The Association of Russian Banks has proposed requiring users to install root certificates issued by the National Certification Authority on their devices. RBC reported the appeal to the Digital Development Ministry on October 26. The ministry confirmed receiving the letter but has not made a decision on the proposal.
The banks propose automatically installing the certificates when apps are downloaded or updated, including them in factory settings on new devices, and developing tools for computers and smartphones already in use. They say the initiative would address difficulties accessing Russian websites after international certificates were revoked for some organizations.
A root certificate determines which certificate authorities an operating system or browser trusts when verifying secure connections. Installing one may expand the ability of the organization operating the certificate authority to issue trusted certificates for different domains.
Experts warn of the risk of impersonating secure connections and intercepting traffic under certain additional technical conditions. Installing a certificate alone, however, does not automatically allow every user message to be read. Such an attack also requires control over the connection, and some apps use additional protections.
As The Insider found by examining Apple and Google technical documentation, an ordinary banking app update does not ensure that all apps on iPhones and Android devices fully trust a new root certificate. Implementing the banks' proposals would require additional technical measures.