Is it smarter to use DNS-level blocking like Pi-hole or stick with a good VPN instead?
Is it smarter to use DNS-level blocking like Pi-hole or stick with a good VPN instead?
So I'm having a chat with some people who are really smart about tech, and they're asking if Pi-hole or a good VPN is the right choice for keeping my internet safe. I wanted to ask them that here so I can hear their thoughts.
You cannot really compare them because they serve different purposes. I guess it depends on what you mean by personal security. Usually, you don't need either one for most things, and you are still very secure. Almost all internet traffic is now encrypted end-to-end with HTTPS. This happened mostly after governments were caught spying on internet data. If encryption stops the government from seeing exactly what you do, then it usually works well enough for normal people. A more recent addition to this protection is the ability to encrypt DNS in browsers and even inside operating systems. Now, this also helps hide the names of websites and can block certain sites by intercepting how computers look up those names. I don't know any traffic that isn't encrypted at least partially, even like data from online games which is encrypted mostly just so cheaters are stopped. A VPN is mostly used to bypass restrictions or make it seem like your traffic comes from somewhere else. However, the actual encryption in a VPN disappears when you connect to the server. Your real traffic then becomes visible again between the VPN server and your final location. This would only be a problem if someone wanted to see your IP addresses, but remember that both data and DNS are already encrypted anyway. Most people use VPS not for security but to get around country restrictions on things like Netflix or maybe just because they don't want their real IP traced back to them when doing illegal acts. Pihole is kind of a firewall that stops internal machines from accessing certain sites, though it's not as good as a proper firewall since it only blocks by name and doesn't stop actual connections. It's mostly used to block advertising sites so you can't see ads even if you visit the site directly. It can also be used in small ways to override things like DNS servers giving different IPs based on your location, though many websites do this anyway. You can force it to use certain servers if you want. Neither of these tools are really good for true security anymore. They are sometimes hacked by hackers just to bypass site security or rules when trying to visit a website.
What are you actually trying to protect? Maybe you want to stop bad sites from getting in, but a VPN won't help with that either. If you mean reaching your own gadgets from far away, a Pi-Hole is also useless for the job. That's why @bill001g said these tools aren't comparable.
It wasn't always like this. Back when coffee shops had non-secure wifi and most websites were all unlocked, people used to see so-called hackers stealing their Facebook and other login info. A VPN was back then very helpful to stop that from happening... but of course it didn't stop the real hackers or the government who could still read the data right after it left the VPN provider.
So even though encryption for DNS helped, it still wasn't enough because redirecting just blocks traffic rather than actually sending it somewhere else. Even HTTPS can fix that too, since setting up a secure link means checking if you're talking to the right person using a certificate server. If someone tricks your DNS but doesn't match that certificate, your browser will show a warning telling you something is wrong.