Security vulnerabilities found in China's nationwide installed filter software

James Fallows argued pretty persuasively that these sorts of things aren't actually relevant to the Chinese government's ability to accomplish effective censorship in his article about the Great Firewall: http://www.theatlantic.com/doc/200803/chinese-firewall

What the government cares about is making the quest for information just enough of a nuisance that people generally won’t bother. Most Chinese people, like most Americans, are interested mainly in their own country. All around them is more information about China and things Chinese than they could possibly take in. The newsstands are bulging with papers and countless glossy magazines. The bookstores are big, well stocked, and full of patrons, and so are the public libraries. Video stores, with pirated versions of anything. Lots of TV channels. And of course the Internet, where sites in Chinese and about China constantly proliferate. When this much is available inside the Great Firewall, why go to the expense and bother, or incur the possible risk, of trying to look outside?

The same points arguably hold for the Green Dam.

Edit: I guess I missed the point of the advisory (see comment below). I assumed they were discussing methods of circumventing the system, but after a second (more careful) reading, that's obviously not the biggest concern.

It's really a crappy situation: mandated software that's this broken. Either join a botnet or potentially raise the government's suspicions by uninstalling the software.

The legal consequences of this (in China) are frightening. Imagine a malicious site that uses this vulnerability to download child porn onto the target computer, and then reports the user to The Authorities. Many lives could easily be ruined, as I imagine China does not provide many rights for the accused. (This will probably get you into trouble in the US, too, which is why I make sure all my filesystems are encrypted.)

The encryption ensures that you avoid charges in the first place.

My imagined dialogue: "We're here to seize your hard drive to see if you are doing anything illegal." "OK." "Damn, it's encrypted, tell us your password." "I refuse to testify against myself." "Uh, you have to." "I forgot the password." "Fuck."

The fishing expedition then ends fairly quickly. (If you really are distributing child porn, though, they will probably get you some other way. This is exactly how the system should work.)

(You might want to have a "honeypot" that can be activated with a certain password so that you don't even have to claim you forgot the password. This could be helpful for avoiding "contempt of court". IMHO, this should not be necessary, but I Am Not The Supreme Court.)

Will be fascinating on how China's government responds to this. With any luck these findings will postpone this terrible idea... Or at least get some competent(security focused) people writing this application.

China has a court system and there are rights for the accused. Now, if your up against someone that has lots of power, its well understood the legal process can be bought to a certain extent. That said, there are quite a few cases in China where the "little guy" prevails in the courts.

The real issue is simply that this new system is not safe for many reasons, without regard to the situation suggested by the parent post.