OpenDNS can be over-ridden.

[g_thomas]

Having used OpenDNS for quite sometime I am a bit frustrated at the lack of front-end security. We use all MAC's from Snow Leopards to a new OS X Yosemite. My 15 year-old son is able to easily by-pass OpenDNS by simply clicking the "Forgot Password" link. Then he enters my email address and bingo, click the link in the email and change the password and he in. GREAT! Those familiar with MAC's know that passwords are stored in the KeyChain. I've removed the saved OpenDNS password key from the chain but that doesn't help either. Once he logs-in with the new password MAC's give you the option to save the password in the KeyChain. Or more clever still he can simply write down his new password and elect not to save it in KeyChain and nothing is changed. I've tried several work-arounds but he beats everyone of them. I still believe that OpenDNS is the best technology available but this is really frustrating. Maybe I should just lock-up all my computers. But then he's use his iPhone and hack it through there. Any suggestions? :-(

[samsyst]

I don't understand. Your son has access to your email? Would that be a problem in itself?

[mattwilson9090]

Yes, one suggestion. Change your email password so that your son doesn't have access to your email.

I have no idea what workarounds you have tried, but OpenDNS dashboard is no more or less secure than any website that relies upon a username and password to log in to the site.

OpenDNS is using an industry standard method of recovering from forgotten passwords that relies on email. Although it's an imperfect system wherever it's used, it loses all value if people have access to the email account where the password reset messages are sent. With your son knowing having access to your email you are effectively leaving the key in the lock that it is supposed to be protecting. Remove the access to the email and he loses the key that is necessary for him to do this.

[g_thomas]

Hi Matt,

Yup! My son has my email address of course. But after giving it some additional thought I believe I've finally hit on it. I will create a gmail account and then change my email address in OpenDNS. My son will never know that I have a gmail account so when he tries to retrieve it the password it will fail since he will be entering my regular email address. On my MAC I will simply delete the login info from the KeyChain. Duh! I don't know why I didn't think of that before. Thanks for your feedback.

Cheers!

[rotblitz]

"My son has my email address of course."

Why "of course"?  E-mail accounts should never ever be shared.  This is one of the most worst habits I know, beggaring all descriptions regarding security.

[g_thomas]

This does not make any sense to me. My email address is on every computer in the house when I have messages coming in and out all the time. So tell me, how am I suppose to hide my email address on Safari mail? And no, I don't want a webmail based account except for the use as I described above since they're not secure. As far as the actual account is concerned that too is irrelevant. "This is one of the most worst habits I know...[sic]." Should I also then be concerned about hiding my email address from my wife. How do I do that since I'm in her address book? I'm sorry but your response is a bit illogical.

[rotblitz]

You misunderstood.  It's not about hiding your e-mail address, but it's about not sharing your e-mail account's password.  Then your e-mail account cannot be used by someone else, e.g. to retrieve credentials for other service like OpenDNS, your online banking, your social networking accounts, etc, or just someone else to read your e-mail or to send messages from your e-mail address making people believe that it's you.

[g_thomas]

Fair enough mate, I misunderstood. However, OpenDNS has nothing to do with sharing my e-mail accounts' password; they are two different entities. One for e-mail and a different one for OpenDNS. In OpenDNS' login page it states: "Forgot Your Password." All one has to do is click the link put in my email address and an e-mail will be sent with a link to change the password. Once that's done, bingo, you're in. Does that make sense or am I still missing something here. Incidentally, I refuse to have on-line banking accounts nor do I have any social media accounts. To me social media sites are nothing but time wasters. I for one have better things to do than sit in front of a tube all day "tweeting" or filling up a Facebook page with a lot of crap. Cheers!

[mneme]

yeah you are definitely missing something... the point is, your son should not be able to read your emails, then he wont be able to click the password recovery link in said email. You talk about how webmail isn't secure, yet it seems that anyone in your house has unregulated access to your email account. The fact that you seem to care so much about "security" then have literally the most insecure email system is mind boggling.

[g_thomas]

One app of which I wasn't aware was Sandbox. Each individual app can be inaccessible without using a special passcode. By the way, never begin a sentence with a lower case letter. "yeah"?? Nice.

[mneme]

I typed that on my phone, sorry for the typo. A sandbox app will not stop your son from accessing your email, thats not how they work or what they are for. The only way to stop him is to password protect your email. Also, why does he have your email on his iPhone?

The problem here has nothing to do with OpenDNS, allowing your son access to your email gives him access to EVERY single account you have on any website. 

[rotblitz]

"However, OpenDNS has nothing to do with sharing my e-mail accounts' password...  Does that make sense or am I still missing something here."

This is where you are so much in error.  Your e-mail account has everything to do with your OpenDNS account, because you linked your e-mail account wittingly to your OpenDNS account when you registered with OpenDNS.  Therefore the credentials for your e-mail account are far enough sufficient to also fully access your OpenDNS account with the same ease.

Btw, as mattwilson9090 already said, this is industry standard for single authentication and password reset purposes, no matter if you like it or not.

"Incidentally, I refuse to have on-line banking accounts nor do I have any social media accounts."

That's brilliant in your case, else everybody knowing your e-mail credentials would be able to manage your banking accounts or to thieve and abuse your social media identities...

[g_thomas]

To mneme: No need to apologise for the typo; I have an odd sense of humour. Yes, you are correct. My OpenDNS account has my e-mail address but isn't that a requirement? My son doesn't read my personal e-mail [there's nothing in it worth reading anyway] but he does have my e-mail address since it's in every e-mail I sent him. That's how he's able to access OpenDNS. In reviewing the comments in "MacRumour Forums" I find that there is no way to password protect an individual app. Incidentally, you're also correct about Sandbox.

To rotblitz: I believe when you refer to e-mail "account" you mean e-mail address which, of course, are two different things. The actual account having all the settings for that account which wouldn't be necessary to know for retrieving a password from OpenDNS; the only thing needed is the actual e-mail address. Making my system password protected won't make any difference either since he still has my e-mail address. So unless you mates can come-up with an alternative to this thieving little blighter, who wants to spend all his time watching porn, I guess I'm stuck. A damn good kick in his arse may be good for starters. Thoughts? ;)

[mneme]

You are confused about how password recovery works. When you click "Forgot Password" it asks for your email address, then sends a link to reset your password to your email account. Without access to your email account, there is no way to reset your password. So, what your son is doing is reading your personal email to access the reset link. There is no way of resetting your password by just knowing your email address, you need access to your email account to reset it.

[g_thomas]

Well, as much as I hate to muck about with it I'll just have to password protect my system. He will only be able to login as a "guest" in this case a term of derision given the present circumstances thus rendering him unable to accesses any of my personal apps. My admin account will of course will have a different password, i.e., long Welsh word which he'll never be able to figure out. Hopefully, that should solve the problem...hopefully. Thanks for all your time. Cheers!