Why can't we use https for everything?

First, briefly, a reminder of what https (http-s) means:

• Verification of the identity of the remote site. Https uses cryptographic "certificates" that allow the browser to positively confirm that the site you're connecting to is, in fact, the site that it claims to be.

• Encryption of the data that flows between your browser and the remote site. All the data sent is strongly encrypted such that only the recipient can decrypt it to view its contents.

Verification and encryption: that's all https really does, but those are two very important and useful things.

As you might expect web sites that will request sensitive information from you should be https. Banking sites, for example, should always have an https connection to enforce both identity verification (you really are connected to your bank), and data encryption (no one "listening in" will be able to see your information).

What's not as obvious is that https technology could be used in other ways.

For example, as you suggest, what if all downloads from microsoft.com were via an https connection? That way you could be absolutely certain that your download was coming from microsoft.com, and not some spoofed or phishing site.

There are a few problems with this as a blanket solution:

• The biggest issue is that phishing and viruses don't actually use the microsoft.com domain. They use some other domain that somehow looks enough like microsoft.com to fool the casual user. For example, "microsoft.com.ask-leo.com" is a totally valid (though unimplemented) domain, and if you only read the first part, of if the rest was partially obscured, you might think you were going to microsoft.com when you weren't. The fact that microsoft.com might have an https connection means nothing if that's not where you're connecting.

• Https is also easy to set up. As I've shown in an earlier article, https://ask-leo.com exists (though there's nothing there right now). I could get a real https certificate for it, and could even go so far as to make https://microsoft.com.ask-leo.com work. Particularly if I were overseas, the accountability that getting an https certificate requires might even be called into question.

• People ignore errors. If you went to https://ask-leo.com you'll get an error message because it's not a real certificate. However, that can be bypassed. It likely would be in the case of someone who doesn't understand the potential ramifications, or someone in desperate need of whatever the link was supposed to provide. If a phishing site were to throw the same error on an https connection, enough people would still fall for it anyway to make it successful.

• People don't look at http versus https. If you get an email that says "your download is at http://microsoft.com/...", how would you know that it was supposed to be at https? And would you even notice? How would a user know that https should be required? We've had years to get people used to "you need https for banking" and yet people are still phished and scammed every day.

There's also a cost for website owners for https to be done properly. https://ask-leo.com currently uses what's called a free "self signed" certificate, which means that while data on the connection is encrypted, there's no additional validation that the site you've connected to is, in fact, ask-leo.com. In order to get that level of validation (and remove the warning a visitor will experience), I as the site owner need to purchase what I'll call a "real" certificate, renewable and payable every year. The purchase process also requires that I prove ownership of the site and a certain amount about myself.

All this isn't to say that https doesn't serve it's purpose - it does. As I said, it remains critical to validate your connections when you pay attention, and it keeps your data safe from prying eyes when used.

And it's very possible that we may see more sites move to https as a connection mechanism, particularly when offering even marginally sensitive information. I know I appreciate it when I see it. But widespread adoption to actually prevent phishing or other forms of deception, while possible, would require some truly Draconian measures along the lines of browsers requiring only valid certificates with no work arounds, and perhaps even requiring only https connections period.

That's just not likely to happen any time soon.