How do DApps that don't need their users to run Ethereum nodes or Metamask work?

Question

For example, A website which will give the option to register an ethereum account. The user would hit the register button and the server, which I assume is running a node 24/7 and will generate an account via web3.eth.personal.newAccount. The server then sends back the public and private key for this account to the user.

Now the website also has the option to allow users to deploy a smart contract. To do this I assume they would send their public key/private key and the server will use this to deploy the contract from the users account after unlocking it.

But this account would have 0 ether since the user isn't mining with it because they don't even have an ethereum node. Another solution could be the server has one account which contains ether as the server is mining. The server then deploys all contracts from this one account on behalf of the other users but declares them as the owner of the contract in some way.

Could someone clarify what approach is taken to implement such a website?

Answer 1

Most likely the workflow you mentioned is not optimal for security purposes.

Importantly:

No user should trust a service that is generating keys on it's centralized server

Luckily you can include the web3 library in the web browser, so your users can generate and store keys there. Again NOTE: There are several best practices and procedures for doing this securely.

As you mentioned, this Ethereum account will not have any funds available to publish transactions (or smart contracts to the Ethereum network). Transfer of funds to this new account is a separate flow, and would require the user getting ETH from somewhere (your service could provide a small amount of ETH to the account on creation).

Your second scenario of offering a "free smart contract publishing service" is possible, but introduces new challenges: preventing users from exploiting your service, and making sure all deployed contracts are ownable by your users and not just the key you are publishing them to the blockchain with.

Conceivable Flow:

1. Ideally for security purposes, you would create or support a user wallet or client as an app or in browser which would allow users to manage keys.

2. Secondly users should have to get their own ETH (or people will try to exploit your free ETH service).

3. Thirdly, after your users have keys and ETH, your client software can generate and sign smart contract code for users.

4. Lastly, after the contracts are signed (by the users keys, with funds available), your service can publish these to the Ethereum network (for example).