Security Experts Hope To Write Eulogy For Blacklists

from the black-death dept

Blacklists have always been a significant tool in the security industry's anti-malware arsenal. For years, the basic anti-virus model was simply to maintain a list of known viruses (and their permutations) and match any potential virus against that list. As malware started to proliferate and vary wildly, security firms have augmented this approach with other techniques, though the basic blacklist still remains. Blacklists are also used to protect against spam and identify websites that may be hostile. But just as the model has come to be inadequate in the traditional anti-virus space, so too is it seen as deficient for other purposes. Among the complaints about blacklists include the fact they're easy to accidentally fall into, while easily gamed by those looking to get off them. Essentially, blacklists are a blunt weapon unsuitable for the complexity of good security systems. Just ask the customers of Verizon, who at times have had all of their foreign email blocked, because the company's overly aggressive anti-spam software. Interestingly, one major user of blacklists is Google, which uses them to warn users about potentially malicious sites that they may encounter through searches. Seeing as the company is ramping up its security business, it will be worth watching whether it continues to push blacklists, or if it seeks out more sophisticated mechanisms for discerning what's legitimate online.

Filed Under: blacklists, security, spam

Reader Comments

Subscribe: RSS

View by: Time | Thread

  1. icon
    JS Beckerist (profile), 10 Jul 2007 @ 8:05am

    White List vs. Black List

    White List vs. Black List, and I'll give a prime example: the Firefox plugins, NoScript and Adblock.

    NoScript is a White list based service. It blocks all Javascript from every top level domain until you specify otherwise. Adblock is a black list based service. It doesn't block ANYTHING until you specify otherwise (good for image based advertisements, and fun to build!)

    My point with this is, both are very useful and perform similar functions but are meant for two different things. NoScript is my powerhorse, nothing gets through it that I don't want. Adblock, while working more like AV software, will prevent things from loading AFTER I've already seen it once. This is NOT effective when trying to prevent an unknown for the first time, every time, and really the White List method is the only real way to do this.

    ...then again, look at Windows Vista. Would you like to perform this action? Yes or No? A step in the right direction if you ask me, and I think A/V could learn a thing or two from this.

Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here

Subscribe to the Techdirt Daily newsletter

Comment Options:

  • Use markdown. Use plain text.
  • Remember name/email/url (set a cookie)

Follow Techdirt
Techdirt Gear
Shop Now: Copying Is Not Theft
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Report this ad  |  Hide Techdirt ads
Recent Stories
Report this ad  |  Hide Techdirt ads


Email This

This feature is only available to registered users. Register or sign in to use it.