For another angle on the risks of browser prefetching, read this paper by Srinivas Krishnan and Fabian Monrose. The authors describe algorithms that allow a hacker with access to a shared name server's cache to determine -- with remarkable accuracy -- what terms users with prefetching browsers are searching for.
This is also a good reminder of the importance of locking down queries to your name server. Through judicious use of BIND's allow-query and allow-query-cache sub-statements, you can prevent unauthorized queriers from snooping your cache, whether or not your users use prefetching browsers. Recipe 7.12.2 in my DNS & BIND Cookbook shows how to do this with just allow-query. allow-query-cache actually makes it a little easier, but that exercise is left to the reader.
Comments
Really liked this. It also makes one wonder how easy it is to inject information into the local cache to redirect. This was very interesting, thanks.
After almost a year of watching and reading you, it seems like you have the mindset of what i need to know next, regarding DNS, thank you for taking over this position!