6

As this decentralisation wave is taking place around the digital world, I was wondering how can you remove some content that you just uploaded on a decentralized network.

As I understand, more and more people want to have decentralized services, because as opposed to the client-server architecture this gives you more ownership of your stuff and everything is more transparent. But, what happens if you messed up, or the company you're a client of messed up and they/you upload some personal info that you clearly don't want others to have access to? Since it's a peer-to-peer network everybody has access to it and there's no way to enforce them to delete it.

I think what I am trying to understand is how this decentralized future will play out with private data, will there be a centralized place for private data and then we gonna do other things on ipfs and different similar apps? Because if that's so then what's the purpose, why not continue as it is right now? Maybe I am still not seeing all the use cases...

Discordian
  • 749
  • 3
  • 16
Alex Simion
  • 131
  • 3
  • 10
  • The way I've been starting to see it is like, you can't delete something off a random HTTP webserver, you'd have to send a C&D or petition a government or something. Same with IPFS. I'll try to write a proper answer later (unless someone else does). – Discordian Nov 04 '21 at 21:40

2 Answers2

7

IPFS does allows you to delete file, you just need to make so on all different nodes hosting the file.

If some nodes aren't in your control the process is fairly simple, monitor ipfs dht findprovs <A file you want to delete>, find all peers hosting the file, then for each find their IP with ipfs dht findpeer <Peer ID>, then use a database like whois or BGP to find the ISP and send them C&D or GDPR claim or whatever.

Appart from the tools you use being ipfs centred it's the exact same process as for regular good old web2 with http.

You might think that for multiple nodes it's unlikely for everyone to comply and whatever juridiction you use to claim your rights of forgotness. But that already happen with http, you can host your server in a country that doesn't follow whatever law you claim your right of thoses files to be removed or use Tor and mostly not worry about legal threats.

GDPR or any other law like that is already ineffective at removing stuff from the web, the goal is more to scare big players and help politicians keep their job (putting in place an ineffective solution to a problem not many people understand can help them get a good reception of the public and being renewed).

Jorropo
  • 348
  • 3
  • 12
1

Yes it can be a problem. Companies which store data of their customers should not store them on a Blockchain. As in Europe with the GDPR-Law they are obliged to delete the data if the customer requests it.

I have had a similar issue at my company when we were discovering if we should use a decentraliced network in a project. In this link here is a statement from R3 (which developed Corda, a DLT for Business) about this topic. It is from 3 years ago but it's still relevant in my opinion.

So the solution is to only store the reference to the user (like an ID) on-chain and keep the sensitive stuff off-chain.

Another interesting project is Atala Prism, but unfortunatly I had not yet the time to dive into it.

retoen
  • 379
  • 1
  • 7
  • 2
    Good thing IPFS doesn't use a blockchain ;). – Discordian Nov 04 '21 at 21:37
  • 2
    > customer Because IPFS has customers now ? – Jorropo Nov 04 '21 at 21:38
  • 1
    Yes you are both right. But companies who use the service may have customers. I understood the question not specifically for IPFS, but for any decentralized network. It makes deleting data just more complicated and GDPR makes you viable if you cannot guarantee to delete sensitive data if you offer a service. – retoen Nov 05 '21 at 12:38
  • 2
    The title specifically says "IPFS can't...". With HTTP you download a file, and it's not automatically re-served. With IPFS when you download a file, it *is*. That's really the only practical difference I'm seeing from a legal perspective. You can still send takedown notices, and data isn't automatically replicated unless the user requests it (and then it'd only be re-served from their node). Individual nodes can delete the data right now, any service that hosts nodes can also delete data, all the same as HTTP. – Discordian Nov 05 '21 at 14:12