Hanno's blog

I've written in the past about the EFF SSL Observatory. It's a great project that has scanned the whole IP space for SSL-certificates used in HTTPS. They provide a database with meta information and their project found a couple of issues where CAs have issued certificates with weak security settings and violation of their own policies. CAcert is a project which tries to be the "better SSL authority" - it issues certificates for free, based on a web-of-trust community. The CAcert root certificate is not part of any major web browser. The EFF has mainly analyzed the browser-accepted CAs - but they provide the data, so I could do it myself.

I did some checks on the all_certs table selecting the certificates from cacert. I found out that there were 143 valid certificates with 512 bit. That is completely insecure and breakable by a home computer today. I also found that the majority of certificates still has 1024 bit, which by today's standards should be considered harmful - there have been no public breaks yet, but it's expected that it's possible to build an RSA-1024 cracker for an attacker with enough money.

I did the following query on the database:
SELECT RSA_Modulus_Bits, count(*) FROM all_certs WHERE `Validity:Not After datetime` > '2010-03-08' AND ( `Issuer` like '%CAcert.org%' OR `Issuer` like '%cacert.org') GROUP BY `RSA_Modulus_Bits` ORDER BY count(*);

+------------------+----------+
| RSA_Modulus_Bits | count(*) |
+------------------+----------+
[...]
| 512              |      143 |
| 4096             |      632 |
| 2048             |     3716 |
| 1024             |     5790 |
+------------------+----------+

Now, what further checks can we do? I checked for the RSA exponent. I found two certificates in the database with exponent 3. RSA with low exponent is also considered insecure, although one has to state that this is not a serious issue. RSA with low exponents is not insecure by itself, but it can create vulnerabilities in combination with other issues (if you're interested in details, read my diploma thesis).

I have not checked the CAcert database for the Debian SSL vulnerability, as that would've been non-trivial. There were scripts shipped with the SSL Observatory data, but I found them not easy to use, so I skipped that part.

My suggestions to cacert were to revoke all certificates with serious issues (like the 512 bit certificates). Also, I suggested that new certificates with insecure settings like RSA below 2048 bits or a low exponent should not be allowed. CAcert did most of this. By now, all 512 bit certificates should be revoked and it is impossible to create new ones below 1024 bit or with low exponents. It is however still possible to create 1024 bit certificates, which is due to a limitation in the client certificate creation script for the Internet Explorer. They say they're working on this and plan to prevent 1024 bit certificates in the future. They also told me that they've checked for the Debian SSL bug.

I've reported the issue on the 11th March and got a reply on the same day - that's pretty okay, one slight thing still: There was no security contact with a PGP key listed on the webpage (but I got a PGP-encrypted contact once I asked for it). That's not good, I expect especially from a security project that I can contact them for security issues with encrypted mail. One can also argue if four months is a bit long to fix such an issue, but as it was far away from being trivial, this can be apologized.

I'd say that I'm quite satisfied with the reactions of CAcert. I always got fast replies to questions I had and the issues were resolved in a proper way. I have other points of criticism on the security of CAcert, the issue that bothers me most is that they still use SHA-1 and refuse to switch to a more secure hashing algorithm like SHA-512, although all major browsers have support for this since a long time.

I want to encourage others to do further tests on CAcert. I'd like to see CAcert being an authority that does better than the commercial ones. The database from the observatory is a treasure and should be used by projects like CAcert to improve their security.

When thinking about China, probably many people associate this with censorship.

On my trip, I had the chance to see the infamous great firewall from the inside. I haven't done any deeper analysis, but I'll share some thinkgs I've observed. A couple of famous sites (for example Twitter, Flickr) are blocked. Contrary to what many people may believe, webpages that are often associated with Warez (Rapidshare, Pirate Bay) were also blocked. The situation with Wikipedia was mixed. Most of the time, I could read the texts on Wikipedia, but access to the image servers was blocked. At the end of our trip, I couldn't access Wikipedia any more.

I encountered no blocks on less famous sites, although I regularly surf sites that could be labelled politically controversial. Though this probably doesn't tell much, except that the chinese authorities are not very interested in blocking european websites.

Interesting may be that the blocking works on an IP level. DNS resolution of blocked sites still works, but you cannot ping the IPs. I haven't extensively tried to circumvent the censorship, as I had no pressing need for it. The only thing I tried was an SSH tunnel, but that usually wasn't possible as the connection never was fast and reliable enough for a stable SSH session.

Most Hotels and Hostels provide Internet access - but most of them by cable. Usually, in other countries today this is done via wireless lan. My theory on that is that a cable-based Internet access makes it easier to log activity associated to a specific person (you always have to show your passport when you check into a Hotel). But still, we had anonymous Internet access (both wireless and cable) at a few places.

Another thing I'd like to mention is what the (non-technical) censorship did with me. I knew that in China people cannot just write a blog, they need some kind of license for it. I was very unsure what this means for me as a forein traveller. I came to the conclusion that I likely won't get any trouble if I just write about my trip without touching any controversial topics. Although I hadn't planned to write anything, this was always in my mind and probably influenced my writings. There was one time where I self-censored myself. In the entry about Hong Kong, I originally had this part, which I removed before publishing:

Most notably it is a place where free speech is possible to a much higher degree than in mainland China. This makes it a very important place for political discussion about China in general. We saw chinese dissident groups that had their information tables and spread leaflets around the Kowloon harbour.

Not much and I luckily have the opportunity to publish it now.

Recently, a new X-Men movie made it to the cinemas. I quite liked the first three X-Men movies. I wasn't very impressed by the prequel-movie Wolverine, which tells the story of one of the characters.

Now there's X-Men first class. Again a prequel, but from a different perspective. Wolverine only has a very short cameo appearance, this time the movie telling the story of many other X-Men characters. Prequels are difficult. They must tell a story that already has some fixed points and a fixed outcome that's already known my most viewers. The new X-Men film suffers exactly from that problems.

The movie does a very brave task - it tries not only to tell a prequel story to the other movies, it also involves a whole bunch of historic events. From the nazi concentration camps to nuclear weapons and the cuba crisis. This sounds like too much for a science fiction movie, but surprisingly it handles this part not so bad. It even motivated me to improve my history knowledge and read something about Argentinia's role in hiding nazis after the second world war (some german information here). It seems the movie is pretty close to real history in that respect.

But there's another problem in this movie. I found the main plot just doesn't fit. And that's due to the fact its a prequel where the outcome is already decided:

(please stop reading here if you haven't seen the movie and still want to see it - spoilers ahead)

The development of the charakter Erik Lensherr alias Magneto. As the victim of some cruel experiments by a mad Nazi scientist, his life is one of anger and revenge. But his opponent - and all viewers of the other X-Men movies already know that - has a role which is exactly what Magneto's role will be later. So in the end, he kills him - and then just replaces him. All allies of his biggest enemy just become allies of him. That just doesn't make sense.

(now you can read again)

All in all, it's still a pretty good movie. If you like such movies, it has its moments. But the in my opinion illogical story destroys a lot.

Final word: We had two X-Men prequels now. But X-Men 3 ended with a perfect cliffhanger. It should be resolved at some point - I'd like to see X-Men 4.

I have promised to write something about the route we had planned to take for the way back from China to Europe. We had several variants in mind, I'll list them all. All of them, however, have in common that they start in Ürümqi (乌鲁木齐, ئۈرۈمچی) - and as I already wrote, the train line to Ürümqi seems to be a bottleneck - it was booked out for an unknown amount of time.

Ürümqi is a town in the Uyghur province of China in the north-west. It is north of the Taklamakan desert. China's population is not evenly spread through the country. Most of the population lives in the eastern part. The west is sparsely populated and Ürümqi is one of the very few big cities in the west.

From Ürümqi, there are several options to go to Kazakhstan - there exist trains and busses both to Astana (Астана, أستانا), the current capital of Kazakhstan, and Almaty (Алматы, الماتى), the former capital.

Variant a: Twice through russia (our preferred option).

From Astana, there is a train directly to Kiev (Київ) in Ukraine. The train goes twice through russia. Once it scratches it before Oral / Uralsk (Орал). I think it doesn't even stop there. The other time it goes through the Caucasus region.

It should've been possible to buy the train ticket in Astana and then get a transit express visa in the russian consulate. I read some reports suggesting that EU people were able to do this. However, I was not entirely sure about that: Usually, a russian transit visa only allows to pass the country a single time. I don't know if crossing the country twice would've posed any problems.

Astana to Kiev is quite long - stopping was a problem, because you can only get the transit visa once you have the ticket for the whole journey. So our plan was to take the train just to Kharkiv (Харків) in the east of Ukraine. This would've limited the train trip to a bit more than two days. Still a lot, but acceptable for me.

Variant b: Once through russia.

Oral/Uralsk (Орал) in western Kazakhstan has its own russian embassy. As stated above, the train from Astana to Oral already crosses russia, but there's a way round: One can first take the train to Atyrau (Атырау) and then to Oral. This way, you don't leave Kazakhstan. The advantage: Lots of options to make stops, no overly long train trips.

The problem with this variant was that I had almost no information about the consulate in Oral: I haven't read a single report online that any EU citizen tried or successfully applied for a transit visa there. I only found some people asking that question, but without answers. So it was quite unsure if this would work.

Variant c: Avoiding russia altogether (option we originally intended to take).

It is also possible to avoid passing russia altogether. One can go by train to Atyrau (like in variant b), but then take a train on to Aktau (Ақтау) at the caspian see. From Aktau, there is a ferry service to Baku in Azerbaijan.

Now, this "ferry" has its own problems: It has no regular schedule. In fact, from what I read its no real ferry at all, but a cargo ship. It starts when there's enough cargo. So you have to get there and ask every day if there will be a ship today. Waiting times rank between some days and two weeks. I had liked to take that option, because I like travelling by ship and I thought that sounded like an interesting experience.

From Azerbaijan, one could take a train to Tbilis in Georgia and continue by bus to Istanbul in Turkey. From there, there is a train to Austria (the orient express sadly doesn't exist any more).

We had our visas ready for Kazakhstan and Azerbaijan. Georgia and Turkey are visa free for EU citizens.

If you look at a map, you may notice that there's another option: Going from Kazakhstan to Turkmenistan and Iran. However, that would've imposed getting two more visa plus the feeling that travelling through Iran might be a risk. So I haven't really investigated that option very much.

For our trip, we needed a couple of visa. I haven't applied myself for a visa any time before, so this was quite new to me. This was the most troublesome part of our travel preparations.

What I learned about getting visa:
- Every country has different rules for visa.
- You cannot apply for several visa at once - they take your passport. That means you have to add all the waiting times and cannot apply for more than one at once (this may seem trivial if you know the procedure, but I didn't).
- The information on the consulates webpages is often incomplete or inaccurate. (For example, if you have a 30 day visa: Does that mean 30 days starting from your entry to the country? Or 30 days starting from a fixed date you have to know in advance? Pretty relevant if you plan your trip.)
- If you phone a consulate, they won't answer. If you email a consulate, they won't answer.
- You cannot expect that anyone in the consulate is able to speak to you in a language you understand.
- You cannot expect that information you got from people in the consulate is correct.
- Usually, the best way to get information is searching the internet for people who have done the same thing before. There are specialized companies that arrange your visa, but the information you get from them is also often inaccurate.

In the end, we applied for 6 different visa (Russia, Mongolia, Belarus, China, Kazakhstan, Azerbaijan), although we didn't use them all in the end (see previous blog entry).
The most difficult part was the russian one. That was, in the end, the reason we couldn't make the trip the way we wanted to (taking the transsiberian train for both directions with stops). They have a kind of bizzare regulation regarding invitations: You need an invitation to apply for a russian tourist visa. This has evolved a market for agencies that arrange invitations. That means you pay them that they do a fake booking in a hotel you will never see in reality and get an invitation from them.
Another anecdote: When asking for the "two-way"-problem in the embassy, they gave us a contact to a travel agency that will help us. This travel agency suggested we could get two passports and thus apply for two visa - that would've been illegal according to russian law. I had no intention in seeing a russian jail from inside, so I refused to choose that option.

You see, it's a pretty complex issue. But there's one thing one should mention, too: It's not the russian (or other countries) authorities that are to blame here. Russia is very willing to relax its visa rules. They even suggested several times to abbadon the visa requirement for EU citizens at all. They just have one requirement: The regulation should be relaxed for their citizens, too. Everything I've heared suggests that russians trying to get a visa for Germany and other EU countries face more difficulties than the other way round. It's the EU that is blocking here.

If you want visa regulations to be relaxed, you'd better not only blame other countries regulations. You should also ask how regulation is the other way round. Looking at the current political debate in the EU, I don't have much hope that the situation will improve soon.

(the pictures are from Wikimedia Commons here (Russia) and here (Belarus) and are public domain)

My Asia trip is over. I'll try to sum up some experiences I made.

In the end, we couldn't do a lot of things we had planned to do, especially for the China part of our trip. Due to a number of reasons, our approximate time plan completely didn't work. Sometimes this was due to a lack of information (e. g. not finding a ferry / a bus we've read about) and communication possibilities. A surprising problem was also the lack of internet information: It seems having a webpage is far less common in China, many transport operators, hotels or other venues had no internet presence at all, not even a chinese one.
Very time consuming were unplanned stops due to simple health problems like a cold.

I think I wrote that some times before, but I had never expected the difficulties with the language. The idea that English is some kind of "international communication language" is not very common in Russia and China - I think we stayed in a couple of cities where we didn't meet a single person we could talk to. I felt this was a great limitation for my possibilities to get to know those countries better.

Another unexpected difficulty was getting any medicine. I had thought that in any country in the world you should be able to get some equivalent medicine if you show the pharmacy personal the scientific name of the ingredient. This worked in Russia, but it didn't work in China - and I tried a lot of pharmacies. I suggest if you ever go to China, take everything you usually use to handle small issues like a cold or a headacke in large enough quantities.

In the preparation phase of the trip, I was often warned of safety issues like pickpocketing. This was almost a non-issue. Nothing was stolen from me and I don't remember even an attempt to do so, although we visited places like the Naran Tuul market in Ulaanbaatar, where everyone will tell you that pickpocketing is a big issue. I don't know if I was just lucky, but I had the feeling that using common sense and always looking after your belongings is enough to handle this.

I haven't stepped into an airplane for about 12 years. I travelled a lot through Europe with ferries, trains, busses and hitchhiking. It was my plan to stick to that on this big trip.

It's a simple fact that there is no viable option to use airplanes on a regular basis in a responsible way. There is no thinkable way that all humans on this planet can have access to planes. It only works because it's a privilege of a rich minority. And there's no thinkable way of combating climate change with the current growth rate of the aviation industry - not to mention the dangers of Peak Oil and unconventional oil extraction.

Some environmentalists who like flying found a very creative way to circumwent this: Compensating emissions. You pay an amount of money that's invested in some climate project for every flight you do. If I had to name the three most ridiculous actions people invented in combating climate change, compensating flight emissions would certainly rank amongst them (for the other two I'd vote carrot mobs and lights off actions). As above, this only works for a very small minority of rich people.

Ok, so back to our trip. It was my plan to avoid flying. I wanted to proove myself and others that it's possible. I failed. I took a plane from Beijing back to Germany. For a relatively trivial reason: Our plan was to take a train to Urumqi, then go to Kazakhstan and then we had two options, one with a train through russia to Ukraine and one through the caspian see to Azerbaijan (I will describe those in detail in a later blog entry). All of them requried getting to Urumqi first. There's no alternative route with public transport. And here's the problem: All tickets to Urumqi were sold out - for the whole time they can be booked in advance. So we wouldn't get tickets for an unknown amount of time.

I the end, after checking all alternative options I could think of, I decided to take a plane back to Germany and shorten my trip. I wasn't that unhappy about it after all, because I experienced our trip much more exhausting than imagined.

There would've been one other option: Taking the transsiberian train back. But that imposes another difficulty that has to do with russias visa regulation. A russian tourist visa is valid for 30 days. So ours is expired. It is not possible to get two visa at the same time, so it was not possible to arrange this in advance (it was our original plan to go back through Russia). And it is not possible to get a russian tourist visa anywhere else than in your home country. It used to be possible in Hong Kong in the past, but recently russia has tightened its visa regulations and according to several online sources this is no longer the case. The only option is getting a Russian transit visa. But that means you have to do the whole trip in a row and have all the tickets to Moscow and further to another country ready beforehand. This means several days in a train without much possibility to pause. I decided that I'm not up for that. I already found the many long train trips we did very difficult, partly because I'm slightly claustrophobic. My girlfriend will do the train trip - I won't. If you are ever in the same situation and need a travel agency, I can suggest Monkey Shrine - they are quite expensive, but their service was excellent. They were able to arrange all tickets including ones from Moscow to Kiev or Tallin and offered a lot of different options for all parts of the trip.

Now I don't think that my single flight will change much. It was a symbolic thing. But I think that opening options for flightless travelling is essential and gets far too less attention. If people talk about environmental or sustainable tourism, the issue of aviation is rarely spoken about. Often enough the problem is just that it is never considered. Take the visa regulation: If you enter and leave a country with an airplane, you usually don't need any visa - even if you change the plane within the country. There's no comparable rule for trains. You even need a visa if you enter and leave a country in a train without a stop. If you're looking for organized transsiberian railway trips, almost all the time it's taking the train for one direction and the plane for the other. Different public transport options often don't fit very well together. I always illustrate this with an experience I had last year when I switched from the train in Zeebrugge in Belgium to the ferry to Edinburgh - there was not any proper footpath from the train to the ferry, although they were only some dozent meters apart. You had to either illegally cross the railway lines or walk on a big street without a footway. I think many missing links for travel options could be closed if there would be more people doing it (e. g. there is no ferry from Singapoure or other Asian countries to Australia and none between Russia and Alaska, although the way isn't that far).
These are just some unfinished thoughts, but I could imagine there is a need for a lobby for flightless travelling. There's much more one could write about it. Flightless travelling means slower travelling - which brings up a discussion about our relation to working time.

If you're interested in flightless travelling, the best online ressource I found is the great webpage seat61.

My trip ends here, but some more blog entries will follow with stuff I didn't find the time yet to write down.

Maybe you've heared that some years ago, a story about a fake Disneyland amusement park in China made some rumors in the media. As I love good fakes, I obviously had to take a look. The amusement park in question is Shijingshan Amusement Park ( 北京石景山游乐园) and is located in Beijing. It can easily be reached, as it has its own metro station.

The park had the advertisement slogan "Disneyland is too far to go" some years ago and some images of Mickey Mouse and other Disney figures in the park boosted the story (see Wikipedia for details). Also, like all Disneylands, the Park has a Cinderella castle. It seems in the meantime things have changed - we didn't see any Disney charakters there. The only thing that still reminds of the story is the Cinderella castle - but as much as Disneys lawyers might want this, Cinderella is not a Disney invention after all.
I even found a fake Mickey Mouse (at least I think it was fake, it looked somehow wrong) in Beijing, but it was not in the amusement park, it was in the olympic village.

The story of a fake Disneyland seems highly exaggerated. The Cinderella is probably no issue at all, as I doubt there's anything that makes it a special "Disney-Cinderella". I'm not sure if there was a copyright violation at all: The fake Mickey Mouse and other figures in combination with the solgan could probably be considered parody - which is legally allowed in most of the world's copyright laws.

The park itself was kind of weird. Large parts of it were in really bad shape. Some looked like a construction site, many parts were not operational. On the other hand, other parts of it were really well-designed. One could hardly imagine that this was the same park.

A nice thing to mention: They had a dance dance revolution like arcade machine - but the game on it was StepMania - a free software game. I think this is the first time I saw a free software game in an arcade machine.

Unlike most european amusement parks, the pricing concept here is different - the entrance fee costs almost nothing (10 Yuan, approximately 1 €), but you pay for every ride.

Pictures from the park

After Hong Kong, we left the south of China and went on to the capital Beijing (北京). The first days we stayed at a very helpful couchsurfer, later we switched to a Hostel again. That was kind of difficult. In China, not all Hotels are allowed to take foreigners - they need a special license for that. We knew that before, but we never found it to be a problem - at all other places we never went into a Hotel that rejected us. My impression is this rule is only enforced in the capital. Many Hotels are booked out at the moment and we had an unplesant experience with the Drum Tower Hostel: We got a confirmation per email the day before that they have a free room for us. When we got there, there was no free room. When we showed them the email, one of the Hostel's staff laughed at us. We didn't find this very funny.

We were in Beijing during the birthday of the chinese communist party (CCP). We didn't notice that much of it, except a big monument on Tian'anmen square (天安门广场).

We had some trouble with our next travelling steps, which I'll write up in detail in one of the next blog entries.

Pictures from Beijing

After staying on Hainan island, we went on to Hong Kong (香港). The main reason for that was a visa issue. A chinese tourist visa usually allows a stay for 30 days and we were nearing that 30 day periode. However, we had a double-entry visa which is valid for two entries with 30 days each. It would have been possible to request an extension of the stay for more than 30 days, but that would've taken several days we had to stay at the same place. So it was easier to just leave the country and come back at some point.

Although Hong Kong is officially part of China, it has its own migration and border system, its own currency (the Hong Kong Dollar) and going to Hong Kong from China is like going to another country. Hong Kong itself requires no visa for EU citizens for up to 90 days.

It was terribly difficult to get any accomodation. All Hotels we found were far beyond what we were willing to pay. In the end, for the first night we payed 350 HK$ (around 30 €) for a room without a window in a small hostel. The hostel was located in a big building called Mirador Mansion near Tsim Sha Tsui (尖沙咀) station which was full of mini-hostels, most of them only with a couple of rooms. However, most of them were booked out. Luckily, for the next day we found a room in the same building for 300 HK$ which was much better and had a window (where we could see the swimming pool on top of the next building, part of the Holiday Inn hotel, which was one of those we found far too expensive).

In general I can say that although Hong Kong is somehow part of China, many things there are completely different. It feels much more like a western city. It has a lot of foreigners, many of them from India - which was good for us, because we could easily get vegetarian food in Indian restaurants. Also noteworthy is that English is the official second language in Hong Kong, so communication was much easier.

Hong Kong pictures (as always, not uploaded yet)

Being a vegetarian was a special challenge on our trip. It was difficult in Russia, where the food plan often enough was reduced to pizza margherita and pancakes. It was even more difficult in China, where the idea of having any food without meat seems to be widely unknown and the choice was often enough reduced to french fries from american fast food companies.

But there was also a surprise: It was absolutely no problem in Mongolia - in sharp contrast to everything I've read before. Traditional mongolian food is very meat-oriented. But Ulaanbaatar has a density of vegetarian and vegan restaurants definitely higher than in Berlin. And even the little border town Zaamin-Üüd has a vegetarian café. Unlike one may expect, I never had the impression that they were primarily focussed to tourists. We even once were in a vegetarian restaurant in Ulaanbaatar that had only a mongolian menu without any english translation.

Most of those restaurants seem to be somewhat related to the "spiritual leader" Supreme Master Ching Hai. I don't know that much about her and her group, so I can't judge how problematic I find that (though I'm always sceptical both about leaders and about esoteric groups). Their arguments for veganism are mainly about the greenhouse gas emissions and climate change effects from meat productions, which is absolutely correct, but sadly their stated numbers are just wrong.

Hainan (海南) Island is the southmost point of China and has a tropical climate. It has some tourist-oriented cities with beaches and many coconut trees. We stayed some days in Haikou (海口) and Sanya (三亚).

Hainan also has some of China's rainforests. We made a trip to Yanoda rainforest park (呀诺达雨林). It was quite interesting, though somewhat unexpected: The trips to this rainforest are very organized - you never walk really in the forest, only on prepared wood-ways and the whole thing is more park-like and you're guided through it.

As I already wrote, we didn't manage to take the ferry and got to Haikou (and later to Sanya) by train - however, there is no bridge, so the train is put on a ship. Sadly, it wasn't possible to leave the train during that time. On our way back, it was somewhat difficult to get a ticket, as we left on the day after the typhoon - and all the people who planned to leave the day before either on the ferry or on a train also tried to get tickets so we had to queue for four hours.

Pictures from Hainan island
Pictures from Yanoda rainforest

While going on to the south of China, we had a short stop in Guangzhou (广州). It is the third largest city in the country and the center of the cantonese part of China. At this time of the year, the climate in Guangzhou is very extreme, which we suddenly experienced when we left the train: Very hot and very humid.

Our original plan was to take the ferry to Haikou (海口) on Hainan (海南) island, but that failed because we were unable to find the ferry. First a taxi driver told us that the ferry doesn't exist at all. We then tried to find it at Huangpu port like it's statet on various internet pages, but there was no ferry and nobody could tell us anything useful about it. The information about Huangpu port you can find online (both place and days/times) is probably outdated. Although we didn't take the ferry at the end, if you find this information helpful to my best knowledge this should be correct (information from Haikou port and tourist information):
Haikou (海口) Xiuying (秀英港) port to Guangzhou Shazaidao port - starting from 2nd of every month every three days, 14:00
Guangzhou Shazaidao port to Haikou (海口) Xiuying (秀英港) port - starting from 3rd of every month every three days, 16:00
Price per person: ¥ 130 / ¥ 180 / ¥ 220 / ¥ 260 / ¥ 300 / ¥ 450 (room with more than 16 / 8-16 / 8 / 4 / 2 / 2 beds). Trip takes approximately 19 hours.

We also didn't take the ferry for our way back, as I already wrote, a typhoon stopped us from doing so.

On our unplanned one day stop in Guangzhou, we visited the Yuexi park (越秀公园). It is the largest urban park in China and it was a nice opportunity to see the tropical plant life in that area.

Guangzhou pictures (not many)
Guangzhou Yuexi park pictures