Any advice for visitors of those websites hosted in China? As a Chinese, I am always wondering if there is a way to avoid this. Many of us are aware of the backdoors in the Chinese apps (across all the platforms). No matter how big names they are, they have to comply with the order from the ruling ones (I guess most of them cooperate with little guilty feeling). The best I can think of is to have different devices for visiting/using Chinese apps/websites. To a larger scale, I think average users have very limited resources to hide from big organizations. What average Joe could do is a more general question I have not figured out. Thanks in advance.

Some general advice, to decrease the chance any given browser exploit will work against you:

- Disable Java; disable or whitelist Flash; use a different PDF reader than Adobe.

- Use either Firefox with NoScript or Chrome. (Disabling JavaScript is highly effective at reducing attack surface, but on any sites you've whitelisted, Firefox is significantly less secure than Chrome due to the lack of sandbox, though they're working on it... I think that NoScript equivalents for Chrome don't work correctly, but could be wrong.)

- Don't use XP! It no longer receives security updates...

- For the same reason, on mobile, prefer devices that have up to date operating systems.

Not perfect, but that's the state of computer security these days.

Very detailed. Thanks for your input.

The ideal answer is to convince the sites you visit to use https.

If the Chinese government controls a single CA that's installed by default, couldn't they MitM any TLS connection that isn't pinning certs?

Are there any Chinese CAs in any browsers' default installs? If so, they should probably be removed immediately.

CNNIC is no longer trusted by Chrome due to recent incidents, and you can manually remove it from Firefox and IE. While you're at it, take a few minutes to browse the list and also remove anything that sounds Chinese.

If any website you visit legitimately uses a Chinese SSL certificate, you can whitelist it specifically. I actually do this for SSL certificates signed by my own country's CA (not China), and it works wonderfully.

I don't think, practically, we could expect anything positive from the other side. But still thanks.

Given that the Chinese government could inject malware into any insecure connection you make across the firewall, you may also want to do most of your browsing through a virtual-machine.

Thanks, note taken.

Most of China is running on outdated, no-longer-supported software with lots of vulnerabilities. Pawning those computers is easy as there is an abundance of well documented exploit vectors available.

I disagree. If the history of EW/SIGINT has taught us anything it's that denial of service through saturation is effective. E.G. "Jamming".

The question is if that truth transcends well from broadcast media (i.e. Radio) to packet based, routed networks such as the Internet. Esp long term effects.