Understanding User-Perceived Security Risks and Mitigation Strategies in the Web3 Ecosystem

Literature Title

Understanding User-Perceived Security Risks and Mitigation Strategies in the Web3 Ecosystem

Literature Information

• Subject Area: User-perceived security risks and mitigation strategies in the Web3 ecosystem
• Keywords: Web3 ecosystem, security risks, user perception, mitigation strategies, blockchain systems, decentralized applications, decentralized finance (DeFi), data privacy, technology and society integration

Research Background and Issues

• Problem Identification:

  • Web3 technology is characterized by decentralization and user sovereignty, but this architecture shifts security responsibilities to users.
  • There is a lack of security research from the user perspective in Web3; most existing studies focus on technical aspects, leaving users challenged in addressing security issues.

• Research Importance and Motivation:

  • Web3 has the potential to become a critical foundation for the future internet, and user security behavior and perception are essential for enhancing the ecosystem's overall security.
  • Issues such as smart contract vulnerabilities, improper private key management, and user behavioral habits leading to data leaks frequently result in significant asset losses and trust crises.

• Research Objectives and Key Questions:

  1. What security risks do users perceive at different levels of the Web3 ecosystem?
  2. What strategies do users adopt to mitigate these security risks?

Solution

• Research Methods:

  • Proposed a Web3 ecosystem user interaction framework to analyze user behaviors within blockchain systems, decentralized applications (DApps), online communities, and off-chain cryptocurrency ecosystems.
  • Based on this framework, conducted 21 semi-structured interviews to explore users' security perceptions and their mitigation measures against these threats.

• Framework Overview:

  • Interaction Levels: Blockchain systems, DApps, online communities, off-chain cryptocurrency ecosystems.
  • Describes user operations and risks at each level, including behavioral habit leaks, multi-platform collaboration anxiety, and social engineering attacks.

• Innovations:

  • Refined the classification of security issues in the Web3 ecosystem from a user perspective.
  • Considered not only technical security issues but also those caused by regulatory constraints and human factors.

Research Findings

• Security Issues of Concern to Users:

  • Consensus level: Issues such as blockchain centralization and system reliability.
  • DApp level: Problems like Rug Pulls (project team absconding), smart contract vulnerabilities, and interactions with untrusted third parties.
  • Online community: Prevalence of social engineering attacks such as phishing, with users struggling to identify phishing links.
  • Off-chain ecosystem: Regulatory compliance of centralized exchanges (CEX), counterparty qualifications, and privacy leaks caused by KYC processes.

• Mitigation Strategy Classification:

  1. Risk Assessment: Includes open-source information retrieval, code reviews, product trials, and seeking help from the community.
  2. Risk Avoidance: Trusting market leaders, staying updated on industry news, and storing assets on CEX.
  3. Risk Diversification: Portfolio strategies to spread risks across different projects.
  4. Risk Acceptance: Acknowledging uncontrollability and risks, and choosing to accept them.

• Key Contributions:

  • Provided in-depth insights into user security risks, revealing critical challenges commonly faced by users in the Web3 ecosystem.
  • Described how users actively adopt mitigation measures to address multi-level risks.
  • Proposed clear technical and design recommendations, such as enhancing technical literacy through education and broadening information dissemination.

• Experiments and Future Directions:

  • Experimental validation showed no new themes emerged from the dataset, indicating theoretical saturation.
  • Limitations include participants primarily from Asia, reflecting regional homogeneity and gender representation imbalance.
  • Future research suggests broader geographical coverage and deeper gender difference analysis to further validate initial hypotheses and the effectiveness of security education.

Research Significance:

This paper identifies user-perceived security risks and mitigation strategies in the Web3 environment, providing critical insights for the future security design of the Web3 ecosystem.