Easy. No need to install software or do anything different than anybody does now, except have to worry about 4 dns addresses instead of 2.

The “gift of safe”? More like the “gift of pseudo-random”.

I’m glad that I’m not the only person who is concerned about this. I first looked to OpenDNS as a way to use a more reliable DNS service since my ISP DNS servers are always going down. When I tried to register my IP address I got the message “Network already registered” which means that someone already registered this dynamic IP address even though I am the one that owns it now. It immediately got me thinking “So someone is possibly tracking me?”.

My concern is over privacy in that if someone else tracks the stats, they can easily begin to see what sites I am visiting and build a profile on my IP address and identity. For example, they can see what bank I use, what company I work for (while checking my email) etc. etc and start to build a profile on an IP address.

Thanks for your comment.

I do wonder when you say “not happened very often”. Is this statement based on user complaints (which we would expect to be minimal) or internal data that show that different accounts have rarely shared IP addresses? Either way, this doesn’t begin to deal with the issue of the user who just uses your servers nor how visible you make this issue to prospective users.

Knowing when IPs are dynamic can mitigate this issue, but without a warning like the one I proposed, I don’t think you are being clear enough to your users. Even with a warning, the user who just uses your servers is counting on your extended services users to update IPs correctly. This is why I suggested the two server pairs.

Statistics being off by default is neither here nor there, it only reduces the likelyhood that it doesn’t happen. That doesn’t make the service more secure or “private”.

Regarding stonewalling, it was not just your response in the forums, but also my collective experience at the OpenDNS that makes me feel this is being swept under the rug. For example, why doesn’t your privacy policy point out the vulnerability?

Robert

Here’s the situation:
1. It can happen as you describe.
2. It has not happened very often.
3. As OpenDNS grows, we can expect it to happen more often IF we don’t do anything. So… we’re doing several things.

I don’t like to talk about stuff we haven’t delivered yet (anti-vaporware), but here’s an example of one of those steps.

Many of the dynamic IP pools have been flagged as such in various ways. When you add a dynamic IP as an OpenDNS network, we’ll recognize that and give you next steps accordingly (checking the box for dynamic by default, lead you to the software downloads required, etc.).

You’re talking about a rare problem now, which we’re aware of, and which we’ll address before it becomes a real issue instead of a “what if” situation.

I’m glad you’re using our service, and I hope you’ll continue. And the feedback is helpful, even if we disagree about the scope of the problem.

Regarding privacy, I’d point out the OpenDNS privacy policy at http://www.opendns.com/privacy/ and underline that network statistics are OFF by default for anyone with an account and network.

John Roberts
OpenDNS