Advice Request VPN vs DNS: which is better for protection against malicious domains and attackers?

[SohanRay]

Considering that the VPN service does have a DNS firewall(blocking ads and malware) , but the DNS firewall (only) service maybe better at filtering malicious domains.The DNS firewall service is an encrypted DNS filtering service and also has the option to block all newly registered domains.

 

[n8chavez]

Considering that the VPN service does have a DNS firewall(blocking ads and malware) , but the DNS firewall (only) service maybe better at filtering malicious domains.The DNS firewall service is an encrypted DNS filtering service and also has the option to block all newly registered domains.

Stop using the term "DNS firewall" when you have no idea what it means. You're going to confuse people.

 

[SohanRay]

Stop using the term "DNS firewall" when you have no idea what it means. You're going to confuse people.

Why do you think I don't know what a dns firewall is?

 

[ForgottenSeer 77194]

VPNs are only relevant in unsecured public wifi in terms of protection, nowhere else. Applications using encrypted tunnels (TLS) are much more important.
In terms of protection from malware or phishing, blocking all newly registered domains is great addition since new phishing domains are short lived to evade detection.

 

[n8chavez]

Why do you think I don't know what a dns firewall is?

Because all your coments so far have demonstrated that you don't. You seem to be jamming to words and concepts together hoping no one notices. DNS and firewall are two seperate things, thus DNS firewall does not exist. Don't use marketing terms.

 

[n8chavez]

VPNs are only relevant in unsecured public wifi in terms of protection, nowhere else. Applications using encrypted tunnels (TLS) are much more important.
In terms of protection from malware or phishing, blocking all newly registered domains is great addition since new phishing domains are short lived to evade detection.

You assume all people need is HTTPS protection, but how does that hide your IP? It doesn't. How does that help with p2p? It doesn't. How does that circumvent geo-location restrictions? It doesn't.

 

[SohanRay]

Because all your coments so far have demonstrated that you don't. You seem to be jamming to words and concepts together hoping no one notices. DNS and firewall are two seperate things, thus DNS firewall does not exist. Don't use marketing terms.

So encrypted dns filtering service sounds ok?

 

[n8chavez]

So encrypted dns filtering service sounds ok?

Yuuup.

 

[SohanRay]

You assume all people need is HTTPS protection, but how does that hide your IP? It doesn't. How does that help with p2p? It doesn't. How does that circumvent geo-location restrictions? It doesn't.

Why do you consider hiding your IP so important? To keep your activity hidden from ISP?
What about dns over TLS and https?
P2P file transfers are secure from external threats while in transit right? because data sent and received in this scenario stays within peers network only

 

[ForgottenSeer 77194]

You assume all people need is HTTPS protection, but how does that hide your IP? It doesn't. How does that help with p2p? It doesn't. How does that circumvent geo-location restrictions? It doesn't.

The question was "which is better for protection against malicious domains and attackers?" .I answered in terms of protection. All these examples that you provided are usabilities.

 

[n8chavez]

Why do you consider hiding your IP so important? To keep your activity hidden from ISP?

Because I prefer to make it hard to take me, electronically or physically. I prefer to make sure my shopping or any other transaction is secure after T-Mobile let people steal my information. In that case, a VPN might just be a sugar pill but it makes me feel better.

P2P file transfers are secure from external threats while in transit right? because data sent and received in this scenario stays within peers network only

Why would you assume that? Define external threats. And, no, data sent/received does not stay only in the peer network. In the case of torrents the tracker get announced. In the case of usenet, the central server as well as the usenet service your using both have your connecting IP. Why risk it?

What about dns over TLS and https?

What about them? They have nothing to do with whether or not to use or not use a VPN. That being said, I use DoH system-wide on Windows 11 via paid NextDNS and will recommend that everyone do the same.

 

[SohanRay]

VPNs are only relevant in unsecured public wifi in terms of protection, nowhere else. Applications using encrypted tunnels (TLS) are much more important.
In terms of protection from malware or phishing, blocking all newly registered domains is great addition since new phishing domains are short lived to evade detection.

In unsecured public WiFi, what extra protection would a vpn offer than an encrypted dns filtering?apart from privacy?

 

[n8chavez]

The question was "which is better for protection against malicious domains and attackers?" .I answered in terms of protection. All these examples that you provided are usabilities.

Not necessarily. Define attacker. Anyone that can get your true IP can do things with that address that cannot be thwarted by DNS filtering.

 

[n8chavez]

In unsecured public WiFi, what extra protection would a vpn offer than an encrypted dns filtering?apart from privacy?

In that case, there could be MiM attacks, which cannot be with a VPN.

 

[SohanRay]

In that case, there could be MiM attacks, which cannot be with a VPN.

How can there be MiM attacks with dns over tls and https?

 

[SohanRay]

Not necessarily. Define attacker. Anyone that can get your true IP can do things with that address that cannot be thwarted by DNS filtering.

Well knowing my IP can only lead to tracking my online activities to some extent. Like which website I am visiting.

 

[n8chavez]

How can there be MiM attacks with dns over tls and https?

Of course. That assumes you trust the cert that site happens to be using. What happens if that cert, and thuds https, was installed maliciously? Highly unlikely. But possible. What about network sniffers. Highly unlikely, but possible as well. My point is, why not be prepared for anything? Is it needed, no. But for me it's preferable to user a vpn.

 

[SohanRay]

Of course. That assumes you trust the cert that site happens to be using. What happens if that cert, and thuds https, was installed maliciously? Highly unlikely. But possible. What about network sniffers. Highly unlikely, but possible as well. My point is, why not be prepared for anything? Is it needed, no. But for me it's preferable to user a vpn.

If there's such a behaviour in a site its simply a malicious site. So if you visit such a site you are at risk even if you are using a VPN. If you reveal any sensitive info that is. Now if you say that the website may hack you by knowing your ip address, its not that easy. Knowing the ip address its just a starting point. A lot more its needed to hack.
Again as I said earlier network sniffer can view like the website the user is visiting if he isn't using a VPN. But that's all. He cannot manipulate data transfers of the destination site supports encryption. If it doesn't however, then he can steal any info that is entered here. But that would happen even with a VPN in Play.

 

[SohanRay]

Because I prefer to make it hard to take me, electronically or physically. I prefer to make sure my shopping or any other transaction is secure after T-Mobile let people steal my information. In that case, a VPN might just be a sugar pill but it makes me feel better.



Why would you assume that? Define external threats. And, no, data sent/received does not stay only in the peer network. In the case of torrents the tracker get announced. In the case of usenet, the central server as well as the usenet service your using both have your connecting IP. Why risk it?



What about them? They have nothing to do with whether or not to use or not use a VPN. That being said, I use DoH system-wide on Windows 11 via paid NextDNS and will recommend that everyone do the same.

Have you ever researched the Nextdns github repository? 35% of the threat feeds they use are outdated and of no use actually.Frankly speaking just 12 to 13 of the sources of their threat intelligence feeds are reliable out of the whooping 49 that they use. And reliable as in not as reliable as giving a zero day protection.Most of them are updated like once in a day or once in two days or even less than that.
NRD and AI are the only thing keeping the service afloat I think. It just shows from the outside that its very good and all,but it isn't. The cryptojacking protection that they have is useless actually. They use 2 sources for it. Both are outdated and are like not updated any more. Typosquatting protection only works for the domains they have in list. So for India, there's just one banking domain that is protected.All the rest aren't.And protection while banking is the most important.

 

[blackice]

Have you ever researched the Nextdns github repository? 35% of the threat feeds they use are outdated and of no use actually.Frankly speaking just 12 to 13 of the sources of their threat intelligence feeds are reliable out of the whooping 49 that they use. And reliable as in not as reliable as giving a zero day protection.Most of them are updated like once in a day or once in two days or even less than that.
NRD and AI are the only thing keeping the service afloat I think. It just shows from the outside that its very good and all,but it isn't. The cryptojacking protection that they have is useless actually. They use 2 sources for it. Both are outdated and are like not updated any more. Typosquatting protection only works for the domains they have in list. So for India, there's just one banking domain that is protected.All the rest aren't.And protection while banking is the most important.

I’ve seen your discussions on the NextDNS help section and it seems that despite the old feeds their protection is relatively decent in testing. DNS isn’t the most efficient way to block threats anyway and is kind of a nice extra layer. For the other features NextDNS is a pretty good service with a good level of protection thrown in, though as you note there are better solutions for a sole focus on security. All-in-all I’d say it’s a good service, for security on Quad9 is better. But if you are that concerned about security a router or device level solution is going to be more effective.