Some people my server admin uncle included believe that bringing any device to China automatically compromises it even if you reinstall a new OS. Is this warranted as some random person?

Can I go to my public sites and/or VPN into my servers?

Edit: I go there all the time. Also, I can take these precautions but I can’t expect my family to take them. What about family members phones?

A lot of great replies, thank you! Would love the read more specifics so I can know exactly the threats and my actions

Also, this is not an anti-China post. My field is Chinese related. Just learning more about the hosting side :)

  • neatchee@lemmy.world
    link
    fedilink
    English
    arrow-up
    48
    arrow-down
    3
    ·
    edit-2
    1 month ago

    Do not bring your normal personal devices to China. They are notorious for injecting spyware on foreign devices at every opportunity. Use a freshly formatted device and create all new accounts to use with it.

    Regarding services: do not use self-hosted services unless you you spin up fresh, isolated instances of your services for use while abroad and spin them down afterwards, including formatting any OS they were hosted on.

    Regarding VPN: because we are assuming that any device used in China is compromised, do not connect to your VPN unless you have set up a segregated VLAN and are connecting through a VPN server instance created specifically for use while in China.

    Basically, assume anything you use in China is compromised. And assume your connections are being monitored. And assume that any device you are connecting to from China is at risk of being compromised. So everything needs to be segregated from the rest of your network and set up specifically to be deleted after you’re back home.

    • ComradeMiao@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      14
      arrow-down
      1
      ·
      1 month ago

      Do you have any links to read more about this? Thanks for a very detailed response.

      Is there anyway to bring my phone and laptop without this risk? I can totally format my laptop completely but can’t do that with my phone.

      • neatchee@lemmy.world
        link
        fedilink
        English
        arrow-up
        21
        ·
        1 month ago

        Unfortunately, no, not really. They are absolutely able and willing to confiscate your devices at any time once you’re on Chinese soil, and once you’ve lost physical control, that’s the end of trust for that device. Even beyond that, it’s not unheard of for there to be vulnerabilities in Wi-Fi, Bluetooth, etc that make your device susceptible to wireless attacks. IMO it’s not worth the risk.

        Here is just one example of this type of thing uncovered by The Guardian, New York Times, and others in a joint investigation: https://www.theguardian.com/world/2019/jul/02/chinese-border-guards-surveillance-app-tourists-phones

        • AustralianSimon@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 month ago

          I know both Australia and UK have laws that allow border to take and copy your phones, laptops and storage devices. It’s not unusual.

          • psmgx@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            ·
            1 month ago

            Most countries give customs and border agents broad latitude to do stuff like that. I’ve had it happen in Vietnam, the US, and Turkey, among others.

            Burners, all the way

            • AustralianSimon@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 month ago

              Agree - better safe to not risk it when crossing borders. Even if you don’t have anything incriminating your identity can be stolen and used.

  • Pixel@lemmy.ca
    link
    fedilink
    English
    arrow-up
    28
    ·
    edit-2
    1 month ago

    A lot of these comments are downright unreasonable.

    It’s important to evaluate your threat model critically. The average tourist (that isn’t going to Western China) or student is not a target for surveillance or data extrication attempts, especially firmware level attacks that are very specific to devices and are expensive to research and implement.

    Companies tend to require employees to carry burner devices for international travel because that’s just good practice. You’re far more likely to lose your device when traveling, border officials have broad discretion to search for and access your devices, and companies tend to have high value information available to their devices past the corporate gateway, like trade secrets, technical designs, accounting records or employee data. That applies to any country, even Western countries.

    Take your privacy seriously, but the notion that anything that touches Chinese soil means your devices are instantly compromised is a bit of a fallacious claim. Critically evaluate your role, the information you carry and why you might be the target of anything.

    Anyways, as far as VPNs go - technically not illegal. Companies, universities, etc. all have sanctioned MLP gateways in Hong Kong to bypass the firewall. Every expat in China uses a VPN. There’s only one public case of anyone ever being arrested for using a VPN (and it was under a catch-all law), the others were all operators of ShadowSocks/V2Ray airports.

    Tailscale and WireGuard is dicey in Mainland China. If you’re just a short term visitor, just buy a 3HK roaming sim for China and call it a day. As a best practice, you don’t really want to expose your self hosted services to the web anyways, so I would probably not even bother trying to VPN from a mainland connection directly.

    I never got Plex or Jellyfin to work well on actual Mainland internet connections, simply because the Chinanet backbone that most people in China use is excruciatingly bottlenecked to the point that torrenting from other Chinese peers is just a much more pleasant experience.

  • TheButtonJustSpins
    link
    fedilink
    English
    arrow-up
    25
    ·
    1 month ago

    Get a new phone for use while traveling, then dump it when you’re back home. Leave your services behind.

  • schizo@forum.uncomfortable.business
    link
    fedilink
    English
    arrow-up
    24
    ·
    1 month ago

    If your device is out of your sight, then yeah, you should probably assume it’s compromised.

    Of course, that’s hardly JUST China doing funky shit with your devices, but depending where you’re calling home, odds are customs/immigration when you head home will try to do the exact same thing, too.

    And the answer to everything is yes, always use a VPN if you don’t trust the network and you should never trust the network.

  • NeoNachtwaechter@lemmy.world
    link
    fedilink
    English
    arrow-up
    23
    ·
    1 month ago

    Can I go to my public sites

    I would not recommend. Remember, wherever you step, your feet are leaving traces. Your public sites may be a little too publicly well-known afterwards.

    and/or VPN into my servers?

    VPN’s might not work from there, or the use may be considered a crime.

  • Moonrise2473@feddit.it
    link
    fedilink
    English
    arrow-up
    20
    ·
    1 month ago

    When you enter China, you have to run their application on your phone to fill the immigration form. Way more convenient compared to the paper slip, right? 😉

    It’s this https://apkpure.com/zhong-guo-ling-shi/com.gov.mfa

    Luckily, you don’t need to install full malware but only medium malware, there’s a way to run it as a web app inside tencent WeChat by scanning a special qr code.

    I run this stuff inside insular because tencent is tencent and even on fully patched Android 15 without any file access permission they still manage to drop fingerprinting files disguised as images in /pictures/.gs_fs0

    For connecting to my servers, technically ssh on standard ports isn’t blocked (otherwise it would hurt their bots, no?) but I don’t want to show my server IP address, so I use a hysteria2 proxy hosted on a Oracle VM in the Japan datacenter. There are services like doggygo that rent access to those proxys for literal pennies (like $2 per month) but payment need to do with alibaba’s alipay or tencent wepay which is ultra traceable (linked to Chinese id+Chinese bank account+Chinese phone number) and very stupid. Honeypot?

    There are reports of evil maid attacks where a secret service agent poses as room cleaner in your hotel room and tampers with your laptop when you’re away, but for normal people this seems unlikely. Keep your electronics with you at all times, always use a VPN, check hashes of executables if really need to run them (better not) and you’re going to be ok

  • omxxi@feddit.org
    link
    fedilink
    English
    arrow-up
    8
    arrow-down
    4
    ·
    1 month ago

    I’m wondering if this is a real threat, or a conspiracy theory. If it’s a real threat, wouldn’t be the same with the NSA?

      • EarMaster@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 month ago

        To be honest: After visiting both the US and China I was way more concerned after my US visit that my phone may have been compromised.

        Using a VPN was no problem for me in China, but it has been a few years since I’ve been there.

        • ComradeMiao@lemmy.worldOP
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 month ago

          That’s an interesting thought as well. Was talking with my partner, we agree both countries have the ability and feel Ike it’s almost sinophobic to say only China does this. I’m sure the US would if it could.

  • kylian0087@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    1 month ago

    Grapheneos with a dedicated profile with those China apps. Dont allow the profile to run in the background. Then just use tor with snowflake or one of the many methods of tor to bypass the firewall of China.