Dangerous default re rDNS

[Estragon]

I have always known that any site I visit can see my IP address. But I was genuinely appalled a few minutes ago to discover that if they do a Reverse DNS check on that address, it reveals my account username.
As suggested by Oldjim in reply to this post I have raised a ticket to stop this.
Surely the default should be not to reveal this? There are only two things preventing a hack, the username and the password, and revealing the first severely compromises the customer's security.
_{Edit - typo.}

[AndyH]

Same here...didn't realise that! But I think it's automated when I requested a static IP.

[Gus]

raise a ticket and request a rdns change, you can choose what you want within reason or just have it show your IP address

[itsme]

Don't you give away your username if you use your PN email address?

[Estragon]

I don't even know my Plusnet email address  :P.

[Gus]

anything@username.plus.com

[Estragon]

A good reason not to use it then.

[Oldjim]

Spotted at TBB - this is the relevant page for requesting a change https://www.plus.net/wizard/?p=wizard&page=22425&wizard_id=38

[Estragon]

Yes, I saw that as well Jim, and your post saying you had posted it here.
But none of this addresses the basic issue. The default should be to the IP address alone, not the account username. It is simply incomprehensible and very insecure for it to be as it is, without even a warning at request time through the Member Centre.

[adamwalker]

I understand your concern, however nothing at all can be done with a username without its accompanying password. I'm not saying that as an excuse more to belay any belief that it could be seen as a security breach.

[Bright]

The security of my Plusnet account is protected by two text strings. One is called "username" and the other is called "password". Anyone who knows both can access my account.
With the current default for rDNS on fixed IPs, I potentially reveal my username to every site I visit on the internet. By definition, that therefore reduces the security of my account, although it doesn't breach it. My account is still protected by the complexity of the password I have chosen. Given what we now know about the poor password practices employed by MOST internet users (who are all human, after all), the revelation of the username is significant. It would be good security practice to eliminate this issue.

[orbrey]

See what you're saying, but this only happens with static IPs which wouldn't really be used by less IT literate people?
Just playing devil's advocate rather than trying to say the idea's without merit, we'll make sure it's passed on.

[Estragon]

Quote from: Matt

... but this only happens with static IPs which wouldn't really be used by less IT literate people?.

Even then, IT literate people are unlikely to have a 64-character alphanumeric plus special character password  ;). Several may also ask for a static IP address just so they can run the TBB BQM, (which is my only need for one), without really being particularly savvy.
How many password attempts are allowed before the system locks the account access please Matt?

[orbrey]

Sorry for the delay in response. I believe it's ten, and then all attempts are blocked and our networks security team are notified directly.

[gordonsuk]

Not wanting to hijack the thread, but I thought this was relevant.
Just had reply to a ticket asking for a change to rDNS, have been told that it does not resolve to the ip. However on checking via several sites they all show it resolves to the correct static ip. Come on Plusnet get it right!!!