. He doesn't say: * it's mostly a scam, or * blockchains are worthless. He takes a detailed look at the present architectures for dApps and wallets and shows how they are technically lacking. https://moxie.org/...
@brian_armstrong Brian Armstrong on x
4. There are more options than Infura and Alchemy. Access to simple blockchain data will be relatively commoditized. Which is good for decentralization.
@emilygorcenski Extremily Gorcenski on x
This is an incredibly well-written post that very clearly explains in simple language for the most part why web3 fails to deliver on its most vociferously offered promises https://twitter.com/...
@davepell Dave Pell on x
Agree. But it also seems to me that every tech we were hopeful about back in the day was abused by the bad guys. So we need to consider that this time around. It never occurred to us back then. https://twitter.com/...

Chronicles