A bottle of bourbon on a counter, a fifty dollar bill, a driver's license, a label. Three credentials, each issued by a different authority, each holding up because somebody could be made to answer if it failed. That was Part 01, and the striking thing was how little moved: two generations of payment technology arrived, rebuilt money from the ground up, and left the other two credentials exactly as they were.
Now take the room away.
You are at home. The store is a website. The bottle is in a warehouse you will never see, and it will arrive on a different day from the one on which you pay for it. Nobody is in the room, because there is no room. Almost every layer on that counter was quietly relying on the three of you being in the same place at the same time, and all of it has to be rebuilt from nothing.
Start with a question that did not exist before, because it did not need to.
Is the store real? When you walked through a door you were not really trusting the shopkeeper, you were relying on the building. Premises are expensive, visible, and hard to abandon, which is a roundabout way of saying that whoever operates one can be found again later. A website has none of those properties. So the very first identity problem the web had to solve was not yours. It was the merchant's. That is what the padlock is: an X.509 certificate binding a domain to a cryptographic key, signed by a certificate authority whose own key your browser already trusts.
Which raises the obvious question of who vouches for the certificate authorities, and the answer is that browser makers do, by shipping a list of the ones they have decided to trust. The chain of trust has to stop somewhere, and it stops at a handful of companies in California maintaining a file. This is not a scandal. It is just worth knowing that the padlock ultimately means Google and Apple and Mozilla think this is fine.
The store also needs to remember you for the four minutes between picking up the bottle and paying for it, and the web was built with no memory at all. Lou Montulli solved that at Netscape in 1994 with the cookie, invented specifically so that shopping carts could exist. Within about two years the same mechanism was being used to follow people between sites who had never asked to be followed.
The shopping cart and the surveillance economy are the same invention. Nobody planned the second part. |
Now the three credentials.
| |
The money. There is no chip and no PIN pad, so the strongest verification of the previous era simply cannot run. The industry's name for this is beautifully honest: card not present. A whole category of fraud named after an absence. |
What is striking is that the absence never stopped anything. Online retail did not wait for a secure mechanism. From the mid-1990s you typed the number into a form and it worked. That number had been designed to be swiped off a physical card in a store, where possessing the card was the point. Online it was cut loose from the card entirely, typed by anyone who had seen it, and stored on the servers of everyone you had ever bought from. A global industry scaled on that.
It held together because the liability had already been assigned. Card-not-present fraud falls on the merchant, so merchants priced it in and kept selling.
Security came afterward, as a retrofit. Tokenization swapped the stored number for a substitute that is worthless to a thief. 3-D Secure added the step where checkout bounces you to your bank to confirm you are you. Both were bolted onto a system already running at enormous scale, and neither was ever compulsory in America. Europe eventually passed a law requiring banks to check customers more strictly. The United States never did, and still has not. It left the question to the liability rules and let merchants decide for themselves how much fraud they were willing to eat.
Both approaches produced working e-commerce. Only one of them involved a regulator.
And the honest answer to "is this really you" online is usually none of the above. It is a fraud model: a score computed from your device, your location, your behavior and your history, deciding on a balance of probabilities whether to let you through. Sit with that. Your identity, at the moment of purchase, is frequently not verified at all. It is estimated. The clerk knew. The model guesses, and it guesses right often enough that the losses stay cheaper than the alternative. Your phone works the same way, calibrated to be wrong rarely enough that nobody minds.
|
Under the Counter
Who sold the store its card machine?
The clerk's terminal did not appear by magic. The store holds a merchant account with an acquiring bank, and somebody sold them the hardware, usually the acquirer or an independent sales organization reselling on its behalf. Before any of that, the bank underwrote the business: checked what it sells, how long it has traded, how likely it is to fail and leave unpaid chargebacks behind. That took weeks.
Moving online did not remove that structure. It added to it. A website has no terminal, so it needs something to carry a card number from a web form to the processor. That piece got a name in late 1996, when Authorize.Net was designed and then launched in April 1997. Its founder built it because the alternative was selling his clients expensive, already-outdated terminal hardware. He also chose SSL over the more sophisticated CyberCash, on the grounds that banks already trusted SSL and it did not require installing proprietary software on the merchant's server. The easier thing won again, exactly as it did with passwords and cookies.
But you still needed your own merchant account, underwritten one business at a time. For most of the late 1990s and 2000s, the barrier to selling online was not building a website. It was persuading a bank to take you on.
That is what PayPal, Stripe and Square dismantled. A payment facilitator puts thousands of small sellers underneath its own merchant account as submerchants, having done the underwriting once, for itself. Onboarding fell from weeks to minutes.
Which quietly moved a decision. It used to be a bank that decided whether you were allowed to sell things. Now it is a platform, applying its own rules, at its own speed, with its own appetite for risk. Sellers discover this the day the platform decides it no longer likes their category and the money stops.
Remember that mechanism. In Part 03 the same move happens on the other side of the counter, and a platform starts deciding which buyers are allowed to transact.
|
 |
| |
The age. Here the system simply gave up. |
With no face to look at and no photograph to compare it to, age verification collapsed into a checkbox you tick yourself. A state-issued credential, checked against your physical person by someone legally answerable for getting it wrong, was replaced by a promise you make to a form. This was legally sufficient for roughly two decades and nobody much minded, which tells you how seriously the requirement was ever taken.
Courts eventually noticed. Texas required commercial sites publishing sexually explicit material to verify visitors' ages, and in Free Speech Coalition v. Paxton, decided June 27, 2025, the Supreme Court upheld it six to three, under a lighter First Amendment standard than it applied to a comparable federal law in 2004. Expect a great deal more of it.
Set aside where you land on that and notice the mechanics. A rule meant to keep minors away from certain material requires adults to hand identity documents to commercial websites: more identity data, disclosed to more parties, with weaker enforcement behind it, to answer the same one-bit question the clerk answered by looking up from the register.
And for the bourbon, none of that is the actual control. Every state that permits direct-to-consumer alcohol shipping requires delivery to someone over twenty-one who is present, produces government-issued photo identification, and signs for it. FedEx will not leave it at your door. The real control is a delivery driver looking at your license and comparing it to your face, exactly as the clerk did.
That is worth stating plainly, because it will matter enormously in Part 03. Across seventy years of relentless digitization, the age check never got solved. It got postponed to the doorstep. The one step in this entire transaction that was never digitized is a stranger looking at your face.
| |
The label. You cannot read it. The bottle is in a box in a truck. Everything the TTB standard of identity guarantees is still true, and none of it is available to you at the moment you decide to buy. |
So the question passed to strangers. Reviews, ratings, seller feedback, the platform's own reputation. This is the medieval guild rebuilt out of anonymous opinion, and it is much weaker than what it replaced for one specific reason: nobody is answerable. A hallmark was struck by an assay office that could be sued. A five star average was written by a person who cannot be found, and an entire industry exists to manufacture them.
Notice the pattern across all three. Money got a genuine cryptographic upgrade. Age got a checkbox and a delivery driver. The label got worse. The layers did not modernize together, they diverged, and they diverged according to who was on the hook. Card networks lose money on payment fraud, so payment fraud got solved. Nobody's balance sheet suffers when a review is fake.
Which brings us to the thing that actually made global commerce possible, and it is not what people usually say.
It was not the internet. It was not encryption. You can buy that bottle from a merchant in another state or another country, under a legal system you have never read, because a card network sits in the middle and guarantees settlement, and because a set of rules decides in advance who absorbs the loss when it goes wrong. Chargebacks, liability shift, interchange. Planetary commerce did not require us to agree on who anybody is. It required us to agree on who pays when we are wrong.
Hold that thought.
Next time, an agent buys the bourbon, and that question will not have an answer.