Securing a laptop for travel to China
mricon.com
mricon.com
ironically, you don't get comparable Internet speed or cost (my 200mbps Internet costs me $180/year, or I can upgrade it to 500mbps for $400/year) in most "free" countries. I'd be protesting really hard if I have to pay some unfair cost, say $50/month or more, to suffer from the so called uncensored broadband running at tortoise speed such as 50mbps or less.
With ssh, restarting the connection would help for whatever reason. So I had a little script rotating a set of connection behind haproxy.
EDIT: oh and Hong Kong. HK VPSes seemed to work the best.
https://github.com/shadowsocks/shadowsocks
"Removed according to regulations." vs:
https://github.com/shadowsocks/shadowsocks/tree/master
Is it the shadowsocks project dancing around github censorship, or github allowing ss to dance around chinese censorship?
https://web.archive.org/web/20150822042959/https://github.co...
BTW, I have noticed a trend to block port 22 in international hotels. It's annoying!
Have you lived in China? If so, please tell me what VPN service you're talking about. If not, I think you might not be aware how sophisticated and annoying the GFW is.
Start here: http://blog.zorinaq.com/my-experience-with-the-great-firewal...
I'm curious if ssh access to eg: digital ocean is allowed?
If so, you can simply use ssh as a socks5 proxy:
ssh -D 8080 you@example.com
# Set your browser to use 127.0.0.1:8080
# as a socks5 proxy for dns lookup and
# traffic, via eg foxyproxy for firefox
try IPSec or PPTP based vpn, they turn your encrypted communication into plain text. then think about the scale - they do this on almost 1 billion users.
We developed shadowsocks for the exact purpose of battling machine learned DPI head on.
The real challenge is the (poor) quality of the networks and the topology of censorship body all around China. The Blackbox nature of such state system made each improvement feel like experiment at best, simulated annealing at worst.
1. shadowsocks is a good example that certain vpn/proxy can survive after becoming popular. 2. GFW blocks sites/pages/connections based on content, it has been doing this for more than a decade. whether shadowsocks can fool GFW or not doesn't change the nature of GFW.
So, 1. Chinese gov don't care about those who just want to paste a photo on twitter, they blocked website such as twitter because it's known by even some Chinese farmers or workers. They are supposed to be susceptible, which means, danger.
2. It is said that China will block by whitelist instead of blacklist(maybe like North Korea), but they didn't do that.
3. Usually, someone who can buy and setup a server for himself is clever enough to distinguish between lie by terrorists and the truth.
I still visit semi-regularly (once a year, approximately) and my observations remain valid now as then (for me at least).
Same goes for my experiences going into and coming out of Russia, for that matter.
https://detail.tmall.com/item.htm?spm=a230r.1.14.1.WxB4yL&id...
Nineteen Eighty-Four is more interesting, apparently, there are hundreds of vendors selling it on taobao.com, including the Xinhua which was started/owned/managed by the Communist Party of China.
https://list.tmall.com/search_product.htm?q=Nineteen+Eighty-...
(In all due deference, Capitalist Realism is a very anti-capitalist argument, so...)
However if you brought any book that attacks current government, for example books about the 64 event, you would be in very big trouble.
You seriously believe that she is less influential than a few books? If Chai Lin is allowed to enter and stay in China, what is the point stopping a few books?
Its an only state where during my travels on the way out of the country (Russia here) in addition to usual security scan and passport control you have an additional booth maned with rusia official/military personel only judging if they can let you out. Again: this was in addition to passport control due to destination etc.
Source: me at s petersburg airport 2016.
P.s. Overall Russia experience was very good and eyes opening (comparing to what you get from media)
My point is perhaps you were profiled to your benefit as well.
Edit: I'm from the US.
Only once has customs had the slightest look at our bags and that was when the airline left them behind and we had to pick them up later. I was wheeling out a cart with 4 checked bags, no carryons and that drew the interest of the customs guy. The entry stamp two days earlier also drew his interest. He started running the bags through his x-ray, at that point my wife caught up and explained what had happened (she's a native speaker, I figured it was easier to leave any discussion to her) and that was the end of it. Nothing was ever opened.
Even the day my wife set off a nuke alarm at customs produced no response. (She had set off a previous alarm also, which was resolved with a short discussion. They never checked what the actual radiation source was and the card from the lab that explained why she was hot was sitting at home in the pocket of the jacket she didn't wear.)
Now, if my employer was some big company I would be concerned with espionage but that's all. Since my employer doesn't do anything remotely of interest to the Chinese I don't worry about it. Besides, we stay with relatives, my laptop has never seen a Chinese hotel room.
Well, the Cultural Revolution was a crazy time.
um... so what's social harmony? The exact same words are used by chinese gov. when trying to be 'vague' about their censoring activities...
So as long as you're not doing political activism, it's fine. I know people who've had private messages apparently censored when they contained anti-government ideas. They don't get arrested. It's not something to fear. The tech companies just monitor and delete politically risky content. If you are a real dissident, then you know you're breaking the law, however vaguely it's worded, and you know you're in danger.
You tell me how Nazi could possibly raise to the very top without the help of that very beneficial revolution? maybe time to read more history books and come back with better trolling skills?
I do agree that it is always good for some political speculators.
What about the Cultural Revolution which put the ruling party itself in power? It's a bit hypocritical for the government to categorically condemn revolution when they wouldn't even exist without it.
And yeah, while the French Revolution was probably a good thing in the long run, it was pretty terrible in the short run: https://en.wikipedia.org/wiki/Reign_of_Terror
First of all, the Cultural Revolution didn't put the ruling party in power, and second of all the CCP (and China) of today is very different from the CCP (and China) at the time of the Cultural Revolution.
Another dimension of threat is the targeted threat model. Examples of this include the French Secret Service leaving audio recording devices in the first class seats, so they could distribute economic espionage to French state-owned companies. Or of some country (NSA, MSS, BND) trying to get a toehold into some company's internal systems as preparation either for cyber defense, cyber attack, defending their country against the pernicious dissident movement, etc. There have been stories about laptops left in Chinese hotel rooms getting outfitted with keyboard bugs or other free hardware "upgrades". It's not clear how true those stories are, but again, since they are targeted attacks, just because you've never seen it happen doesn't mean much.
Perhaps simply you never noticed the free hardware upgrade. Or the country has laws that prohibit using intelligence agencies from giving an advantage to that country's companies; or you are a citizen of that country and that automatically gives you significant protections over anyone else, for which anything is fair game because that country doesn't recognize privacy as a fundamental human right or views non-citizens located outside of the country as not having any constitutionally guaranteed rights.
Or perhaps you simply don't work for a US defense contractor, or a large social media or search company, and so you were deemed too unimportant to bug. (Don't take it personally.)
So the question of deciding what is the right level of paranoia is a tricky one, and I wouldn't be too quick to judge. Is wearing a seat belt in a car being too paranoid? After all, the vast majority of the time you don't need it. Does that mean you are a crackpot for insisting that you and your passengers wear a seat belt?
Finally, note that the person who wrote the article is responsible for providing IT for kernel.org, Linus Torvalds and Greg K-H, and other kernel developers who have their git trees on the kernel.org system. How much security protections do you think we should be providing to make sure no one is trying to introduce a backdoor into the Linux kernel?
somehow, a plane is so noisy that I cannot imagine this working :D
You might as well say that it's unlikely that tapping 60s era cars on the highway will work. I'm fairly certain it did.
I wouldn't say the experience of getting into China is the best, because you still need a Visa to study/work there. But I'd say that it might have been the easiest Visa to get.
On the other hand I've never been through so much aggressiveness and difficulty with the American border. It probably is the worst border in the world (or at least that I've been through).
I've been in most of the Iron Curtain countries--most of which searched us in far more detail than anything I've gotten from the US.
And I've been subject to some fairly through searches in Africa looking for anything that carried those forbidden words "Product of South Africa". Never mind all the stuff written in Afrikaans with the forbidden words blacked out.
(In my travels to various unremarkable destinations, there's one country that stands out as having far and away the grumpiest, officious, unpleasant and sour people in immigration: the UK.)
YMMV.
Some of my experiences:
- ~2013 on an Australia -> US (1 month) -> Mexico (1 month) -> Australia via US stopover (~8h) trip, I was detained by customs at the stopover for ~3h and had all my luggage opened and unpacked in front of me for no reason that I can tell other than that I was coming from Mexico and looked tired. About 2h of the 3h were spent waiting in line and nobody told me why I was in line or what to expect.
- Mid 2014 on an Australia -> Malaysia (6h) -> Turkey (2w) -> US (2w) -> Australia trip, I was detained on the way into the US for ~2h by immigration and was asked the question "did you ever step foot in Syria" about 10 times (I wish that was an exaggeration). Again, nobody was friendly, nobody told me what was happening and I spent most of the time waiting and wondering whether I was about to be denied entry for some reason.
- Late 2015 on a US -> France (3d) -> US trip, I was pulled aside prior to boarding the plane because I had an SSSS mark on my boarding pass, which meant I was one of the 10% "randomly" selected for extra screening.
- Early 2016 on a US -> Switzerland (8d) -> US trip, I was pulled aside in Switzerland because once again I had an SSSS mark on my boarding pass. This was the second time in a row.
- Late 2016 on a US -> Germany (3d) -> US trip, I was again had an SSSS mark, for the 3rd time in a row.
Aside from my travel history which I don't think is particularly out of the ordinary, I don't believe there's anything else particularly interesting about me. I'm a young white male with a bachelor's degree, my father works for the Australian government, my mother is a nurse and I've never been a member of any major religious or human rights organization.
Seriously; going through the Chinese border is much nicer experience than those two declining and/or former empires: USA and UK.
They do not care about what is on your laptop. The Chinese block Facebook and al to prevent Chinese en masse joining Facebook; they don't care that a few westerners check up on dogs or complain about missing toilet paper using some VPN/SSH-thingee.
Are they likely to be hassled at the border? No. But if there's a way to make all parties happy, might as well document it.
If they really cared, they wouldn't host it on Linux. It would be OpenBSD or something with every software measure possible on read-only storage that admin physically replaces. That's just to start with. It's good that the author is taking measures but it gets amusing how much risk they keep on distribution side when you bring up nation-states going after them. Most big ones have 0-days for Linux systems anyway. They just use them in a targeted fashion to get more ROI from them. China can probably hit anyone working for Linux Foundation if they wanted to outside some really, paranoid setups that might exist.
They just don't since they don't care about them. They're 100% unimportant to Chinese intelligence. What is important is the source code of the kernel and privileged software which are freely available. If anything, letting Linux development and distribution continue is a good thing for Chinese intelligence since developers add features (and vulnerabilities) more than do code audit on a project whose source is available to the black hats. Makes Chinese spies' jobs so much easier. :)
> It is important to point out that you are extremely unlikely to be penalized for bringing in an encrypted laptop with you to China, as any kind of widespread zealous application of such practice would quickly shut down any business travel to China -- and this is definitely not in the government's interest.
In the US's case, it might mean that the world depends too much on it and has to put up with draconian policies.
Just a wild guess, but like many people have said in this discussion: I find it pleasant to go to China, but I have to be paid to go to the US.
Hopefully the US will sort itself out and people can be happy visitors again, and not simply go there because it's normal to do so.
The US is quite different, far from welcoming, it's scary, so many bad stories of things happening, the immigration people trend to scowl (they must be under so much pressure) they take your photos, your fingerprints (not entering China) ... honestly, as much as I love the US, it's my home I've spent half my adult life there, I'm not going out of my way to visit these days
While working for a couple of different financial institutions they had blanket "hand in your electronic devices" both before you went to China (to ensure you didn't take them) and after you returned (to ensure you didn't attempt to continue using the device they gave you for your trip). This had nothing to do with political dissidents or customs inspections and everything to do with the assumption that anything on a device in China was compromised for financial reasons.
Its possible that the US/UK have been put in the same bucket by these organizations, and maybe with cause, but the threat model is completely different between the 2 places and comparing border crossing experiences doesn't invalidate that.
"Then, depending on your level of paranoia, give the ChromeBook away to what is likely to be a very thankful kid/student"
133 million foreigners went through Chinese custom and entered China in 2016 - that is a lot of paranoid laptops to give away.
A lot of laptops that have the wrong keycaps and radio regulatory domain no less.
The OP is also the author of LinuxFoundation's laptop security guidelines. LF has been targetted by a number of DDoS's intrustions and worms. At least one was successful, and it's not clear if it was a criminal org, or a state actor disguised as such. So their laptop configuration policy is designed to thwart all comers. Hard drive / swap encryption, SSH keys on GPG cards, secureboot, SELinux, encrypted backups, NoScript, HTTPSEverywhere, FireJail, etc.
China's policy appears to be that you must provide them with data should they request it. Making this happen is pretty much in direct contravention of the same laptop configuration policies designed to thwart the NSA, Europeans, Russians, cybercriminals, etc. But lets look at it this way: LF knew the facts on the ground in China, and proceeded anyways. So their IT manager responsible for preventing another break-in publishes a guide for adhering to China's laws while keeping the LF safe.
Throughout this thread I see people suggesting that they're never bothered by state apparatus, so nobody should worry. I don't know which of that sentiment's implications is more insulting: that kernel.org isn't worthy of state infiltration, or that China isn't competent enough to pull it off.
Chinese immigration does not treat you as a potential criminal aiming to overstay your visa by default.
There are probably reasons for that, apparently an estimated 3% of the US population is illegal aliens. I wonder what the number is for China.
https://en.wikipedia.org/wiki/Illegal_immigration_to_the_Uni...
Also, it's sad that you have to call human beings 'aliens'.
The term generally preferred by those of us who balk at "illegal" and "alien" is "undocumented."
Now, using "undocumented" for "illegal" is clearly fraudulent. These words don't mean the same.
Undocumented frames people as lacking official documentation for the lives they lead (so we should document them). That is illegal, yes, but the terminology puts the emphasis in a different place.
Would you say "person who struggled with narcotics addiction" or "felon"? People who were addicted to hard drugs at one point possessed them, and are necessarily criminals in the same way that people who are in the US without corresponding records in government databases are necessarily criminals. Which word you choose depends on how you want the audience to feel about them.
Illegal vs. undocumented is just a code word for your view on immigration policy (with illegal being more neutral, undocumented being specifically liberal).
How is it reasonable or courteous to require your conference attendees to read a long guide, buy a throwaway laptop, set it up, etc., or run the risk of being requested to decrypt sensitive information at the border or have their devices seized?
Just because the US and China get away with this does not mean that all countries do. Just pick any state in this list http://www.wassenaar.org/participating-states/ that doesn't have a history of requesting decryption or taking traveler's property without good cause.
https://wiki.debian.org/non-US (Also: OpenBSD etc)
US customs is fine. TSA is a mixed bag. But US immigration are unfathomably rude and disrespectful for no reason at all; they treat you like scum. I've been through US immigration & customs a lot, been sent to secondary three times, ironically the people you deal with in secondary are more polite/reasonable than the people in the little glass booths, but still very "respect my authority."
Ironically going into the US feels more like entering a police state than going into Russia. The Russians were just super disinterested and to-the-point. The US is fine once you're in, but getting in as a non-American is a bad first impression (the UK has this issue too).
I'd hate to think how much worse they would treat me if I was non-white and from a country with traditionally bad or mixed ties to the US. From other people's anecdotes that I've read or spoken to: Bad. Just by what their official union supports (and who) you can get a sense of their views on other races.
Last year the US just started a new policy of asking foreigners for our social media credentials. It is starting out as option, but like all of these things it is just a matter of "when" not "if" it will be made mandatory.
Never had a single problem with US immigration or customs. Had plenty of issues with Canadian customs on the other hand. Especially when crossing the border by bus. From Canada to US, never an issue, from US to Canada, treated like shit every time.
What matters is that nerve-wracking bullshit like this[1] happens to people (little old ladies!) from allied bloody countries.
Mem Fox is a celebrated Australian author of childrens books.
She later received an apology, but only because she's famous. Tough luck to the average foreigner who gets abused by your border agents.
This is why the US is hell bent on spewing negative propaganda about China and Russia, because it needs to hide the fact that it's a huge embarrassment to itself.
1. http://www.abc.net.au/news/2017-02-25/mem-fox-detained-at-lo...
After I became an Australian citizen, I never had problems entering Australia again, interestingly (as everywhere else, they have different Customs areas for citizens).
That is a bold claim. As an Australian it would be enlightening if you could provide links to support your assertion.
If I were to sum up my personal experience with Chinese gov. officials, I think "apathetic", or even "lazy" would be a much more apt description.
My response above is more about the paranoia some people tend to have when visiting China because of the reputation of its government, when from my personal experience, the people and the government workers of China are some of the most non-ideological, politically apathetic people I have interacted with.
Short of being some sort of China-focused activist, you'd have to try real hard to get Chinese law enforcement to care about what you're doing.
As long as you are not bringing a world map with Taiwan as a separate color from China, you will be just fine.
For some companies/positions you may be targeted surreptitiously.
Spying exists. The people who granted me my expedited Russian visa inside the consulate were kicked out as spies.
If they ever checks it, it's usually because it looks so new so they want to make sure you're not smuggling.
https://www.theguardian.com/technology/2017/jan/23/china-vpn...
Your best best (if you can survive on web only) is to ssh to a server outside the country using the "-D" option which creates a socks proxy, then use firefox to connect.. I tried with chrome but it kept trying to make direct DNS requests (which don't work) and I was unable to fix it.
I was there June, 2016.
My point was more that everyone was already using a VPN that wasn't blocked, and that didn't change. (I guess they bribe the government or have an agreement to monitor traffic, or else they are not big enough to care about.)
There are many other ways. The best current methods I know of are Shadowsocks (what I use), or ShadowsocksR, or Shadowsocks over obfsproxy. Although the Shadowsocks protocol presents as a socks proxy, there are clients for iOS (e.g. Potatso 2), Android and routers (e.g. those available at koolshare's web site) which make it transparent to use (and they deal with your DNS issue as well, by tunneling DNS through the proxy).
"Although the Shadowsocks protocol presents as a socks proxy, there are clients for iOS (e.g. Potatso 2), Android and routers (e.g. those available at koolshare's web site) which make it transparent to use (and they deal with your DNS issue as well, by tunneling DNS through the proxy)."
How would you use ssh -D to reroute your iPad traffic? How would you set up DNS? How would you help your non-technical friends who wanted to set this up?
Put more simply:
- Easy to set up the server
- Easy to set up devices (Windows, OSX, Android, iOS 9+) so that you can connect in a couple of clicks, and the right traffic goes via the tunnel
- It's reliable (in the past 1+ years I've been using it, I've experienced none of the slow-downs or blocking I experienced using other protocols, including ssh, PPTP, L2TP and OpenVPN).
And ssh is not the best way. shadowsocks is.
The only issue with Russian border crossings are the line-ups due to general mess and inefficiency. Nobody checks anything, leave alone rummaging through your belongings or asking to see the contents of your devices.
Others have also mentioned that yes the govt doesnt really care about tourist, conference attendees, or even normal business people for that matter. If you are human rights lawyer, and environment activist, or full websites with anti-china hate material then you may get 'closer personal attention'.
Excellent metaphor!
Unless you are an activist they don't care about anything.