4 ms·

The ideal answer is to convince the sites you visit to use https.

• LiweiZ 12y ago
  I don't think, practically, we could expect anything positive from the other side. But still thanks.
  • Terr_ 12y ago
    Given that the Chinese government could inject malware into any insecure connection you make across the firewall, you may also want to do most of your browsing through a virtual-machine.
    • LiweiZ 12y ago
      Thanks, note taken.
• alphapapa 12y ago
  If the Chinese government controls a single CA that's installed by default, couldn't they MitM any TLS connection that isn't pinning certs? Are there any Chinese CAs in any browsers' default installs? If so, they should probably be removed immediately.
  • kijin 12y ago
    CNNIC is no longer trusted by Chrome due to recent incidents, and you can manually remove it from Firefox and IE. While you're at it, take a few minutes to browse the list and also remove anything that sounds Chinese. If any website you visit legitimately uses a Chinese SSL certificate, you can whitelist it specifically. I actually do this for SSL certificates signed by my own country's CA (not China), and it works wonderfully.