Be sure to push your DNS through the OpenSSH tunnel too, or they'll see your client's DNS requests. Here is a very short write-up on safe web browsing while on untrusted networks: http://16systems.com/OpenBSD/untrusted.pdf
If you want to be fastidious enough to hide the DNS for un-proxied services, you'll probably also want to have a firewall blocking and logging most outgoing non-tunneled services so you can identify them and configure the clients and proxy appropriately.