Regarding Sense DNS settings

General Sense Discussion
1

I’m writing this on behalf of the team.

We wanted to update you on the resolution of some feedback we have received on a recent upgrade to the Sense monitor software.

This upgrade changed the way in which the Sense monitor resolved internet domain names (such as sense.com) into the IP addresses used for all internet communication. Every internet-connected computer has designated servers for converting names into IP addresses. These computers are called DNS servers. Without a functioning DNS server, the Sense monitor cannot operate.

The monitor software change was made to help Sense monitors operate on home networks without well-behaved DNS servers. Instead of trusting the DNS server provided by the user’s home network, which would typically be the internet service provider’s DNS server, the Sense monitor now sends its DNS requests to one of several well-known public DNS servers. It is our experience that these servers offer more dependable service than a home network’s DNS server. Additionally, misbehaving home DNS servers are usually beyond the technical ability of many home users to diagnose and fix.

However, we received feedback from some of our users that this change was undesirable, as they wanted a clear understanding of which third parties the Sense monitor was contacting, and what information was being shared with and retained by those third parties.

Our business depends on the trust of our users, and we hear and understand the concerns. This change to the list of DNS servers should have been included in the release notes for the monitor software update, but it was not. We will make sure to include any such changes in the release notes in the future.

The team at Sense has discussed at length how to proceed with preserving user privacy and transparency, as well as allowing the Sense monitor to function well in homes where the DNS server is absent or misbehaving.

We will take the following steps to address your feedback, while still giving new customers the best possible experience when installing their new Sense monitor.

  1. We will limit our public DNS server to only Cloudflare’s server, known as “1.1.1.1”. Of the public DNS providers we examined, they had the clearest and strongest privacy protections. Cloudflare does not keep records, sell data, or target ads. You can read more about 1.1.1.1’s privacy protections here: Privacy · Cloudflare 1.1.1.1 docs. Neither Google’s DNS server nor Oracle’s OpenDNS server will be used by the Sense monitor.

  2. For those customers who want to rely solely on their own network’s DNS server, we will offer an option to suppress the monitor’s use of 1.1.1.1. To enable this feature on your monitor, contact support@sense.com. This setting does not appear in the Sense app today, but it may in the future.

  3. On home networks where 1.1.1.1 is inaccessible, the Sense monitor will fall back to the DHCP-provided DNS server. Thus, if you wish to simply block access to 1.1.1.1 for all devices on your network, or for the Sense monitor explicitly, your monitor will continue to function using your DHCP-provided DNS server.

These changes will take effect within the next few weeks, as we release new monitor software.

Thank you for bringing your concerns on this issue to us. We want to make sure that all our users know that their voices are heard. We are committed to offering the best combination of privacy and dependability for our users, and we believe that these changes hit that mark.

11 Likes
2

Thank you for the update. Will this choice be added to the out of the box experience for first time setup so customers are able to make an informed decision about the behavior of the device?

2 Likes
3

Thank you for the thorough explanation and for the effort the Sense team put toward researching this issue.

2 Likes
4

Thank you for addressing this so quickly and thoroughly. Will the support articles be updated to reflect this networking change?

My last review of the articles showed no mention of 1.1.1.1.

Thanks

5

Thank you Sense for addressing this, these are good settings to have. That being said the privacy concern is way overblown. Anyone that owns a smartphone or that has used Google should be for more worried about the data collection there as opposed to the DNS resolution of a Sense device. I’m not trying to stir people up with this post but am trying to be realistic about how impactful this really is.

7 Likes
6

Thank you, Ryan, for explaining what happened and all the considerations involved in the issue. I don’t know if that kind of open, honest and complete response to a customer service issue is scalable, but big companies with a PR crisis would benefit greatly from following in Sense’ footsteps.

1 Like
7

Not right away, but it’s a good idea and something we can include in the future.

I will get on that today!

Well that’s certainly nice to hear. The concerns of our customers matter to us — and especially so when it comes to data security and privacy. And we may not be a “big” company, but we’re not too tiny either! :grin:

8

Thanks for the attempt to make Sense better.

9

Totally agree! I do appreciate Sense’s thoughtfulness and the way they handled the issue though.

10

On all of my networks I block access to external DNS servers and watch internal DNS queries for various reasons. I appreciate that the sense device will automatically fall back to the DHCP provided servers.

11

@RyanAtSense Any updates on the progress with those 3 items you outlined?

12

All of those were enacted when I created this thread.

1 Like
13

Appreciate the input. Seeme there should be a single resource where an explanation of all ports sense might use for communications.

I see my sense is using:
Source (Sense Device) IP 192.168.XXX.103:5353
Destination IP: 224.0.0.251:5353

And I had not seen this being used in the past.

14

224.0.0.0/24 is a so called multi cast address:
https://wikiless.org/wiki/Multicast_address?lang=en
https://www.iana.org/assignments/multicast-addresses/multicast-addresses.xhtml

That information stays local and does not leave through your router to the internet.

15

Here’s the list - buried in the Help section of the website. And as @dannyterhaar points out, 224.0.0.251:5353 is a multicast broadcast that goes out over your LAN, but not outside. That’s how Sense talks to Kasa smartplugs.

Please ensure the following ports are unblocked as Sense uses them to securely communicate with our servers: TCP 123, 443, 6514, 8482, and UDP 53.

1 Like
16

Impressive that sense users are finding mDNS entries in their logging. What type of devices are home users using showing detailed LAN traffic ?

1 Like