cross-posted from: https://scribe.disroot.org/post/10554455

This week, the websites of major Russian banks—Sber, VTB, Rosselkhozbank, T-Bank, Uralsib, Promsvyazbank and Bank Saint Petersburg—began serving TLS certificates issued by Russia’s Ministry of Digital Development, Mediazona discovered. Just last week, on July 31, all of them were still using certificates from the Chinese authority TrustAsia.

…

The migration is uneven. T-Bank moved only tinkoff.ru, which references the bank’s more common older name, leaving tbank.ru still on US-based Let’s Encrypt certificate. Levoberezhny bank switched only its business banking. Alfa-Bank made the jump last week.

…

(T-bank, widely known as Tinkoff, dropped its founder’s name in 2024, two years after Oleg Tinkov denounced the invasion of Ukraine. Tinkov says he was pressured into selling his stake at 3% of its value. He renounced his Russian citizenship later that year, left the country and was subsequently designated a “foreign agent”.)

…

No major browser trusts the Ministry’s root—so the Ministry is asking users to install it manually, describing the step as “safe” and as having no effect on how devices function.

Once a root certificate is installed, it can vouch for any domain—not just the bank a person installed it to reach, but Gmail, iCloud, a messaging service, a news site. The browser accepts the result silently, because the user told it to. And the agency making the request already operates the network the traffic crosses: TSPU deep-packet-inspection equipment sits inline at Russian ISPs while state DNS resolvers can redirect a hostname to a server of their choosing.

…

Archived