The Internet Is Held Together by Trust & That’s Kind of Terrifying
Every HTTPS connection, DNS lookup, and network route depends on some form of trust. So who exactly is your computer trusting when you open a website?
Every day, we type things like:
google.comamazon.comor the address of our bank into a browser.
A page appears.
We see the little lock icon.
And we continue as if the most obvious thing in the world just happened.
But there's a question I hadn't really thought about before:
How does my computer know that the server it connected to is actually who it claims to be?
Because if you think about it, the internet is full of machines communicating with machines they have never met before.
And somehow, they need to establish trust.
That trust turns out to be one of the foundations of the internet.
And it's surprisingly complicated.
Imagine the Internet Without Identity
Suppose you want to visit your bank's website.
You type:
1
mybank.comYour computer eventually gets an IP address and connects to a server.
But there's a problem.
How do you know that server actually belongs to your bank?
An attacker could theoretically try to impersonate it.
Simply asking the server,
“Are you really mybank.com?”
doesn't help much.
The attacker could just say:
“Yep.”
So we need a way for a server to prove its identity.
This is where digital certificates enter the picture.
The Internet Has ID Cards
When you connect to a website over HTTPS, the server provides a digital certificate.
You can think of it a little like an ID card.
It contains information connecting a domain name to a cryptographic public key and is digitally signed.
But now we've created another problem.
Who says the ID card is legitimate?
If anyone could create a certificate saying:
1
I am mybank.comthen certificates wouldn't mean anything.
So the certificate is usually signed by another trusted organization called a Certificate Authority (CA).
And now things start getting interesting.
Who Do We Trust?
Certificate Authorities are organizations trusted to verify identities and issue certificates.
Your browser and operating system already contain a collection of trusted root certificates.
These act as starting points for trust.
When a website presents its certificate, your browser can verify a chain that may look roughly like:
1
2
3
4
5
6
7
Website Certificate
↓
Intermediate Certificate Authority
↓
Root Certificate Authority
↓
Already trusted by your deviceThis is called a chain of trust.
Your browser doesn't necessarily trust the website directly.
It trusts the certificate authority that ultimately vouches for it.
In other words:
“I don't know you, but I trust someone who says you're legitimate.”
Which sounds suspiciously like how humans establish trust too.
Then HTTPS Can Actually Do Its Job
Once the server's identity has been authenticated, the browser and server establish a secure connection using TLS (Transport Layer Security).
Cryptography is then used so that information traveling between them can be protected from someone simply reading or modifying it in transit.
Conceptually:
1
2
3
4
5
6
You
|
| encrypted connection
|
v
WebsiteSo when you send something sensitive like a password the goal is that someone observing the network shouldn't simply see:
1
password = coffee123They see encrypted data instead.
The lock icon in your browser is therefore doing a lot more work than it appears to be.
But DNS Requires Trust Too
Before your browser can even connect to a website, it needs to figure out where the website is.
Humans like names:
1
example.comComputers ultimately need network addresses.
DNS, the Domain Name System, helps translate between them.
Very roughly:
1
2
3
4
5
6
7
example.com
↓
DNS
↓
IP address
↓
Website serverBut again, trust appears.
Your computer needs to trust the DNS information it receives enough to use it.
If an attacker could successfully convince you that:
1
mybank.com → attacker's serveryou could be sent somewhere you never intended to go.
Mechanisms such as DNSSEC exist to add cryptographic verification to parts of DNS, but the bigger point remains:
Even something as ordinary as typing a domain name depends on multiple systems working correctly.
And Then There's Internet Routing
Let's go one level deeper.
Suppose we know the correct IP address.
Your request still needs to travel across the internet to reach it.
It may pass through infrastructure operated by several different networks along the way.
Networks exchange information about how to reach different parts of the internet using routing protocols such as BGP - Border Gateway Protocol.
Very simplified:
1
2
3
4
5
6
7
8
9
Your Network
↓
Network A
↓
Network B
↓
Network C
↓
DestinationThese networks continuously exchange routing information that helps determine where traffic should go.
And once again, there is an element of trust.
The modern internet has added protections and validation mechanisms over time, but its architecture grew from systems where cooperation between networks was fundamental.
Which leads to something I find fascinating.
Trust Exists at Multiple Layers
Opening one website can involve trusting an entire stack of systems.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
Domain Name
↓
DNS
↓
IP Address
↓
Internet Routing
↓
Server
↓
TLS Certificate
↓
Certificate Authority
↓
Encrypted ConnectionWe usually experience all of that as:
click.
A webpage loads.
Most of the complexity disappears behind the browser.
So… Is the Internet Insecure?
Not exactly.
The internet isn't held together by blind trust.
Modern systems increasingly try to turn trust into something that can be verified cryptographically.
Certificates can be validated.
Digital signatures can be checked.
Encrypted connections can protect data.
Certificates can expire or be revoked.
DNS information can be signed.
Routing security continues to improve.
The interesting part is that security doesn't eliminate trust entirely.
Instead, we build mechanisms that answer questions like:
Who are we willing to trust?
How can they prove their identity?
How far should that trust extend?
What happens if something we trust is compromised?
The Part I Find Slightly Terrifying
When I first started learning networking, the internet felt like a giant collection of computers sending packets to each other.
The deeper you go, the stranger it becomes.
A website loads because DNS helped us find it.
Packets arrive because networks agreed on how to route them.
HTTPS works because cryptography protects the connection.
And identity works because somewhere in that process exists a chain of trust that eventually reaches something our device already believes.
The internet isn't secure because nobody has to trust anyone.
It's secure because we've spent decades building systems for deciding:
who should be trusted, what they should be trusted for, and how that trust can be verified.
So the next time that tiny lock appears beside a URL, it's worth remembering:
behind it is a surprisingly large infrastructure dedicated to answering one deceptively simple question—
“How do I know you are who you say you are?”
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article