Beware the crossroads: The dangerous overlap of web2 and web3

Disclosure: The views and opinions expressed herein belong solely to the author and do not necessarily represent the views and opinions of crypto.news editorial.

Web3 has emerged as a beacon of hope for a more secure, transparent internet, promising to solve many of the privacy and data control issues that have long plagued centralized web2 systems. Yet as web3 expands, it often interacts with web2 networks in risky ways. This intersection is a breeding ground for new forms of cyber threats that, if left unchecked, could undermine the security that web3 was built to provide.

While many tech-savvy people are eager to embrace web3, the reality is that the transition from web2 to web3 is neither clean nor seamless, and introduces vulnerabilities that hackers and fraudsters can readily exploit. If web3 is to foster a more secure digital ecosystem, it must first confront the weaknesses it inherited from its predecessor.

Critical vulnerabilities at the Web2-Web3 intersection

Web2 and web3 represent very different approaches to the internet. Web2 relies on centralized servers and data collection models, concentrating power in a few large companies. Web3 decentralizes control by putting data ownership in the hands of users through blockchain, a distributed ledger technology.

But the two systems are far apart. Many web3 applications still rely on web2 infrastructure, including domain names, storage, and APIs. This dependency exposes web3 to web2’s core vulnerabilities. For example, a web3 platform that uses a cloud provider for off-chain storage may be vulnerable to a server breach. Similarly, web3 platforms with web2 interfaces remain vulnerable to phishing attacks and DNS hijacking.

Phishing exploits: Web2 vulnerabilities in Web3 environments

Phishing is a long-standing threat in web2 environments. In web3, the process is similar: malicious actors use fake interfaces that mimic legitimate platforms to trick users into revealing private keys or signing malicious transactions.

These attacks rely on web2 vulnerabilities, such as fake domains and fake emails, to trick users into thinking they are interacting with a legitimate decentralized platform. For example, a phishing scheme targeting a DeFi platform could use a fake web2 website to compromise web3 wallets and steal funds. As a result, the overlap of these two networks creates new ways for malicious actors to blend traditional phishing attacks with new technologies, posing significant threats to users who assume that decentralization alone protects them.

The benefits of Web3’s transparency and decentralization

Despite the above risks, web3 still offers hope for a more secure internet through its decentralized and transparent frameworks. The backbone of web3, Blockchain, is an immutable ledger that is much more tamper-proof than traditional web2 databases. Smart contracts eliminate the need for intermediaries that could be compromised, while decentralized identity solutions give users control over their digital identities, reducing the effectiveness of phishing attacks.

Additionally, web3’s transparency allows users to verify transactions and audit systems in real time, providing a level of security and accountability that is difficult to achieve in web2’s opaque structures. By distributing control across multiple nodes, web3 reduces the risk of large-scale data breaches that are all too common in centralized systems.

Accelerating web3 adoption to reduce online security risks

To mitigate new security risks posed by the web2-web3 overlap, the technology community must accelerate the adoption of fully decentralized systems. As long as web3 remains partially dependent on web2 infrastructure, it will remain vulnerable to hybrid attacks that exploit weaknesses in both systems.

We’re already seeing how fully decentralized systems can increase security. For example, in the DeFi space, users transact directly with each other without relying on intermediaries, reducing the risk of third-party exploitation. Additionally, dApps built on blockchain networks allow users to securely interact with platforms without traditional logins or centralized data storage.

However, realizing the full potential of web3 will require a commitment from developers and industry leaders to build a decentralized infrastructure that operates independently of web2. This means investing in decentralized storage solutions, identity protocols, governance systems, and other similar platforms—all aimed at mitigating the risks inherent in the current hybrid space to create a more secure digital environment.

Ronghui Gu

Ronghui Gu is the co-founder of CertiK and Associate Professor of Computer Science at Columbia University. He holds a PhD in Computer Science from Yale University and a BS from Tsinghua University. As the primary designer and developer of CertiKOS and SeKVM, Professor Gu has received numerous awards, including the OSDI Jay Lepreau Best Paper Award, the SOSP Best Paper Award, two Amazon Research Awards, a CACM Research Highlight, and a Yale Distinguished Doctoral Award.