Buyers will be asked for certificates – Newspaper Kommersant No. 233 (7434) dated 12/15/2022
[ad_1]
Sberbank intends to transfer the service used to pay for services and goods in online stores to Russian encryption certificates. The message that buyers will soon need to independently install a domestic browser or root certificates of the Ministry of Digital Development appears when buying in the online stores of Svyaznoy, Detsky Mir and other retailers. The certificate issued to Sberbank for its Internet acquiring will expire on February 15. Experts believe that stores may respond to the bank’s problems by changing the acquirer or moving payments through the SBP.
“Kommersant” found on the Sberbank page used to enter bank card data a warning that “certificates from the Ministry of Digital Development will soon be required for stable operation.” This page is displayed when paying for an order in online stores and services that use online acquiring from a bank. Kommersant discovered them on the websites of Detsky Mir, Leroy Merlin, Svyaznoy, Online Trade.ru and Delimobil. For those who intend to pay for purchases in these stores, Sberbank offers either to download Russian browsers (Yandex Browser or Atom from VK), which already have the necessary certificates built in, or install them on your phone or PC from the Gosuslug server.
We are talking about root certificates, which, together with site-side certificates, allow you to establish a secure connection (HTTPS). The Sberbank page does not indicate when it is planned to transfer online acquiring to Russian certificates. The current certificate from the Belgian CA GlobalSign expires on February 15th. Sberbank told Kommersant that “translation work is already underway,” but did not specify when it would be completed. Svyaznoy declined to comment on Kommersant. The other companies mentioned and the Ministry of Digital Development did not respond to inquiries.
After the outbreak of hostilities by the Russian Federation in Ukraine, foreign certification centers stopped cooperating with domestic entities subject to sanctions, including Sberbank. In March, certificates for a secure connection began to be issued by the National Certification Authority (NCC) of the Ministry of Digital Development. But for such a connection to work, you also need a root certificate installed in the operating system or browser. Products from Microsoft, Google, and Apple ship with root certificates from various CAs, but not the NCA. Sberbank’s instructions – to independently install either certificates or browsers containing them – are similar to those given by the Ministry of Digital Development.
According to the Nilson Report, Sberbank processed 3 billion Internet transactions worth $40 billion in 2021. VTB, second in this indicator (more than 830 million transactions worth $13.5 billion), also fell under sanctions and recommends that customers install Russian browsers on their website or NCA root certificates. At the same time, in March, VTB withdrew from the capital of T1 Group, which has owned the processing company Multikarta since October 2021. Kommersant did not find a recommendation to install Russian certificates on the online payment pages generated by Multicard. On November 22, a new certificate from GlobalSign was issued to this address. The third bank in terms of the number of processed Internet transactions is Tinkoff Bank (367 million transactions, $12 billion).
Users “are wary of unusual security procedures” and the need to install certificates may scare away some of them, said Viktor Dostov, head of the Association of Electronic Money Market Participants and Money Transfers. Stores, he said, could switch to another acquiring service or encourage the use of a fast payment system (FPS): “The latter option is promising, but it often lacks the bonus services offered for card payments.” The cost of changing an acquirer depends on how closely the online store works with the bank, said Roman Prokhorov, head of the board of the Financial Innovations Association: the bank will not be easy.” He considers the promotion of payment through the SBP to be more effective, but “it would be nice to stimulate customers who receive cashback when paying with cards, but as a rule, nothing through the SBP.”
[ad_2]
Source link
