Setup Checklist for Clients Travelling to China
Secure setup for clients who need to take their work or private devices to Mainland China
Body
Dear ,
following up on our conversations on your upcoming travels, I’m sending you this checklist with tips for improving your digital security before you leave.
-
Back up all sensitive data from the devices you will carry with you to an encrypted external storage media that you will leave at home. Then delete this data from the device you will be carrying with you. [[ If necessary, insert instructions for secure file deletion. For Windows, we can point them to this guide. ]]
If you need any of this data while travelling, you can upload an encrypted folder to a cloud storage service, download it when you’re in the country, and then delete it again before you leave. We can help you set up a trusted storage service.
-
Enable full-disk encryption with a strong password/passphrase.
[[ For recommendations on full-disk encryption, see Article #166: Full-Disk Encryption (FDE) ]]
-
Enable the Firewall (with so-called ‘stealth mode’, which does not reply to pings)
[[ Depending on the client’s operating system, we can send them the following links:
- Windows Vista and 7
- On Windows, we can also suggest to use Comodo instead of the built-in firewall
- More general instructions on Comodo are here
- For Mac
- For Linux (GUFW) ]]
-
Make sure that the devices only connect to trusted, password-protected Wi-Fi networks. If connecting to an open Wi-Fi network (which should generally be avoided), you should always use a trusted VPN.
-
Set a PIN or passphrase to access any mobile device you have and switch it off (not put it to sleep) when you are not using it. Also, keep the device with you whenever possible and lock it in the hotel safe when you cannot take it with you. Please note that hotel staff could have a way of opening their safes: if you can, never leave your device unattended.
-
Disable location services.
-
Install Chrome and addons for secure browsing.
[[ Suggest the client to review their security hygiene, based on Article #212: Safe Browsing Practices and Plugins. ]]
-
[[ If the client requires access to a video chatting service, which will probably not work anyway due to the restrictions China imposes on traffic from outside the country ]] For video chat, you can bookmark Calyx’s Jitsi Meet server.
-
[[ If the client requires access to encrypted email while traveling ]] Install Thunderbird with Enigmail with a temporary email account created for this case. If using a Chromebook, Mailvelope should be installed instead.
9.1. Generate a PGP key pair for the new email account. [[ We can link this guide for Windows, Mac, or Linux. ]]
-
Install and set up end-to-end encrypted messaging tools such as Signal, Wire, etc.
[[ Telegram is very popular in China, but apparently, as of November 2017, it is being blocked, as is WhatsApp ]].
Please, feel free to get in touch with us if you have any doubts or questions on how to implement the above points.
Best regards,