Providing Metamask hooks only using node hosted on server

Question

I am currently looking into hosting an Ethereum node on my web server in order to allow my users to interact with my dApps without needing Metamask (although it could be used). How could I have the client side Web3.js code interact with my server as the hook instead of whatever would normally be injected by Metamask. If I were to include the web3.js code on my server and link it in the header, could I simply construct the Web3 object with my node as the provider and Metamask would no longer be necessary?

If Metamask is necessary for normal browsers no matter what, an explanation of why would be greatly appreciated. If what I've stated could work, how could I use my server hosted node as a provider (what port would I use and could I use my normal domain) as well as what could I do to improve security. My biggest worry is that if everything works as simply as I've suggested here, that someone could create a website of their own that connects to my node and everyone will start using my node for all of their websites.

My server is setup as a LAMP server and I use named virtual hosts in order to redirect/control traffic as I need it (could this be used to secure my node from others using it). I would prefer to stick with my current setup instead of switching to node.js but if it is absolutely necessary in order to get a site that works without Metamask, I would definitely look into it.

Answer 1

I work on MetaMask.

I think MetaMask mostly does two things:

1. It provides a web3 object to read from, a blockchain data source.
2. It manages the user's keys, and by connecting them to the web3 API, gives sites an easy way to request that a user signs a transaction, without giving up the user's control to approve only what they want.

The solution you proposed would be an easy-drop in replacement for MetaMask in the first case I described. The trickier issue is the user's key management. Where do you think that would fall, on your proposed LAMP setup?

You might just choose to manage user accounts server side, store the users' private keys for them, and require they fund the accounts when they start, maybe making it easy to fund it with the Coinbase widget like MetaMask does.

The biggest problem here is that the trust model isn't really decentralized. Your server becomes a central point of trust and failure. If a single hacker gained access to your server, every single user's account could be completely drained and all assets stolen, in one fell swoop.

Part of the innovation in blockchains is in keeping a user's cryptographic keys under their own control. There are some decent ways to do this without MetaMask. My favorite is if your users have a hardware wallet, there are some decent libraries for Ledger, for example, but most people don't have a Ledger.

Before MetaMask, people would do a lot of insecure things to make sites where users could interact with Ethereum. Things like requiring them to upload private keys, or giving them commands to copy and paste in their command lines.

That's the basic problem that led to me deciding to work on MetaMask. Those user experiences were awful, and we needed easier ways to interact with Ethereum. There are some cool new models based around mobile applications, but I think MetaMask is still really important for desktop, because it makes it as easy as building a web site to make an Ethereum-compatible app.

I hope this answers your question.