6 ms·

As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?

lbriner 8y ago
If you have something that you genuinely need to keep from the Chinese, don't connect to the internet full-stop. Even SSL can be decrypted by their great firewall if they are suspicious enough. Even VPNs have no guarantee that someone with the right resources hasn't terminated the VPN themselves on the quiet!
- vegardx 8y ago
  [citation needed] Like whoa, are you even aware of what you are suggesting? This is completely false.
  - anyzen 8y ago
    No need to decrypt SSL, there are easier ways: https://xkcd.com/538/ https://xkcd.com/538/
    - walrus01 8y ago
      Or do like Uzbekistan has done, force all local computer stores to install a trusted root CA in the operating system before it gets to the hand of the end user. You can transparently MITM TLS1.2 if the system trusts the mitm operator CA. Maybe 0.01% of people even know where to look to examine their windows 10 machine's trusted CA list.
      - yayana 8y ago
        Having looked through the government CAs in preinstalled CA lists, I'm a little surprised Uzbekistan doesn't qualify.
    - vegardx 8y ago
      Naturally! Well - except for the diplomatic disaster this would turn into if you did it on foreigners. I think most people exaggerate the technical capabilities of the Chinese government and how interesting they are for them. Sure, we shouldn't be naive, but a drop of realism is always good.
      - lbriner 8y ago
        The difference is in the degree! I don't think the Chinese could or would decrypt all foreigners traffic (and I did mean TLS but use the more well-known SSL name) but if the question is "As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?", the answer is very clearly don't connect to the internet. I don't know the person who asked the question, whether he is a realistic government target or just some normal person but there are enough reports of cache poisoning, VPN control/blocking and Chinese hijinks to know that if you are worried about them, don't connect. Mind you, the same fear applies to the US and UK as well.
  - jacobwilliamroy 8y ago
    I know that SSL and TLS tend to be thrown around interchangeably, but SSL is actually deprecated and unrecommended for being unsecure[0] [0] https://en.wikipedia.org/wiki/Transport_Layer_Security#SSL_2.0 https://en.wikipedia.org/wiki/Transport_Layer_Security#SSL_2...
    - vegardx 8y ago
      I would still like to see them decrypt the traffic on demand. There are heaps of other attack vectors that are much easier to deploy. Also, looking at Qualys SSL Labs[0] it seems like most of the web does a good job at supporting secure and modern protocols. And it feels safe to assume that parent meant TLS, like most people do. [0] https://www.ssllabs.com/ssl-pulse/ https://www.ssllabs.com/ssl-pulse/
walrus01 8y ago
If I had to do it, I'd go full thin client. Store nothing. Bring a laptop that is basically a bare bones Linux + xfce desktop, and the ability to connect to external VPN + vnc-over-ssh2 session to a system you trust. Keep in mind that a rootkit installed on your thin client is a possibility, for keystroke logger or whatnot, so if you don't keep it with you and don't treat its physical security as a concern, all bets are off.
elorant 8y ago
Buy a feature phone and dump it once you return.
- lordlimecat 8y ago
  Buying a SIM in china requires you to register your passport.
  - elorant 8y ago
    I meant assume that your phone will be hacked so buy one that you can afford to throw away once you return from China.
HippoBaro 8y ago
(I live in China) I would advise against VPN entirely. I am unsure about the state ability to decrypt the content of the connection (heavily depends on how the VPN is configured really — weak and legacy ciphers, etc.). But they will detect it and eventually you'll start dropping packets like crazy. A simple way to evade all of this is to use shadowsocks with a strong cipher and strong password between your computer in China and your server outside of it. Don't use any free server and don't use any commercial shadowsocks offerings. Set it up yourself, it's pretty easy. On the mobile phone side of things. I wouldn't trust anything. Especially Apple that has been very complaisant with local authorities. China plays a tactical game: they pretend (or we suspect, and they want us to) that they can do a lot of things. But nobody knows the extent of what they are actually capable of.
- shawnz 8y ago
  But shadowsocks is a VPN. What makes it better than other offerings?
  - HippoBaro 8y ago
    Shadowshocks is not a VPN at all. It's a connectionless SOCKS5 proxy. No hand-check, no key exchange, no protocol agreement. VPN is not made to be undetected, only secure in the sense of data encryption. Shodowsocks has broader objectives. See https://shadowsocks.org/ https://shadowsocks.org/ for info.
    - shawnz 8y ago
      > It's a connectionless SOCKS5 proxy. On your local workstation, it exposes itself as a SOCKS5 proxy. But to communicate with the shadowsocks server, it uses a proprietary protocol which is not SOCKS5 and does have a key exchange process. Either way, these details don't affect its ability to be detected. > VPN is not made to be undetected "VPN" is not just one technology. Many vendors of VPN software do claim that their software is made to be undetectable. One example is shadowsocks, but there are other vendors who also claim that.
68c12c16 8y ago
FYI, the great fire wall engineers have already found ways to inspect packets sent through OpenVPN... A couple of weeks ago, I was asked by a friend who was traveling in China at the time to set up a VPN for him so he could use Gmail and other Google services there...I went for the easy way and used the OpenVPN for him, but to our disappointment, with that VPN tunnel, he still could not access google search page while many other pages on other domains were fine...I spent a few hours trying to figure out why, and then I came across these discussion, https://superuser.com/questions/1187525/vpn-to-avoid-the-great-firewall-of-china-is-only-partly-working https://superuser.com/questions/1187525/vpn-to-avoid-the-gre... https://www.quora.com/Can-Openvpn-still-bypass-the-GFW-of-China-circa-2017s-Internet-crackdown-in-China-*Please-read-details-before-answering* https://www.quora.com/Can-Openvpn-still-bypass-the-GFW-of-Ch... My friend and I haven't experimented further; but I think one way that might work is to chain multiple VPNs or perhaps obfuscate your protocol a bit (i.e. make some minor customization yourself)...
- walrus01 8y ago
  It isn't that they need to inspect the contents of the packets, tcp and udp flow analysis will reveal VPN traffic patterns even if the crypto is perfect. What I've seen reported is that people using openvpn see it work for a while, then increasing latency and packet loss, then eventually total lack of ability to move traffic between the two endpoint IPs.
  - 68c12c16 8y ago
    that's true...they have been studying the packet flow patterns for a while -- such as this research, http://security.riit.tsinghua.edu.cn/share/classify_encrypted.pdf http://security.riit.tsinghua.edu.cn/share/classify_encrypte... But if the government completely blocks out VPN uses in the country, lots of international business operating there will suffer and then they will complain, which is not something the government can ignore (at least not always)...VPN whitelist could be a solution, but I don't know how well that is implemented (if it has been implemented) -- not to mention keeping a perfect consistent whitelist at that scale would be difficult...in addition, there is always some false positive/negative in their flow pattern analysis -- those are statistical approaches after all...so there is some grey area here... Anyway, back to that openvpn experiment I did with my friend, many websites were still accessible with my openvpn tunnel -- although Google was not among those sites -- this seems to imply that they were doing some package semantic analysis (i.e. deep packet inspection)...

lbriner 8y ago

If you have something that you genuinely need to keep from the Chinese, don't connect to the internet full-stop. Even SSL can be decrypted by their great firewall if they are suspicious enough. Even VPNs have no guarantee that someone with the right resources hasn't terminated the VPN themselves on the quiet!

vegardx 8y ago
[citation needed] Like whoa, are you even aware of what you are suggesting? This is completely false.
- anyzen 8y ago
  No need to decrypt SSL, there are easier ways: https://xkcd.com/538/ https://xkcd.com/538/
  - walrus01 8y ago
    Or do like Uzbekistan has done, force all local computer stores to install a trusted root CA in the operating system before it gets to the hand of the end user. You can transparently MITM TLS1.2 if the system trusts the mitm operator CA. Maybe 0.01% of people even know where to look to examine their windows 10 machine's trusted CA list.
    - yayana 8y ago
      Having looked through the government CAs in preinstalled CA lists, I'm a little surprised Uzbekistan doesn't qualify.
  - vegardx 8y ago
    Naturally! Well - except for the diplomatic disaster this would turn into if you did it on foreigners. I think most people exaggerate the technical capabilities of the Chinese government and how interesting they are for them. Sure, we shouldn't be naive, but a drop of realism is always good.
    - lbriner 8y ago
      The difference is in the degree! I don't think the Chinese could or would decrypt all foreigners traffic (and I did mean TLS but use the more well-known SSL name) but if the question is "As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?", the answer is very clearly don't connect to the internet. I don't know the person who asked the question, whether he is a realistic government target or just some normal person but there are enough reports of cache poisoning, VPN control/blocking and Chinese hijinks to know that if you are worried about them, don't connect. Mind you, the same fear applies to the US and UK as well.
- jacobwilliamroy 8y ago
  I know that SSL and TLS tend to be thrown around interchangeably, but SSL is actually deprecated and unrecommended for being unsecure[0] [0] https://en.wikipedia.org/wiki/Transport_Layer_Security#SSL_2.0 https://en.wikipedia.org/wiki/Transport_Layer_Security#SSL_2...
  - vegardx 8y ago
    I would still like to see them decrypt the traffic on demand. There are heaps of other attack vectors that are much easier to deploy. Also, looking at Qualys SSL Labs[0] it seems like most of the web does a good job at supporting secure and modern protocols. And it feels safe to assume that parent meant TLS, like most people do. [0] https://www.ssllabs.com/ssl-pulse/ https://www.ssllabs.com/ssl-pulse/

walrus01 8y ago

If I had to do it, I'd go full thin client. Store nothing. Bring a laptop that is basically a bare bones Linux + xfce desktop, and the ability to connect to external VPN + vnc-over-ssh2 session to a system you trust. Keep in mind that a rootkit installed on your thin client is a possibility, for keystroke logger or whatnot, so if you don't keep it with you and don't treat its physical security as a concern, all bets are off.

elorant 8y ago

Buy a feature phone and dump it once you return.

lordlimecat 8y ago
Buying a SIM in china requires you to register your passport.
- elorant 8y ago
  I meant assume that your phone will be hacked so buy one that you can afford to throw away once you return from China.

HippoBaro 8y ago

(I live in China) I would advise against VPN entirely. I am unsure about the state ability to decrypt the content of the connection (heavily depends on how the VPN is configured really — weak and legacy ciphers, etc.). But they will detect it and eventually you'll start dropping packets like crazy. A simple way to evade all of this is to use shadowsocks with a strong cipher and strong password between your computer in China and your server outside of it. Don't use any free server and don't use any commercial shadowsocks offerings. Set it up yourself, it's pretty easy. On the mobile phone side of things. I wouldn't trust anything. Especially Apple that has been very complaisant with local authorities. China plays a tactical game: they pretend (or we suspect, and they want us to) that they can do a lot of things. But nobody knows the extent of what they are actually capable of.

shawnz 8y ago
But shadowsocks is a VPN. What makes it better than other offerings?
- HippoBaro 8y ago
  Shadowshocks is not a VPN at all. It's a connectionless SOCKS5 proxy. No hand-check, no key exchange, no protocol agreement. VPN is not made to be undetected, only secure in the sense of data encryption. Shodowsocks has broader objectives. See https://shadowsocks.org/ https://shadowsocks.org/ for info.
  - shawnz 8y ago
    > It's a connectionless SOCKS5 proxy. On your local workstation, it exposes itself as a SOCKS5 proxy. But to communicate with the shadowsocks server, it uses a proprietary protocol which is not SOCKS5 and does have a key exchange process. Either way, these details don't affect its ability to be detected. > VPN is not made to be undetected "VPN" is not just one technology. Many vendors of VPN software do claim that their software is made to be undetectable. One example is shadowsocks, but there are other vendors who also claim that.

68c12c16 8y ago

FYI, the great fire wall engineers have already found ways to inspect packets sent through OpenVPN... A couple of weeks ago, I was asked by a friend who was traveling in China at the time to set up a VPN for him so he could use Gmail and other Google services there...I went for the easy way and used the OpenVPN for him, but to our disappointment, with that VPN tunnel, he still could not access google search page while many other pages on other domains were fine...I spent a few hours trying to figure out why, and then I came across these discussion, https://superuser.com/questions/1187525/vpn-to-avoid-the-great-firewall-of-china-is-only-partly-working https://superuser.com/questions/1187525/vpn-to-avoid-the-gre... https://www.quora.com/Can-Openvpn-still-bypass-the-GFW-of-China-circa-2017s-Internet-crackdown-in-China-*Please-read-details-before-answering* https://www.quora.com/Can-Openvpn-still-bypass-the-GFW-of-Ch... My friend and I haven't experimented further; but I think one way that might work is to chain multiple VPNs or perhaps obfuscate your protocol a bit (i.e. make some minor customization yourself)...

walrus01 8y ago
It isn't that they need to inspect the contents of the packets, tcp and udp flow analysis will reveal VPN traffic patterns even if the crypto is perfect. What I've seen reported is that people using openvpn see it work for a while, then increasing latency and packet loss, then eventually total lack of ability to move traffic between the two endpoint IPs.
- 68c12c16 8y ago
  that's true...they have been studying the packet flow patterns for a while -- such as this research, http://security.riit.tsinghua.edu.cn/share/classify_encrypted.pdf http://security.riit.tsinghua.edu.cn/share/classify_encrypte... But if the government completely blocks out VPN uses in the country, lots of international business operating there will suffer and then they will complain, which is not something the government can ignore (at least not always)...VPN whitelist could be a solution, but I don't know how well that is implemented (if it has been implemented) -- not to mention keeping a perfect consistent whitelist at that scale would be difficult...in addition, there is always some false positive/negative in their flow pattern analysis -- those are statistical approaches after all...so there is some grey area here... Anyway, back to that openvpn experiment I did with my friend, many websites were still accessible with my openvpn tunnel -- although Google was not among those sites -- this seems to imply that they were doing some package semantic analysis (i.e. deep packet inspection)...