2

I'm trying to understand how publicly available and easy to access the information embedded in contracts is, in plain language.

Am I able to query the contracts in the Ethereum blockchain, similar to how you can look into transactions within the bitcoin blockchain?

For all these dapps being developed that may require sensitive information (SSNs, health information, date of birth, other...), how are they managing this?

Many thanks in advance.

eth
  • 85,679
  • 53
  • 285
  • 406
Mark J.
  • 361
  • 2
  • 6

1 Answers1

3

Everything on the blockchain is public.

For sensitive stuff, the most you should do is store a hash of the data for verification purposes, but the data itself should definitely not be on the blockchain.

Péter Szilágyi
  • 10,436
  • 39
  • 42
  • Or, if absolutely necessary, encrypt the data outside the blockchain. – Nick Johnson Apr 16 '16 at 11:14
  • That is indeed a workable solution too and often suggested. The reason I myself am a bit skeptical about it is because you leave your data there for the picking. If you have a data leak or someone manages to get hold of your keys, instant data access and you cannot do anything about it. There's simply no way to remove access. – Péter Szilágyi Apr 16 '16 at 14:07
  • Thanks guys. How would it work in this example-- say the contract is for an insurance claim and it checks other insurers to make sure someone with that identity hadn't submitted a duplicate claim. So it would need to check some form of common ID, like an SSN, Drivers license, etc. If you hashed this information, would those other insurers be able to see it? Or would the hash prevent that? Trying to understand how you can allow some parties to see it and not other parties. – Mark J. Apr 16 '16 at 16:46
  • Well, the point of hashing is really to prove that some data which you obtain via external channels is indeed the one "recorded" in the blockchain. In your particular example, you could "hide" the real SSN by for example hashing it and using the hash for all operations. Then anyone who has your SSN can easily match it to claims in the chain, but you wouldn't be able to retrieve the SSN from public data. Of course you'd still need to solve the issue of how to ensure everyone uses only his own SSN, but that's a different problem. – Péter Szilágyi Apr 16 '16 at 18:05
  • @PéterSzilágyi Can you show an example of how someone would read a string stored in a state variable marked private? – nipponese Apr 05 '18 at 19:17