Well-intentioned decisions have just made it easier for Putin to control the Russian Internet


This article is in large part inspired by a recent article from Meduza (in Russian).

Since the beginning of the war in Ukraine, Russian users have had problems accessing government websites and online banking clients. Browsers began to mark these sites as unsafe and drop the connection. The reason is the revocation of digital security certificates by foreign certificate authorities (either as a direct consequence of sanctions or as an independent, good will move); without them, browsers do not trust sites and “protect” their users from them.

However, these actions, caused - or at least triggered by - a desire to punish Russia for their gruesome actions in Ukraine, will have long-lasting consequences for Russian netizens.

Digital certificates are needed to confirm that the site the user wants to visit is not fraudulent. The certificates contain encryption keys to establish a secure connection between the site and the user. It is very easy to understand whether a page on the Internet is protected by a certificate. One need just look at the address bar of the browser. If the address begins with the https:// prefix, and there is a lock symbol next to the address, the page is protected. By clicking on this lock, you can see the status of the connection, the name of the Certification Authority (CA) that issued the certificate, and its validity period.

There are several dozen commercial and non-commercial organizations in the world that have digital root certificates, but 3/4 of all certificates are issued by only five of the largest companies. Four of them are registered in the USA and one is registered in Belgium.

As a rule, digital certificates have a tree structure: the owner of the root CA can allow the right to issue CAs signed by its root certificate. They, in turn, will issue child certificates. All participants in the chain earn money from this. For example, a company that owns many sites for different products can obtain a single identity certificate from a root certificate (RC) owner and use it to sign child certificates, separate for each site.

There have been a few reports about foreign CAs, including Sectigo and Digicert, restricting (revoking or not prolonging) their certificates for .ru, .by, .su and .рф top level domains (TLDs) and Russia-based organizations. Additionally, under the conditions of sanctions restrictions on payment systems, Russian sites may simply lose the ability to pay for such services.

Recent statistics (statonline, statdom) show that Sectigo and Digicert account for a small percentage of issued certificates. Let's Encrypt certificates, however, comprise the majority of all certificates issued. These certificates might not be used by the most important services and the biggest companies, but they are in widespread use in Russia. Should Let’s Encrypt and other CAs blindly follow the actions of Sectigo and Digicert, the impact would be enormous.

Where does CA censorship lead?

Modern browsers, as a rule, do not open sites that are not protected by a certificate, and provide a warning about an "insecure connection". In addition, search engines significantly lower such sites in search results. The security and authenticity of the connection is especially important when it comes to working with critical services: e-mail, social networking sites, online banking, and government services.

It is for the last two cases that Russia’s Ministry of Digital Development deliberately offers its own root certificate, from which it is possible to issue child certificates for banks and public service websites, without being tied to international organizations.

But there is a problem with this approach. Since Google (Chrome), Apple (Safari), Microsoft (Edge) and Mozilla (Firefox) do not recognize this certificate, users will either have to switch to browsers from Yandex and VK (formerly Mail.ru Group) or manually add a Russian certificate to the trusted list.

When installing domestic browsers, the process is clear. On March 10th, users of Gosuslugi (an e-government website that manages various government services like tax, marriage registration, passports, driving licenses, etc.) received a newsletter from the Ministry of Digital Transformation encouraging the installation of Yandex.Browser or Atom (Mail.ru), both of which "support Russian certificates."

Since the certificate is state-owned, its installation is a matter of placing trust in the authorities. Usually, when working with a secure site, the internet provider or any other party, except yourself and the secure site, do not have access to the data that the user exchanges with the page. State certificates, however, will allow the Russian government to access information in unencrypted form, by performing a so-called “man-in-the-middle” (MitM) attack.

In addition, the mass information campaign by banks and government services, which will need to be carried out in order to encourage users to install certificates, opens up new opportunities for telephone scammers. They will be able to convince users, allegedly on behalf of the support service, to install a fake certificate on their own devices.

Theoretically, the Russian government could try to ask foreign technology companies to accept their certificate. If the state root certificate is added to the trusted list, browsers will consider the connection to the site where Russian certificates are installed as safe. But in the current situation, it is difficult to count on such assistance. Users of foreign browsers, that is, the most popular ones - Chrome, Safari, Firefox - will have to be convinced to add the certificate to the list of trusted ones manually. That being said, global companies can still blacklist the certificate. In this case users won’t have any other option but to install a browser from a local company, which will obey orders to trust state-issued certificates.

How exactly can the government intercept encrypted communications using state-issued certificates?

HTTPS secures communication between browsers and websites by encrypting the communication, preventing ISPs and governments from reading or modifying it. Servers prove their identity by presenting certificates that are digitally signed by Certificate Authorities (CAs), entities trusted by web browsers to vouch for the identity of sites. 

For example, facebook.com provides a certificate to browsers that is signed by DigiCert, a CA that is trusted and built-in on virtually all browsers. Browsers can know they are talking to the real facebook.com by validating the presented certificate and confirming that it is signed by a CA that they trust (DigiCert). The certificate provided by facebook.com also contains a public cryptographic key that is used to secure subsequent communication between the browser and Facebook.

In an HTTPS interception attack (a kind of “man-in-the-middle” or MitM attack), an in-network adversary pretends to be a website (e.g. facebook.com) and presents its own fake certificate with the attacker’s public key. Normally, the attacker cannot get any legitimate CA to sign a certificate for a domain the attacker doesn’t control, and so browsers will detect and thwart this kind of attack. However, if the attacker can convince users to install a new CA’s root certificate into their browsers, the browsers will trust the attacker’s fake certificates signed by this illegitimate CA. With these fake certificates (or state-issued ones), the attacker (the state) can impersonate any website, modifying its content or recording exactly what users do or post on the site. For this reason, users should not install root CA certificates, because it opens them up to having their otherwise secure communication intercepted or modified without their knowledge.

Has anyone already introduced state certificates?

Russia predictably finds itself in the company of countries most concerned about internet sovereignty and foreign media influence. In China, there are currently more than ten Certificate Authorities that Microsoft has added to the list of trusted ones in Windows and the Edge browser. However, there have been cases of revoking the status of trusted Chinese CAs. In 2017, Microsoft, Apple, Google and Mozilla blacklisted the WoSign CA “due to loss of trust”. In 2015, Google and Mozilla stopped recognizing the root certificate of CNNIC - the organization responsible for managing the Chinese segment of the Internet. This came after attempts to use CNNIC child certificates to spy on users in Egypt.

An example closer to Russians can be found in Kazakhstan, where since 2015, under the pretext of fighting terrorism, the government has already tried to offer users a “state certificate” three times. The first attempt was so ill-conceived that it led to disruption of banks and popular Internet services. Mass failures occurred in international systems, such as websites, payment and advertising platforms. Browsers simply blocked traffic. Their security systems considered what was happening as a man-in-the-middle attack and showed users an error.

In two more subsequent unsuccessful attempts, the Kazakh authorities tried to issue certificates for Facebook, Twitter and Google, but users refused to install such certificates on their devices. Browser developers have blacklisted certificates en masse. Mozilla noted:

“To protect our users, Firefox, together with Chrome, will block the use of the Kazakhstan root CA certificate. This means that it will not be trusted by Firefox even if the user has installed it.” 

The Kazakh authorities have abandoned their attempts at manipulating certificates and have simply moved to the practice of massive Internet shutdowns during crisis situations.

What should Russian users do now?

It is not yet worth adding state certificates to the main browsers. It is better for Russian users to use Yandex.Browser or Atom from Mail.ru exclusively to access government websites and online banks. Russian internet users do not have to worry about the rest of their device’s traffic until the Russian root certificate is added to the list of trusted certificates provided by foreign developers. Yandex and Atom should only be used if there is a need to access Russian government websites and Russian online banks.

What can the international community do?

Governments and companies should be careful in their moves to place sanctions and restrictions on Russia; certain actions might actually help Putin and his regime to harden their grip on the Russian internet and freedom of speech (or whatever is left of it).

ICANN for example, in response to an inquiry to revoke SSL certificates for Russian domains, refused to do so, but did not condemn such requests. ICANN merely stated that this question is outside of their domain: 

“We do not have the ability to revoke the specific SSL certificates for the domains you mentioned. These certificates are produced by third-party operators and ICANN is not involved in their issuance.”

GreatFire, along with other parties advocating for free and safe internet access, urge all actors who are considering steps that would limit or endanger internet access in the Russian Federation to carefully consider the full impact of these sanctions and other measures. While revoking or not (re-)issuing SSL certificates might be thought of as a well-intentioned way of putting pressure on the Russian authorities, the unintended consequences of such an action might create the exact opposite situation - one where Putin has increased control over online speech in Russia.



订阅 email
显示 博客 | Google+ | Twitter | 全部 的消息. 使用 RSS 订阅我们的博客。

星期四, 8月 10, 2023

1.4 million people used FreeBrowser to circumvent the Great Firewall of Turkmenistan

Since 2021, the authorities in Turkmenistan have taken exceptional measures to crack down on the use of circumvention tools. Citizens have been forced to swear on the Koran that they will not use a VPN. Circumvention tool websites have been systematically blocked. Arbitrary searches of mobile devices have also taken place and have even targeted school children and teachers.

The government has also blocked servers hosting VPNs which led to “near complete” internet shutdowns on several occasions in 2022. Current reports indicate that 66 hosting providers, 19 social networks and messaging platforms, and 10 leading content delivery networks (CDNs), are blocked in the country. The government presumably is unconcerned about the negative economic impact that such shutdowns can cause.

星期一, 8月 03, 2020

GreatFire 应用生成器 发布

GreatFire (https://en.greatfire.org/) 是一家专注于中国的审查监督组织,我们自豪地宣布一个新的反审查工具,该工具将使任何被屏蔽的媒体、博客、人权组织或民间社会组织反制审查,将其内容得以传播到中国和其他互联网审查国家的数百万读者和支持者的手机上。

GreatFire 已经构建了一个名为“GreatFire 应用生成器”的网页程序,任何组织可以使用它来为中国和其他国家的用户解锁他们的内容。任何人可以访问 (https://appmaker.greatfire.org/),该网站将编译一个带有自己logo的应用,并将包含他们以前被封锁的内容。该应用还将包含一个特殊的、绕过审查的网络浏览器,以便用户可以访问未经审查的网络。这些应用将使用包括机器学习在内的多种策略来规避中国当局先进的审查策略。这个项目在其他有类似中国的审查限制的国家也同样有效。对于组织和最终用户而言,这些应用将免费、快速且非常易于使用。

这个项目的灵感来自于GreatFire自己的应用 自由浏览(https://freebrowser.org/en)的第一手经验,并希望帮助那些可能没有内部专业知识来规避中国审查制度的小型非政府组织。GreatFire的反审查工具在中国发挥了作用,而其他工具却没有。自由浏览可以引导中国的互联网用户从应用的首页进入被僧所内容的导航(http://manyvoices.news/)。


人权基金会 (HRF) 已经使用 GreatFire 应用生成器 创建了一个应用程序HRF 在全球范围内促进和保护人权。该组织的使命是确保自由在世界范围内得到维护和促进。 HRF 的网站 在中国被封锁, 但现在中国任何人都可以 下载 HRF Android 应用程序 并访问该网站的信息。

“现在是中国政府防火墙倒塌的时候了,”人权基金会战略顾问王珍妮说。 “与我们在 GreatFire 的朋友一起,我们致力于击败中国的审查制度——在每一部手机。”

GreatFire 应用生成器 的起源可以追溯到 2014 年,当时开放技术基金 (OTF) 支持 GreatFire 的“依附的自由”实验。该项目直接导致了 2015 年中国政府的大规模网络攻击,后来被称为“大炮”。 OTF 还为 GreatFire 开发 AppleCensorship.com,该网站正在跟踪苹果对包括香港在内的全球应用商店的审查情况。

自由浏览 是“大炮”攻击的直接结果,五年后,我们很高兴能够向任何可能遭受中国当局审查的组织提供我们的方法。 

星期五, 7月 24, 2020

Apple, anticompetition, and censorship

On July 20, 2020, GreatFire wrote to all 13 members of the Subcommittee on Antitrust, Commercial and Administrative Law of the U.S. House Committee on the Judiciary, requesting a thorough examination into Apple’s practice of censorship of its App Store, and an investigation into how the company collaborates with the Chinese authorities to maintain its unique position as one of the few foreign tech companies operating profitably in the Chinese digital market.  

This letter was sent a week before Apple CEO TIm Cook will be called for questioning in front of the Subcommittee on Antitrust, Commercial and Administrative Law. The CEOs of Amazon, Google and Facebook will also be questioned on July 27, as part of the Committee’s ongoing investigation into competition in the digital marketplace.

This hearing offers an opportunity to detail to the Subcommittee how Apple uses its closed operating ecosystem to not only abuse its market position but also to deprive certain users, most notably those in China, of their right to download and use apps related to privacy, secure communication, and censorship circumvention.

We hope that U.S. House representatives agree with our view that Apple should not be allowed to do elsewhere what would be considered as unacceptable in the U.S. Chinese citizens are not second class citizens. Private companies such as Apple compromise themselves and their self-proclaimed values of freedom and privacy when they collaborate with the Chinese government and its censors.

星期一, 6月 10, 2019


苹果在涉及西藏的审查方面有着悠久历史。 2009年,据计算机世界网透露 ,与达赖喇嘛有关的几个应用程序在苹果的中国区应用商店中不存在。这些应用的开发者未收到他们的应用被删除的通知。当面对这些审查制度时,苹果发言人只是说该公司将“继续遵守当地法律”。

2017年12月,在中国的一次会议上,当被问及与中国当局合作审查苹果应用商店时,蒂姆·库克 宣称



根据生成的数据 https://applecensorship.com,Apple现在已经审查了在中国应用商店中29个西藏的热门应用程序。关于新闻,宗教研究,旅游甚至游戏的西藏主题应用程序正在被苹果审查。最下方附有完整的审查应用列表。

“苹果的领导力隐藏在他们审查应用程序以遵守模糊的'中国当地法律'的借口,但他们的行为缺乏任何透明度。通过从中国苹果应用商店删除藏文和其他许多应用程序,苹果阻碍了藏人获取信息和自由表达自己的能力,这是国际法下的一项基本人权。“ TibCERT(西藏计算机应急准备小组)的响应协调员Dorjee Phuntsok说道。 他们与GreatFire合作对被屏蔽的应用程序进行了分析。

   2019年1月,GreatFire推出了applecensorship.com。在那时,GreatFire联合创始人马丁约翰逊指出:“苹果公司在其透明度报告中没有分享有关应用商店审查的信息 - 该项目强制透明度。蒂姆库克可以随心所欲地说苹果在中国做了或没有做什么,但 applecensorship.com 提供了可以实际看到苹果实施审查原始数据的途径。




星期四, 6月 06, 2019


最新的 数字版权企业责任指数排名 就公司和政府需要做些什么来提出建议,以改善全球互联网用户的人权保护。数字版权排名(RDR)旨在通过为公司尊重和保护用户权利制定全球标准和激励措施,以促进互联网上的言论自由和隐私权。

在他们的2019年责任指数中,RDR着眼于24家世界上最重要的互联网公司在言论自由和隐私方面的政策,并强调了那些尚需努力和已经取得改进的公司。 RDR指出:


特别是,该报告强调了苹果如何滥用其网络言论的权力,并在中国指出这一点。根据该报告,苹果公司在面对政府当局提出的要求时,并未披露其从App Store中删除内容的数据。



RDR 建议政府要求公司的透明度并保持透明度。中国当局采取相反的做法 - 他们不希望在这些问题上保持透明度,因为它突显了他们不希望公众了解的信息。当局不希望公司透明,他们可能直接指示Apple不发布他们正删除的内容列表。

苹果可能真的认为他们必须遵守中国的法律条文。或者他们也可能愿意分享有关App Store中被审查内容的信息,但有碍于被中国当局束手束脚。苹果还可能会利用这种情况作为他们打击中国言论自由的掩护。无论Apple的真实动机如何,透明度都能够并已经被强加给他们。

在2019年1月,GreatFire发布了 applecensorship.com。该项目监控Apple在公司运营的每个市场中对App Store的审查。应用程序的可用性测试由网站访问者进行。截至今天,用户生成的测试已经确定了 超过1100个 在中国应用商店中不可用的应用。在中国受审查的应用程序包括那些涉及宗教,新闻,隐私和翻墙的应用程序。通过审查有助于规避审查限制的应用程序,苹果确实的让中国人无法自由访问信息。苹果的中国用户或许认为他们买到的是一流的设备 - 但可以肯定的是,该公司将他们视为二等信息公民。

RDR建议苹果对言论自由的限制保持透明,并公布有关公司因政府要求而删除内容所采取行动的数据。我们邀苹果审核我们在 applecensorship.com 上公开发布的数据,并根据中国当局的指示突出显示已删除应用的情况。

使用 RSS 订阅我们的博客。


Filtered HTML

  • 自动将网址与电子邮件地址转变为链接。
  • 允许的HTML标签:<a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • 自动断行和分段。

Plain text

  • 不允许HTML标记。
  • 自动将网址与电子邮件地址转变为链接。
  • 自动断行和分段。
By submitting this form, you accept the Mollom privacy policy.