Korea Has Until December to Uninstall Twenty Years of Its Own Banking Software

Open KB국민은행's internet banking install page today and it will offer you two programs to download: WIZVERA Delfino and AhnLab Safe Transaction. The second one starts with your computer and stays running. Its listed functions include keyboard encryption, a firewall, anti-phishing, and something the page calls 단말환경 수집 — collecting information about your device.

The page describes what it is doing as 공인인증.

That word was abolished on 10 December 2020. It has not been a legal category in South Korea for five and a half years. The page still uses it, because the page is a fossil of a system that has outlived several of its own funerals.

That system now has a deadline. On 22 October 2025, in a cross-ministry security plan, Deputy Prime Minister Bae Kyung-hoon said the government would "단계적으로 제한" — phase out — the security software that financial and public institutions force on consumers, replacing it with multi-factor authentication and AI-based detection. On 29 March 2026, banks were told to submit replacement plans in April and complete the conversion by the end of the year.

So: what was all of this, why did it last twenty-five years, and why is almost every English-language account of it stuck in 2015?

The Thing Everyone Gets Wrong First

Start with the vocabulary, because the English coverage collapses two different events into one.

The 공인인증서 — the "accredited certificate" — was not abolished in 2020. What was abolished was the word 공인.

Korean commentary is blunt about this. As Namu Wiki's entry puts it, this was "공인인증서 폐지가 아니라 '인증서 공인제 폐지'에 가깝다" — not the abolition of the accredited certificate, but the abolition of accreditation itself. The certificate was renamed 공동인증서 ("joint certificate"), kept its one-year validity, and still lives in the same NPKI folder on the same disk. What it lost was its state-granted status and its automatic legal superiority over every other method.

The second thing English coverage gets wrong is subtler and more damaging: it is not wrong, it is frozen. English Wikipedia's article on SEED — the cipher at the centre of this story — ends its account of Korea by noting that the ministry announced a plan to remove ActiveX from at least 90% of the country's top 100 websites by 2017. And stops. The reader is left standing in 2015 holding a press release, with no idea whether it worked.

It half worked. That is the actual story, and nobody has written it in English.

Every Chapter Is Korea Going Around the Browser

Here is the spine, and it is not the one usually offered.

The standard explanation is a cryptography story: America restricted strong encryption, Korea built its own cipher, browsers didn't support it, so Korea needed a plugin. We'll take that apart in a moment, because it collapses under dates.

The real through-line is architectural. At every stage, for twenty-five years, Korea chose to work around the web browser rather than through it.

The certificate itself was standard. Korean sources are explicit that the file format followed international standards — it was ordinary X.509. What was not standard was where the file lived:

"파일 양식 자체는 국제표준을 따르고 있지만, 그 파일들이 보관, 저장되는 위치와 방법이 독특해 웹브라우저로는 사용이 불가능했다."

The format followed the standard; the storage location and method were idiosyncratic, so a browser couldn't use them. Browsers had certificate stores. They had client-certificate authentication. Korea put its certificates in a folder on the disk instead, and then needed a program to reach into that folder and sign things.

That is the whole mechanism. ActiveX was not required by the cipher. It was required by the filing system — and once you had a program running outside the browser anyway, you could bolt other things onto it: keyboard encryption, a firewall, an anti-virus module, device fingerprinting. None of which has anything to do with signing a transaction.

When ActiveX died, the pattern survived it. The government's own 2017 policy document — the 국정기획자문위원회's national agenda of 6 July 2017 — committed to removing ActiveX between 2018 and 2020, and in the same sentence wrote the escape hatch: "불가피한 경우에는 대체기술(EXE)을 적용". Where unavoidable, use .exe instead. The loophole was in the plan on day one.

And the joint ministry review of 29 December 2019 shows exactly what that produced. Across Korea's top 500 private-sector sites, plugins fell from 2,266 to 408 — a real achievement. But 77 sites removed ActiveX and installed an .exe in its place. They had not stopped going around the browser. They had changed the file extension.

A 2025 paper from KAIST, Korea University and Sungkyunkwan University, presented at USENIX Security, describes today's software in the same terms: it works by "웹 브라우저의 보안 구조를 우회하는 방식" — bypassing the browser's security architecture.

Twenty-five years, four technologies, one idea.

The Origin Story Does Not Survive Its Own Timeline

Now the cryptography account, which is the part of this story English readers have actually heard.

It runs: US export controls capped exported browsers at 40-bit encryption → Korea couldn't get strong crypto → KISA developed the domestic SEED cipher in 1999 → no browser supported SEED → the only way to run it in a browser was a downloadable binary → ActiveX.

Three problems.

The export window had already closed for banks. On 22 September 1998 — five months before KISA dates SEED's development to February 1999 — the US permitted non-recoverable encryption of any key length for banks and financial institutions. It extended that to online merchants and insurers on 31 December 1998. Earlier still, from around 1997, Server-Gated Cryptography let an unmodified 40-bit export browser negotiate up to 128-bit specifically with a financial institution. The exact problem SEED is said to have solved already had a standards-based fix aimed at exactly the sector that needed it. General relaxation followed on 14 January 2000.

The constraint was real in 1997–99. It was dead by early 2000. Korea kept the plugins for twenty more years.

KISA does not actually make the export-control claim. This one surprised us. The assertion that SEED was built because exported browsers were capped at 40 bits appears on Korean Wikipedia, which cites KISA's own SEED page as its source. KISA's page does not say it. KISA gives a self-reliance rationale — a cipher developed with "순수 국내기술". RFC 4269 and RFC 4162, both written by KISA staff, give no export-control rationale either. We could not locate a contemporaneous 1998–99 Korean government document stating the motive. The most-repeated fact about SEED's origin is, as far as we can establish, an uncited wiki claim.

And the "no browser supported it" premise was resolved — and Korea didn't move. This is the link that breaks the chain completely.

• August 2005: RFC 4162, "Addition of SEED Cipher Suites to TLS," authored by KISA's own staff. The standards-track path existed from 2005.
• February 2009: Mozilla's NSS ships SEED. October 2009: Firefox 3.5.4 ships SEED TLS cipher suites — from patches submitted by KISA engineers using @kisa.or.kr addresses.
• February 2014: Mozilla removes SEED from Firefox 27's defaults, on the stated grounds that supporting it had had no practical effect in helping Korea move off ActiveX.

KISA wrote the RFC, wrote the browser patches, got them shipped — and Korea stayed where it was. Five years later the browser vendor gave up.

There is one genuine caveat, and it explains why the premise felt true. Microsoft's Schannel — the TLS stack behind Internet Explorer — never shipped a SEED cipher suite. So on IE specifically, the objection held forever. It held because Korea had standardised on the single browser whose vendor never implemented KISA's own standard.

The Mandate Was Never in the Law You've Heard Of

If you have read about this before, you have read that the 전자서명법, the Digital Signature Act of 1999, required Koreans to use the accredited certificate.

It did not. We pulled the statute text.

전자서명법 gave the certificate privilege, not monopoly. Article 3 said an accredited digital signature satisfied a statutory signature requirement and carried a presumption of authenticity. A 2001 amendment (법률 제6585호, effective 1 April 2002) defined 공인인증서 and 공인전자서명 for the first time and added Article 18-2, permitting identity verification by accredited certificate.

Privilege and permission. Nothing compelled anybody.

The mandate lived somewhere much less famous: 전자금융감독규정, the Regulation on Supervision of Electronic Financial Transactions — a notice issued by the Financial Services Commission. Article 37, in force until 17 March 2015:

제37조(공인인증서 사용기준) ① 모든 전자금융거래에 있어 「전자서명법」에 의한 공인인증서 또는 이와 동등한 수준의 안전성이 인정되는 인증방법… 을 사용하여야 한다.

In all electronic financial transactions… must be used. That is the sentence that built the Korean internet everyone complains about.

And a second clause put the software on your machine. Article 34(2)3, in force until 2 February 2015:

3. 해킹 등 침해행위로부터 전자금융거래를 보호하기 위해 이용자의 전자적 장치에 보안프로그램 설치 등 보안대책을 적용할 것

Apply security measures including installing security programs on the user's electronic device. Not a law passed by the National Assembly. A financial-supervision notice.

Which Means the Famous Date Is the Wrong One

Everyone writes about December 2020. In banking terms, the decisive year was 2015.

Date	What actually changed
3 Feb 2015	고시 제2015-3호 — the obligation to install security programs on the user's PC (제34조②3호) is deleted
18 Mar 2015	고시 제2015-7호 — 제37조 「공인인증서 사용기준」 becomes 「인증방법 사용기준」. The mandate goes technology-neutral. This is the operative de-mandating.
16 Apr 2015	법률 제12837호 takes effect — "공인인증서" deleted from 전자금융거래법 제21조, replaced by a clause forbidding the regulator from compelling any specific technology
10 Dec 2020	전자서명법 전부개정 (법률 제17354호) — the accreditation system is abolished; certificates become 공동인증서; 금융인증서 launches the same day

The certificate's operational monopoly died in 2015. Its legal privilege died in 2020. Both are real events; treating them as one is the error.

The Reform Was Triggered by Something That Wasn't True

The 2014–15 push has a well-known origin: the 천송이 코트 episode, in which the President raised the case of Chinese fans of a hit drama who supposedly could not buy the lead actress's coat from a Korean site because of the certificate requirement.

Korean coverage notes that experts later established the premise was wrong — "나중에 거짓이란 전문가들의 지적이 있긴 했지만". The specific obstacle described did not work the way it was described.

The reform proceeded anyway, and was largely correct. A false anecdote from a head of state produced a real and defensible deregulation. We are not sure that is a lesson so much as a fact, but it is a fact worth keeping.

How Many Programs, Really

The peak figures are less lurid than internet legend suggests, and better sourced.

A 2014 MBC report put it at five programs to begin internet banking, attributing the requirement to financial regulation. In September 2016 a reporter installed the full stacks of four major banks and counted: KB 5, 우리 4, 신한 5, 하나 6 — twenty programs, eighteen unique. The same piece reports that the financial regulator ordered banks to halve the count and the banks refused, arguing that the certificate, keyboard security, personal firewall and PC information collection were already the minimum.

For scale: an April 2012 government survey found 84% of Korea's top 200 websites (168 of 200) used ActiveX, with payment and authentication the single largest private-sector use case at 41.1%. By July 2012, KISA put the financial sector at 93%.

If you see a claim of ten or more programs per bank in the 2000s, we could not substantiate it.

Where It Actually Landed

Public services genuinely fixed it. 정부24, 홈택스, 국민연금 and 건강보험 are plugin-free and accept 간편인증. The January 2021 tally recorded public-sector sites at 99.9% improved.

The private sector got to 89.7% of the top 500, with 97 sites still requiring plugins.

And the replacements are real and enormous. 카카오 인증서: 40 million users (April 2024). PASS: 38 million subscribers (December 2025). 금융인증서: 43 million issued (December 2024). 토스인증서: 26 million (end-2024). KB국민인증서: 15 million (July 2024). The market has consolidated to the point that 페이코's certificate shut down on 17 July 2025.

Opening a bank account today needs no plugin at all. The regulator's non-face-to-face identity guidelines require two of four methods; in practice that means a phone verification, a photograph of your ID, and a 1원 이체 — a one-won transfer to an account in your name at another bank. The friction moved from software to documents.

Simple payments now run at a scale that makes the old system look like a rounding error: the Bank of Korea reported 2025 daily averages of 35.57 million transactions worth ₩1.105 trillion, the first year above a trillion won a day.

But if you bank on a desktop, the programs are still there. And if you use a Mac, you get a degraded version of a system that was never designed for you: KB's own documentation states that on macOS and Linux only the personal firewall and device-information collection function, that keyboard security is unsupported, and that it is replaced by an on-screen mouse-driven input pad. In January 2026 광주은행 told a Mac-using business customer that banking was simply not possible on macOS, with no committed fix date.

It Did Not Work on Its Own Terms

This is the part that decides whether the system was a reasonable trade or a mistake, and the evidence is not kind.

The software was there to stop malware and keyloggers. Korea's actual losses are social engineering, and they are accelerating: voice-phishing losses of ₩145.1 billion in 2022, ₩196.5 billion in 2023, and ₩311.6 billion in the first quarter of 2025 alone, across 5,878 cases — an average of about ₩53 million per case. Keyboard encryption does not touch any of that.

Worse, the dominant modern attack is a victim installing a malicious app because an authority-sounding voice told them to — which is precisely the reflex that twenty years of "install these programs to bank safely" trained into an entire population.

And the mandated software became the attack surface itself:

• 16 November 2020: ESET documents a Lazarus supply-chain attack conducted through WIZVERA VeraPort — one of the programs Koreans were required to install.
• 2023: Korea's intelligence service and KISA report North Korean exploitation of INISAFE CrossWeb EX (60+ institutions, 210+ PCs) and MagicLine4NX (50+ institutions). In November 2023 this produced the first joint advisory between Korea's NIS and the UK's NCSC.
• 2025: the USENIX Security paper finds 19 serious vulnerabilities across 7 programs, measures 48 real user PCs carrying an average of 9 of them, and surveys 400 users: 97.4% had installed them, and 59.3% did not know what they do.

A security architecture that required every citizen to install unauditable software, that did not address the threat actually emptying their accounts, and that a hostile state used three times as a delivery route, is not a close call.

That, in the end, is what the October 2025 order is responding to. Not tidiness. Evidence.

---

Korea's habit of building its own layer of the internet rather than adopting someone else's is not confined to this story — we've traced the same instinct through Naver's walled garden and the sovereign-AI push, and its consumer end-point in KakaoTalk, whose certificate is now the most-used in the country. What makes the plugin era different is that it has an end date, and the date is this December.

Whether the programs are actually gone by then is a different question. They have been declared dead in 2015, in 2017, in 2019 and in 2020. The banks have until year-end. As of this month, KB국민은행's install page still says 공인인증.

Photographs: 신한은행 원주시청출장소 by Choi Kwang-mo, CC0; 신한은행 head office by Mobius6, CC BY-SA 4.0, re-shared here under the same licence; KB국민은행 산본사거리 by LandAndTree, CC0 — all via Wikimedia Commons, cropped by us. Crops were checked at full resolution and exclude legible telephone numbers and identifiable individuals.

Verified from primary sources: 전자서명법 (법률 제5792호, 제6585호, 제17354호), 전자금융거래법 (법률 제7929호, 제12837호) and 전자금융감독규정 (고시 제2015-3호, 제2015-7호, 제2025-4호) via 국가법령정보센터; US export rules via the Federal Register (63 FR 50516, 63 FR 72156, 65 FR 2492); RFCs 4162 and 4269; Mozilla's own bug records; the banks' live public install pages; and the 2025 USENIX Security paper. The Deputy Prime Minister's wording is quoted from the government's own briefing transcript rather than from news coverage. We have deliberately omitted: any claim that English sources describe ActiveX in the present tense (we could not substantiate it — the documented failure is that the English record stops in 2015); a 2014 amendment on card payments that we found in only one source; and a widely circulated claim about a Korean Supreme Court ruling on US export controls, which is false. No figure for peak program counts above the sourced 2016 tally of twenty across four banks has been used.