Why don't wallets use web-based APIs instead of downloading entire blockchain?

Question

I read other Q/A such as Why do Ethereum clients download the entire blockchain?, but no one addresses the question why the wallet can't just use a web-based API to read/update the blockchain when needed, rather than downloading and syncing the whole huge blockchain.

For years, I've worked the old client/server mentality, that the client just talk to a server where the data resides; even though it's a peer-to-peer network, why doesn't that model work here? Couldn't it randomly connect to someone node of a miner?

It looks like even the light-clients will download a certain amount of the blockchain as well?

Are all wallets considered "clients" then, by definition?

(I installed Parity on my C Drive, and it filled up the drive. Seems like they should at least warn you of the space required on the install, then I would have chosen a different drive.)

Answer 1

As mentioned by others, the problem with APIs is that they are centralized sources of information. This basically eliminates the single most important value-proposition of the blockchain. This is, arguably, more problematic than a fully-centralized service. Most fully-centralized services have methods of reverting malicious modifications of state if they are discovered (e.g.; if someone hacks your bank account, the bank itself is liable and must refund the money lost). The folks at Infura have happily stated that they don't see their service as a long-term solution. It is intended to be a better-than-nothing measure to help reduce the barrier of entry into the blockchain space.

Light clients are intended to address the size issues while maintaining the security of the blockchain, and will ultimately power most desktop blockchain applications (e.g.; the Mist browser). While they might not be 'light' by the standards of a classical client-server interaction, they are significantly more lightweight than running a true node. Once we have stabilized and well-tested light clients, they will allow for much more reasonable application sizes.

In terms of non-client solutions, I recently co-authored a whitepaper proposing a solution. I may be biased, but I think its pretty neat :) It allows for greatly increased security-guarantees and decentralization, but with overhead comparable to a centralized API. I'll add a tl;dr and link below in case anyone cares to know more.

---

whitepaper

TL;DR: Use a proof-of-stake style system to create trustless channels that allow groups of people with nodes to be rewarded for acting as API endpoints, and punished for any malicious activity. We show that we may engineer the system such that:

1. Users may recoup their losses from the stake of malicious parties.

2. The reward to tell the truth is always greater than the reward to lie.

3. Decentralized infrastructure scales proportionate to demand (thanks to mining-esque reward system).

4. Lightweight enough to function within regular website JavaScript, just like a centralized API.

5. Not a side-chain (yay!).

Answer 2

They could, but it's a security issue. If everyone relies on the same API's (like infura) then the entire network is actually centralized. To have true decentralization, you need to have everyone have a copy of the whole chain. Game theory plays in a bit, and its likely that as the chain gets bigger, more people will do this; but no self respecting wallet maker would call their wallet secure at the moment if they used an API.