topic Re: Reverse IP reveals username - a routine privacy violation and security risk in Everything else

Reverse IP reveals username - a routine privacy violation and security risk

SixCopperKs — Tue, 19 Apr 2022 12:07:59 GMT

Looks like this is a very old favourite. Each time it requires Plusnet intervention, and yet it keeps happening.

I noticed my IP address for at least 2-3 days, possibly weeks, has been revealing my Plusnet username.

My plusnet username is personally identifiable information — so it's protected under GDPR.

When I created a username, I never consented for Plusnet to put it on all my web browsing for every marketing organisation and advertiser to see.

For example: [ dig 1.128.229.80.in-addr.arpa ptr ] reveals my username.plus.com (no, that is not my current IP)

I don't have static IP. I haven't got weird firewall settings.

Plusnet has control over the registration of in-addr.arpa records, not me.

Even if I were to change my plusnet username so that it didn't include my real name, it still is an unchanging identifier which effectively deanonymises me and my family.

I see this applies to lots of other Plusnet customers — just from a quick random look.

Anyone got any suggestions, please?

Re: Reverse IP reveals username - a routine privacy violation and security risk

C1Rider — Tue, 19 Apr 2022 13:21:31 GMT

Plusnet can change your user name to your ip address if you ask them.

Regards..

Re: Reverse IP reveals username - a routine privacy violation and security risk

Baldrick1 — Tue, 19 Apr 2022 13:38:30 GMT

Moderators Note

This topic has been moved from Tech Help To Everything Else

Re: Reverse IP reveals username - a routine privacy violation and security risk

LaurenB — Tue, 19 Apr 2022 16:39:14 GMT

Hiya @SixCopperKs, thanks for getting in touch.

I'm sorry for the concern caused by your rDNS and would like to do what I can to help resolve your query

We can look to change your rDNS for you and I have created a ticket here: https://www.plus.net/wizard/?p=view_question&id=223739849 if you can please reply on the ticket with what you'd like it amended to (and give me a nudge on here once you've added your reply) I can get that raised to our Net Ops Team for you

Re: Reverse IP reveals username - a routine privacy violation and security risk

SixCopperKs — Wed, 20 Apr 2022 09:43:38 GMT

Thanks for the swift reply Lauren, I've replied to the ticket.

I remain concerned (for others) that the default is the username, but I'll follow that up later when I feel more sure.

Re: Reverse IP reveals username - a routine privacy violation and security risk

SixCopperKs — Wed, 20 Apr 2022 09:56:09 GMT

Thanks, @C1Rider , much appreciated.

As @LaurenB has raised a ticket for me now, I've responded to that.

My privacy concern is that there's no warning that the username you choose when you sign up will be the one attached to your PTR reverse-IP records. Handy for diagnosing email issues maybe, but worrying for advertising/tracking/profiling.

Other ISPs just throw their domestic customers into big pools of CG-NAT and the internet IP address seems to last for a matter of hours. A Plusnet IP address seems to last for far longer. (Five+ days since my last reboot…!)

If it wasn't for the lack of privacy, this might even be a sort-of dynamic DNS….

Re: Reverse IP reveals username - a routine privacy violation and security risk

LaurenB — Wed, 20 Apr 2022 12:52:44 GMT

Thank you for getting back to me.

I have now picked up the ticket and have got that raised for you The team will aim to get to the request as soon as they can, though we do advise to allow 3-5 working days.

Should you have any further queries, please do just get back to me.