Russian Ministry Certificates Enable Potential State MITM on Foreign Domains
Russian organizations under sanctions have begun switching to certificates issued under the Ministry of Digital Development and Communications root after commercial authorities revoked or declined to renew their existing certificates. Users who visit affected sites now encounter browser warnings that the authenticity of the resource cannot be verified.
The article explains that the only practical workarounds are to install the Ministry root certificates system-wide, switch to Yandex Browser which already bundles them, or maintain two separate browsers. Each option carries significant risks: loss of access to services, full system trust in a state-controlled CA, or reduced usability.
Threat Model
The author constructs a detailed threat model focused on a third party operating inside Russian jurisdiction. This actor can legally compel any Russian company to hand over data and can also deploy TLS interception appliances between users and foreign services. Once the Ministry root is trusted, the same infrastructure can silently terminate and re-sign connections to non-Russian domains, capturing session tokens and credentials.
Because the Ministry root currently carries no name constraints, it can issue certificates for any domain. The article therefore recommends re-signing the root with nameConstraints that permit only the national TLDs .ru, .su, and .рф.
Technical Implementation with OpenSSL
All steps are performed using OpenSSL on macOS and Linux. Users first download the Ministry certificate bundle from gosuslugi.ru, extract the non-GOST files, and create a new local root with appropriate basicConstraints, keyUsage, and nameConstraints extensions.
- Generate a fresh 4096-bit local root limited to national domains.
- Create a temporary CSR and extract the public key from the original Ministry root.
- Cross-sign the Ministry root using the local root and a cross_ca_ext configuration that preserves CA capabilities while inheriting the name constraints.
The resulting new_root_ca.crt can then be installed in the system trust store. Verification commands confirm that sites under .ru domains continue to validate while foreign domains such as sberbank.com are rejected when only the constrained root is present.
The author stresses that users must perform these steps themselves; any party holding the private key of a trusted root can still perform interception within the certificate’s permitted scope.
Related articles
Apple to Scan iCloud Photos and Files Shared via Public Links Starting with iOS 27.3
Apple announced that it will begin scanning content stored in iCloud when users share files or photos through public links. The feature activates with the release of iOS 27.3, iPadOS 27.3, macOS 27.3, and visionOS 27.3. Any file made accessible to anyone with the link will now be checked by Apple for malicious materials. This change effectively means that sharing via public links grants Apple visibility into the shared content for security purposes. The move aims to detect harmful files before they reach other users through shared links.
WhatsApp for Android Tests Long-Press Chat Preview to Avoid Read Receipts
WhatsApp is developing a feature for Android users that lets them preview and scroll through messages in a floating card without triggering blue read receipts. The capability was discovered by Android Authority researchers in beta version 2.26.44.12, where holding a chat opens a preview window containing the latest messages. Scrolling and reading inside this card does not send read notifications to the other party. The same long-press action also reveals an updated action menu with options to pin, archive, mute, mark unread, or delete the chat. On iOS, a similar preview exists but does not allow scrolling through messages. The feature remains in active development and is not yet available even to regular beta testers.
AI as a Control System: How States, Intelligence Agencies and Scammers Manipulate Consciousness Through Data and Personalization
Specialized AI models now reach exceptional accuracy in narrow domains and are deployed across marketing, banking, law enforcement, modeling and research. These systems do more than recommend products; they can predict a user’s intention to switch providers weeks in advance, build detailed psychological profiles, and select the optimal key to influence behavior through preferred services and content. Corporations collect telemetry including clicks, input-device movements, retinal reactions, spoken words and typing patterns, creating unique behavioral signatures comparable to fingerprints. By combining data from insurance records, credit bureaus, medical files, diaries, maps and gaming platforms, companies construct individual portraits that allow them to infer sensitive attributes even when direct records are missing. The article explains how aggregated data improves model generalization while individualized data enables ever more precise targeting, turning information itself into a product that can implant fears, desires and even compel people to defend foreign interests at personal cost. It warns that repeated exposure to surveillance warnings leads to desensitization, making it essential to re-examine the power these datasets confer.
Personal AI Assistants Build Detailed Profiles on Friends and Family Raising Privacy Concerns
New generation AI agents such as Muse from Meta and Dots from OpenAI are gaining extensive access to user data including emails, messengers, and financial accounts. These agents operate with broad permissions to perform actions on behalf of users while automatically collecting personal information. Security researchers discovered that Muse creates detailed profiles on every person in a user's life including family members, partners, friends, and colleagues. The profiles include sections on facts, history, relationships, and strategies for strengthening connections using real evidence only. Data collection occurs through hourly background processes and nightly dream-like analysis that stores information in Markdown files and PostgreSQL databases. The architecture includes isolated VMs designed by Moxie Marlinspike to prevent swarm formation among agents but does not address third-party data exposure. This development expands existing social graphs maintained by major technology companies through previous generations of web services.