Comments on: OpenDNS and Google a Phisher’s Delight?

By: Alan Pugh

Alan Pugh — Sun, 05 Aug 2007 02:18:31 +0000

Type google. Hit CTRL ENTER.

Nobody types the dot com these days.

By: Luke Hoersten

Luke Hoersten — Sat, 03 Feb 2007 06:52:52 +0000

Well put. I agree with that =)

By: Chris Meller

Chris Meller — Sat, 03 Feb 2007 05:46:22 +0000

Luke: You’re quite right about the spellchecking. I agree that OpenDNS has a lot of very useful features (generic domain spell checking, .om -> .com redirection, phishing protection, etc.). I am actually using OpenDNS here at home currently for several of those reasons, along with some others (I find their query stats interesting, and I typo .com more often than I’d like to admit). Primarily I enjoy using OpenDNS because it is faster and all-around more reliable than any other DNS I have access to (even though BellSouth does provide significantly higher-quality DNS than other ISPs), but those extra handful of features make it just a tad more enjoyable than before.

I still say we flog users for being that lazy! It’s like a whole new low in the laziness spectrum when you’re too lazy to add “.com” to the end of your URL and rely on Google to rank the site you’re actually looking for highly enough to be of use.

By: Luke Hoersten

Luke Hoersten — Fri, 02 Feb 2007 20:25:05 +0000

I understand that your taking the extreme stance on OpenDNS for the sake of the argument but I think you inadvertantly brought up a great point in favor of the OpenDNS “spellchecking.” You say “Stop allowing them to be lazy and utilize search engine results to get to their destination…” I know you don’t really think this will happen but you are just getting your point across but the point it brings up is that people are lazy. They are going to [mis]use a product the easiest way they know how.

People were already using their google search bars in the way that OpenDNS does “spellcheck” so opendns mind as well try to help. I actually think I read somewhere that OpenDNS actively tracks phishers and will “spellcheck” you away from them. My point is that if your going to have people using google as a keyword program you mind as well have it trickle through your DNS first so they can catch phishers.

In a perfect world, everyone knows how computers work and why they work the way they do so we wouldn’t have idiots using the “wrong” websites. =)

Great site btw!

By: Chris Meller

Chris Meller — Mon, 29 Jan 2007 20:41:08 +0000

David: Thanks for commenting!

There’s certainly a very high level of trust both companies maintain in the overall populace. Unfortunately, no system is foolproof. No matter how much effort Google may put in to policing its search results, we all know there are people out there capable of gaming the system to gain an advantage. Certainly I wouldn’t expect a situation like I mention to be a long-standing problem, but it could potentially be problematic enough to be of concern.

OpenDNS’s integration with PhishTank goes a long way towards helping prevent these problems for its customers (assuming, of course, that the same tainting of the data set isn’t accomplished with PhishTank as well, which seems highly unlikely). Of course this does require that everyone use OpenDNS. I’m sure you’d love it if everyone in the world were using OpenDNS, but that’s obviously never going to be a reality, so we’re left with the same problem for the rest of the internet populace that’s still relying upon “unshielded” (as it were) Google (and other engines’) search results to locate every-day sites like MySpace, eBay, and FaceBook.

I doubt there will ever be one true solution to the problem. In the meantime, I think users should be encouraged to use search engines in the manner in which they were originally intended - to help you find obscure pieces of data. They were never intended to replace the manually-typed URL, and I think adopting such a policy in common practice is only asking for trouble, particularly since it saves you so little time and effort.

Again, thanks for commenting David! I may not regularly use OpenDNS, but I love the idea (and PhishTank too), and couldn’t live without EveryDNS!

By: David Ulevitch

David Ulevitch — Mon, 29 Jan 2007 20:15:38 +0000

I think there’s a lot of truth in what you write and a lot that folks like us at OpenDNS can do to prevent this from occurring. There is already an implicit level of trust folks like Google and OpenDNS have and we work hard to earn and maintain that trust. Things like this are of the utmost concern to me and I’m definitely open to a discussion of what we can do with more intelligence in the DNS and on the network to remedy these kinds of hypothetical situations.