HTTPS is Complicated

I love hidden assumptions. Ideas and services we take for granted. Take, for example, HTTPS.

The entire commercial Web has moved from http:// to https://. We did that because it is more secure. And it is.

But it’s also way way way more complicated to set up. I’m not going to try an explain how it works. I have a B.S. in Mathematics/Computer Science from a top 5 university plus a M.S. in Computer Science and Engineering from another top school. I can whiteboard what happens during the connection, but I don’t understand all the bits and pieces that are required to make that happen.

HTTPS is complicated.

If it were a consumer product, it would have failed years ago, as no consumer would complete the installation process. In an online consumer buying experience, you order, they send you an email with a link, you click the link and maybe you have to login twice.

For HTTPS you order, they send you an email with cryptic instructions. You follow the instructions. There is no link to follow. No next button to click. You just blindly wait wondering if you did it right. If you didn’t, as I apparently hadn’t for an entire month, nothing happens. If you do, you get a second email with more cryptic instructions. In my case, five calls and multiple email to customer service and voila, my HTTPS works again.

This is a great example of a market failure. Whomever invented the HTTPS system was not just a Computer Scientist but a cryptologist. That person or committee didn’t understand that 99.99% of humanity are not cryptologists. They certainly were not product designers or entrepreneurs.

But alas, this is a great example of a market that likely won’t get fixed anytime soon. It’s akin to taxes. Those who design the system don’t pay the high price of the complexity they create. The masses bear that cost. Every website owner now pays a few hours once per year to keep this complicated system going.

Until some entrepreneur finds a way to hack the system, smooth the edges, and create the better HTTPS mousetrap.

There are a lot of great posts buried in this blog’s archives that are still quite apt. Today is another reprise, this time revisiting the (often invisible) tradeoff between efficiency and resilience. Last time I explained that tradeoff with the case study of electricity blackouts in Texas and how that related to Google’s monopoly on search and Amazon’s dominance of eCommerce...

Who invented double entry accounting? The ubiquitous system of general ledgers, income statements, balance sheets, and cashflow statements found throughout businesses and quite a lot of households? This is yet-another of those concept so taken for granted that they seem to have been around “forever”, but thanks to Double Entry: How the Merchants of Venice Created Modern Finance by...

Many of the everyday details in The Work of the Stock Market told in between the history facts are often just as interesting as the history itself. Case in point, if you read the history of time zones, it seemed like the standardization was complete in the U.S. and Europe by the end of the 1800s. Yet in 1922… The difference in time between London and New York is four minutes and one second...

The standard structure for private equity funds (and venture capital funds) is “2&20”, as in a 2% management fee (±1%) and 20% (±10%) of the profits, a.k.a. “carried interest“. Why 20% of the profits? Henry Kravis of KKR explains below, starting at 6:00. TL;DR: Necessity, as he and his partners had no capital to put at risk. Share this:Click to share on Twitter (Opens...

Why did New York need another stock exchange in 1968? Why was the New York Stock Exchange, American Stock Exchange, and Pacific Stock Exchange insufficient? An unprecedented bull market coupled with paper-based systems. I’m in my 50’s and don’t remember “Wall Street” not having both the NYSE and NASDAQ as the two main exchanges. I am old enough to remember the AMEX...