12 ms·
Securing a laptop for travel to China
- RijilV 9y agoFeels like given the recent issues people have been facing with US Customs, this advise is relevant there too.
- darkpoints 9y agoYeah I'm recognising a lot of similarities here.
- rll 9y agoI know it is anecdotal, but I have never seen even the slightest hint of anyone having their devices closely looked at entering China. At least not in the 72/144 hour visa-free line that I have been using for the past couple of years. This visa-free entry is aimed at business travelers so perhaps there is less scrutiny there.
- Bakary 9y agoI've had the same experience as well. Ironically, the only place where I've ever been scrutinized or directly searched is the US. Short of being some sort of China-focused activist, you'd have to try real hard to get Chinese law enforcement to care about what you're doing.
- raggi 9y agoStarts out by pointing out that exporting encryption software is illegal, and then recommends that you export encryption software in unencrypted form.
- pzh 9y agoIs it really considered exporting if they already have it?
- CaliforniaKarl 9y agoIt could be, yes. Similar to how, just because something is classified has been published, individuals who "needed to know" still can't talk about it until it's been declassified.
- TomMarius 9y agoI don't think that's similar at all. When you tell someone something secret, it's still a secret, until you tell them it's no longer a secret. When you start exporting something for the general public, it's generally known.
- jldugger 9y agoI missed that bit. I see where he mentions the missing PUE, but that's not the same as outlawing the export of encryption.
- leemailll 9y agoWhy the author worry so much about China customs? I never had a problem go through China customs with regards to my laptops. And never seen nor read that someone having trouble about it.
- toomanybeersies 9y agoMost people going through the USA have no issue with US Customs, but there are people that do.
- brian_herman 9y agoWe should create a service where people can trade laptops when they go to conferences.
- a3_nm 9y agoNo, we should stop organizing conferences in countries where it is not legal to bring encrypted devices for personal use (like China, according to the beginning of the article), or countries where there have been known cases of pressuring travelers to decrypt their devices or of confiscating the devices (like the US). How is it reasonable or courteous to require your conference attendees to read a long guide, buy a throwaway laptop, set it up, etc., or run the risk of being requested to decrypt sensitive information at the border or have their devices seized? Just because the US and China get away with this does not mean that all countries do. Just pick any state in this list http://www.wassenaar.org/participating-states/ http://www.wassenaar.org/participating-states/ that doesn't have a history of requesting decryption or taking traveler's property without good cause.
- phkamp 9y agoAll this advise applies equally to USA (in particular if you are brown), England and certainly Russia.
- briandear 9y ago“In particular if you are brown..” [citation needed] – as in actual data and statistics on the alleged difficulties of brown people at the US border. Tens of millions of “brown” people enter the US each year without incident.
- eps 9y agoIt doesn't apply to Russia actually in the slightest. The only issue with Russian border crossings are the line-ups due to general mess and inefficiency. Nobody checks anything, leave alone rummaging through your belongings or asking to see the contents of your devices.
- marco_salvatori 9y agoThe police state that is China doesnt care about summit attendees, it cares about social harmony. Summit attendees should have a passport and a visa if needed. Otherwise they should act in a harmonius manner. If they can do that, then they will be disappointed to find out that the officials simply dont care about them. No one is going to ask friendly, personal questions in customs; no one is going to ask for an inventory of what is being carried in; no one is going to ask how much money you have with you; no one is interested in seeing and opening your electonics; no one is going to pay the least attention to your baggage. Relax, have a good time, and prep a vpn if you are set on working. Then, on the way back, contrast the experience to the police state that you are from.
- org3432 9y agoThis was my experience as well, my USA cell phone wasn't even blocked from accessing websites that were normally blocked in China, they make an exception. There could be some cases where you could run into issues, but the paranoia is greatly exaggerated, and being a "socially responsible" techie is not acting like a conspiracy theorist wing nut.
- dis-sys 9y agovpn that can unblock all those web site can be purchased for $15/year. ironically, you don't get comparable Internet speed or cost (my 200mbps Internet costs me $180/year, or I can upgrade it to 500mbps for $400/year) in most "free" countries. I'd be protesting really hard if I have to pay some unfair cost, say $50/month or more, to suffer from the so called uncensored broadband running at tortoise speed such as 50mbps or less.
- dis-sys 9y agoWhat a huge load of cold war thinking. Look at the crap below found in the article: "Then, depending on your level of paranoia, give the ChromeBook away to what is likely to be a very thankful kid/student" 133 million foreigners went through Chinese custom and entered China in 2016 - that is a lot of paranoid laptops to give away.
- gaius 9y agoThe phrase "coal to Newcastle" springs to mind.
- swiley 9y ago>133 million foreigners went through Chinese custom and entered China in 2016 - that is a lot of paranoid laptops to give away. A lot of laptops that have the wrong keycaps and radio regulatory domain no less.
- e12e 9y agoHow many of those 133 million people signed the linux kernel, used by... billions?
- jldugger 9y agodis-sys, throughout this thread you seem a bit upset, and seem to be carrying luggage on HN in general, given your outsized participation in China-centric threads. I really don't think the post is as negative as you expect. The OP is also the author of LinuxFoundation's laptop security guidelines. LF has been targetted by a number of DDoS's intrustions and worms. At least one was successful, and it's not clear if it was a criminal org, or a state actor disguised as such. So their laptop configuration policy is designed to thwart all comers. Hard drive / swap encryption, SSH keys on GPG cards, secureboot, SELinux, encrypted backups, NoScript, HTTPSEverywhere, FireJail, etc. China's policy appears to be that you must provide them with data should they request it. Making this happen is pretty much in direct contravention of the same laptop configuration policies designed to thwart the NSA, Europeans, Russians, cybercriminals, etc. But lets look at it this way: LF knew the facts on the ground in China, and proceeded anyways. So their IT manager responsible for preventing another break-in publishes a guide for adhering to China's laws while keeping the LF safe. Throughout this thread I see people suggesting that they're never bothered by state apparatus, so nobody should worry. I don't know which of that sentiment's implications is more insulting: that kernel.org isn't worthy of state infiltration, or that China isn't competent enough to pull it off.
- chvid 9y agoSounds like the author the author is going to China for the first time. Seriously; going through the Chinese border is much nicer experience than those two declining and/or former empires: USA and UK. They do not care about what is on your laptop. The Chinese block Facebook and al to prevent Chinese en masse joining Facebook; they don't care that a few westerners check up on dogs or complain about missing toilet paper using some VPN/SSH-thingee.
- tluyben2 9y agoI was going to say this: US and UK are far worse. Heathrow is so bad that I rather take an Uber from or to another airport. I have been going to all three quite a lot the past 3 years.
- jldugger 9y agoThe author is the IT security person for the Linux Foundation, who's activities include distributing the Linux kernel via kernel.org. They represent a particularly juicy target for nation-state actors, and have been targeted with reasonably advanced attacks before. In 2015 the author published a checklist for laptop security, this is just an extension of that, teaching people (and LF employees) how to comply with their policies and China's. Are they likely to be hassled at the border? No. But if there's a way to make all parties happy, might as well document it.
- est 9y agoLMAO. Sounds like Redhat couldn't even dare setup a R&D center in China. Seriously if you frequent kernel mail lists you can see tons of Chinese participating in OOS.
- alecco 9y agoIf I were him I would go with a burner laptop and wouldn't take with me any digital credentials.
- mricon 9y agoThat's the TL;DR of the article. ;)
- paradite 9y agoRelax, whoever wrote this, you are not travelling to the US. As long as you are not bringing a world map with Taiwan as a separate color from China, you will be just fine.
- kiwioperator 9y agohmm.. Chinese gov't does not care about normal citizens/foreigners, let alone a speaker in a tech con. However, some of these advice are universally applicable when you are going to any foreign countries or even in your home country.
- nickrio 9y agoRelax, they don't usually care what's inside your laptop. If they ever checks it, it's usually because it looks so new so they want to make sure you're not smuggling.
- a3n 9y agoSibling comments here from people who've been there notwithstanding, if you're afraid your laptop has something "bad" on it when you return, how can you in good conscience give it to an unsuspecting donee? That's like wondering if your doggy bag has food poison, so you give it to your neighbor.
- MagnumOpus 9y agoBecause while he as a linux kernel developer is a juicy target for the 3PLA's spying/subversion efforts, the Chinese won't be interested in 99.9% of normal people's activities.
- panzer_wyrm 9y agoIs there a chance he is mistaking china with north korea? China is very welcoming place, passing trough the border is smooth experience. Unless you are an activist they don't care about anything.
- kutkloon7 9y agoOr you just encrypt sensitive files and stash it in a folder somewhere. The chance is practically zero they will find it.
- jloughry 9y agoJust a note: it's possible to identify encrypted information by its entropy signature. Forensic tools exist that can scan a filesystem (or a raw block device) and highlight likely locations of encrypted data.
- kutkloon7 9y agoOr you just encrypt sensitive files and stash it in a folder somewhere. The chance is practically zero they will find it.
- mtgx 9y agoOr the US.
- topmonk 9y agoThe article states to use a VPN, but China has now cracked down on them: https://www.theguardian.com/technology/2017/jan/23/china-vpn-cleanup-great-firewall-censorship https://www.theguardian.com/technology/2017/jan/23/china-vpn... Your best best (if you can survive on web only) is to ssh to a server outside the country using the "-D" option which creates a socks proxy, then use firefox to connect.. I tried with chrome but it kept trying to make direct DNS requests (which don't work) and I was unable to fix it. I was there June, 2016.
- yorwba 9y agoThe "crackdown" had precisely zero effect on vpn usage for anyone I know.
- topmonk 9y agoOdd, because when I tried using OpenVPN on my own server in Japan, it kept timing out. I thought it was due to this: https://www.vpnanswers.com/bypass-great-firewall-hide-openvpn-in-china-2015/ https://www.vpnanswers.com/bypass-great-firewall-hide-openvp...
- yorwba 9y agoYes, OpenVPN or really any of the standard VPN protocols are blocked. But this has been the case for a long time before the "new" regulation was introduced. My point was more that everyone was already using a VPN that wasn't blocked, and that didn't change. (I guess they bribe the government or have an agreement to monitor traffic, or else they are not big enough to care about.)
- rahimnathwani 9y agoI live in China, and have many friends who also live in China. ssh -D is not the best way to access things outside China. There are many other ways. The best current methods I know of are Shadowsocks (what I use), or ShadowsocksR, or Shadowsocks over obfsproxy. Although the Shadowsocks protocol presents as a socks proxy, there are clients for iOS (e.g. Potatso 2), Android and routers (e.g. those available at koolshare's web site) which make it transparent to use (and they deal with your DNS issue as well, by tunneling DNS through the proxy).
- fooker 9y agoSeems to have mistaken China for the US. Chinese immigration does not treat you as a potential criminal aiming to overstay your visa by default.
- qb45 9y ago> Chinese immigration does not treat you as a potential criminal aiming to overstay your visa by default. There are probably reasons for that, apparently an estimated 3% of the US population is illegal aliens. I wonder what the number is for China. https://en.wikipedia.org/wiki/Illegal_immigration_to_the_United_States https://en.wikipedia.org/wiki/Illegal_immigration_to_the_Uni...
- dis-sys 9y agoa typical day in Guangzhou: http://s1.sinaimg.cn/mw690/001qhtxNgy6O9rzBib6e0&690 http://s1.sinaimg.cn/mw690/001qhtxNgy6O9rzBib6e0&690
- fooker 9y agoThat's what happens when you annex part of a country. People keep moving across something which is not a natural border. Also, it's sad that you have to call human beings 'aliens'.
- toomuchtodo 9y ago"Non-citizens" works just as well I suppose.
- closeparen 9y ago"Non-citizens" includes lawful permanent residents and visa holders. The term generally preferred by those of us who balk at "illegal" and "alien" is "undocumented."
- qb45 9y ago
- deleted 9y ago[deleted]
- throw_12345 9y agoITT : a bunch of neo-red-guard idiots rushing to the defense a draconian surveillance state with every ham fisted argument under the sun, including "works for for me", "we get fast internet so it's K" and "the imperialist west blah blah" Some of you guys make me sick. there's no excuse for explicitly normalizing a police state - not even the existence of other police states.
- KayL 9y agoDoes the author unlock all data on his laptop in his hometown? If you're targeted, no matter where you are. I think that's no differences. You just will be another missing people.
- jwfxpr 9y ago"IT security is just like driving on the highway in the sense that anyone going slower than you is an idiot, and anyone going faster is clearly a maniac" Excellent metaphor!
- zoom6628 9y agoUseful notes even for those of us that live here - have been here total of 18 years and only cross border issue was bringing in a used(out of production) dot matrix printer for my own factory to use! I just paid the tax. I also use ExpressVPN and find it very good across pc gear, tablets and phones. Just this past week started using dnscrypt of my work laptop - npt because of company policy but because i know the govt snoops on that as well. After install and setting a couple of overseas DNS resolves all of my web pages load more quickly and getting to onedrive is a world more reliable. Others have also mentioned that yes the govt doesnt really care about tourist, conference attendees, or even normal business people for that matter. If you are human rights lawyer, and environment activist, or full websites with anti-china hate material then you may get 'closer personal attention'.
- blablablub 9y agoIf you travel a lot, ask immigration to put the stamp in a corner of your passport to save space. Dont put food in your luggage, if you are extremely unlucky a customs dog will smell it. Just walk through customs, no one cares about you. The GFW will block most social media sites and all of Google. The GFW detects the ssh protocol and slows it down/blocks it. ssh -D does work for like 30 seconds or so. Mosh works good. If you really really want to use ssh -D and firefox, remember to do an about:config and change remote DNS to true. Do the same if you use shadowsocks. Plain tor is mostly blocked. If you want to use your own, private VPN connection, use IPSEC, not PPTP. Overseas connection (Europe/USA) are extremely slow. Set up a private VPM in HK or Japan to enjoy faster speeds. Change you apt location or equivalent to something like mirrors.aliyun.com or wait hours for any updates/ package installs.
- digi_owl 9y agoSeems to me that if you travel internationally these days, your best bet is to leave electronics at home and instead buy "burner" devices at your destination.
- DanBC 9y agoThere are lots of people talking about China, but not many talking about whether any of this works against well funded government actors.
- kasey_junk 9y agoThe issue with traveling to China is not the border crossing. Its the many places you can be compromised after you've crossed the border (your hotel, the internet cafe, etc). While working for a couple of different financial institutions they had blanket "hand in your electronic devices" both before you went to China (to ensure you didn't take them) and after you returned (to ensure you didn't attempt to continue using the device they gave you for your trip). This had nothing to do with political dissidents or customs inspections and everything to do with the assumption that anything on a device in China was compromised for financial reasons. Its possible that the US/UK have been put in the same bucket by these organizations, and maybe with cause, but the threat model is completely different between the 2 places and comparing border crossing experiences doesn't invalidate that.
- deleted 9y ago[deleted]
- Aargau 9y agoPeople commenting below are probably correct wrt border entry for the common business traveler, but might be surprised if they checked their wifi logs at how many things are hitting it maliciously. For some companies/positions you may be targeted surreptitiously. Spying exists. The people who granted me my expedited Russian visa inside the consulate were kicked out as spies.
- jpelecanos 9y agoThis is probably off-topic, but I'm wondering how aggressive is China's GSD (General Staff Department) domestic SIGINT ops compared to U.S.'s NSA or Russia's Spetssvyaz/Special Communications Service?