Protect: Protection from untrusted certificates
The integrated Protect security system in Yandex Browser for Mobile checks website certificates. The browser will warn you if the website cannot provide secure encryption of your data due to problems with the certificate.
Why websites need a certificate
Your personal data and payment information should be protected when you send them to a website. Websites use the HTTPS protocol for secure connection. The protocol activates an asymmetric encryption algorithm, where data is encrypted with a public key and decrypted with a private key. For each session, the browser regenerates the private key and transmits it to the website in addition to taking precautionary measures to prevent theft.
However, if you end up on a phishing website, it might get the private key and then decrypt your data. To protect against phishing, websites use digital certificates issued by special certification authorities. The certificate guarantees that the encryption keys actually belong to the website owner.
What makes an untrusted certificate dangerous
You may end up on a phishing website, or your data will not get the necessary protection on the original website (for example, if the website's certificate has expired). As a result, hackers can:
Block websites with untrusted certificates
If a website can't guarantee safe encryption due to certificate issues, the page won't open and you see (in the SmartBox) or (in the Protect toolbar opened under ) and a warning that a secure connection couldn't be established. In this case you can decide to either not visit the site, or to add the certificate to your list of trusted ones.
Tap. The certificate will stay on the trusted list for 30 days, and then you will have to make an exception again.
Reasons for blocking
Yandex Browser blocks websites that have the following certificate problems:
- Your data may become available to unknown application developers.
- The certificate may be installed by malware pretending to be the application. Browsers do not have the ability to verify the authenticity of certificates installed by special applications.
The certificate might have been installed by a hacker or special software. Ad blockers and similar applications may replace website certificates with their own certificates. If the certificate was installed by an application, you need to find it and disable checking HTTPS in it.
You can also decide to trust your data to such a certificate, but be aware of two potential dangers:
The site certificate is issued by the site itself, rather than by a certification authority. To learn more, see Self-signed certificate. Malware or hackers can intercept your data.
The certificate key does not match the pinned website key. Hackers may try to replace the root certificate. Then they can intercept your data. To learn more about pinning (linking) a key, see HTTP Public Key Pinning.