Where do you save the application data of a Dapp?

Question

Let's say that I want to implement a Dapp similar to Facebook. Each user has its own profile, pictures and information. Usually you would use a database to store all this data. This guarantees that only the DB owner can access it and that no entity can modify the data if not allowed to.

Now how would it work for a decentralized application?

Storing on chain does not seem like a viable solution because of the gas required and also because all the information would be accessible and visible to everyone. An alternative is to store it encrypted off-chain for example with IPFS but then which entity would decide what information a user can see? Or if the entire information stored needs to be used to calculate certain results for the user, how do you calculate those results without someone having access to the entire data? An how would you distribute the decryption keys?

Wouldn't you still require a node that acts as a database and so it has access to all the data and returns only what another user can see? This though would make it a centralized application.

I feel like the only solution to this problem is to use homomorphic encryption, but we are still quite far from a fast and efficient implementation.

Answer 1

This question is difficult to be answered precisely and objectively in the sense of this site, but it's one of my favourite topics, so I'll give it a try. ;-)

IMHO a good solution for something like a decentralised Facebook would be:

Manage relations, data fingerprints (hashes) and permissions on-chain, but keep all the data in a private (per user) database. Offer a service facade (per user again) to this database, which can check the signed requests against the on-chain permissions and serve the content accordingly.

This way, the data is decentralised and it stays completely in the control of it's owner. Thanks to virtualisation, it would be feasible to offer the users prepared setups (images) for the database and service facade. These can be run at own infrastructure (home computer, dedicated server) or in the cloud.

Moreover, when you have a decentralised architecture, you still can offer centralised services on-top of it for users that want the comfort and do not care about having the full control of their data. The great thing is: even in this case, users can have the choice between different providers and easily move their data between them.

A word about IPFS: it sounds tempting to use it for the storage, since it's decentralised. But as you already mentioned, you're running into the problem that it's getting complicated when you try to put an access layer on top of it.

An example from the pre-blockchain era for such setups is Dispora -> „https://diasporafoundation.org“. I am wondering that they didn‘t yet combine their concepts with the blockchain.