In computing, a blacklist or a blocklist or a denylist is a basic access control mechanism that allows through all elements (email addresses, users, passwords, URLs, IP addresses, domain names, file hashes, etc.), except those explicitly mentioned. Those items on the list are denied access. The opposite is a whitelist (allowlist, passlist) which means only items on the list are let through whatever gate is being used. A greylist contains items that are temporarily blocked (or temporarily allowed) until an additional step is performed.
Blacklists can be applied at various points in a security architecture, such as a host, web proxy, DNS servers, email server, firewall, directory servers or application authentication gateways. The type of element blocked is influenced by the access control location. DNS servers may be well-suited to block domain names, for example, but not URLs. A firewall is well-suited for blocking IP addresses, but less so for blocking malicious files or passwords.
Example uses include a company that might prevent a list of software from running on its network, a school that might prevent access to a list of web sites from its computers, or a business that wants to ensure their computer users are not choosing easily guessed, poor passwords.
Example systems to protect
Blacklists are used to protect a variety of systems in computing. The content of the blacklist is likely needs to be targeted to the type of system defended.
An information system includes end-point hosts like user machines and servers. A blacklist in this location may include certain types of software that are not allowed to run in the company environment. For example, a company might blacklist peer to peer file sharing on its systems. In addition to software, people, devices and Web sites can also be blacklisted.
Most email providers have an anti-spam feature that essentially blacklists certain email addresses if they are deemed unwanted. For example, a user who wearies of unstoppable emails from a particular address may blacklist that address, and the email client will automatically route all messages from that address to a junk-mail folder or delete them without notifying the user.
An e-mail spam filter may keep a blacklist of email addresses, any mail from which would be prevented from reaching its intended destination. It may also use sending domain names or sending IP addresses to implement a more general block.
In addition to private email blacklists, there are lists that are kept for public use, including:
- China Anti-Spam Alliance
- Fabel Spamsources
- Spam and Open Relay Blocking System
- The DrMX Project
The goal of a blacklist in a web browser is to prevent the user from visiting a malicious or deceitful web page via filtering locally. A common web browsing blacklist is Google's Safe Browsing, which is installed by default in Firefox, Safari, and Chrome.
Usernames and passwords
Blacklisting can also apply to user credentials. It is common for systems or websites to blacklist certain reserved usernames that are not allowed to be chosen by the system or website's user populations. These reserved usernames are commonly associated with built-in system administration functions.
Password blacklists are very similar to username blacklists but typically contain significantly more entries than username blacklists. Password blacklists are applied to prevent users from choosing passwords that are easily guessed or are well known and could lead to unauthorized access by malicious parties. Password blacklists are deployed as an additional layer of security, usually in addition to a password policy, which sets the requirements of the password length and/or character complexity. This is because there are a significant number of password combinations that fulfill many password policies but are still easily guessed (i.e., Password123, Qwerty123).
Blacklists are distributed in a variety of ways. Some use simple mailing lists. A DNSBL is a common distribution method that leverages the DNS itself. Some lists make use of rsync for high-volume exchanges of data. Web-server functions may be used; either simple GET requests may be used or more complicated interfaces such as a RESTful API.
- For a list of some DNS-based blacklists, see the Comparison of DNS blacklists.
- Companies like Google, Symantec and Sucuri keep internal blacklists of sites known to have malware and they display a warning before allowing the user to click them.
- Content-control software such as DansGuardian and SquidGuard may work with a blacklist in order to block URLs of sites deemed inappropriate for a work or educational environment. Such blacklists can be obtained free of charge or from commercial vendors such as Squidblacklist.org.
- There are also free blacklists for Squid (software) proxy, such as Blackweb
- A firewall or IDS may also use a blacklist to block known hostile IP addresses and/or networks. An example for such a list would be the OpenBL project.
- Many copy protection schemes include software blacklisting.
- The company Password RBL offers a password blacklist for Microsoft's Active Directory, web sites and apps, distributed via a RESTful API.
- Members of online auction sites may add other members to a personal blacklist. This means that they cannot bid on or ask questions about your auctions, nor can they use a "buy it now" function on your items.
- Yet another form of list is the yellow list which is a list of email server IP addresses that send mostly good email but do send some spam. Examples include Yahoo, Hotmail, and Gmail. A yellow listed server is a server that should never be accidentally blacklisted. The yellow list is checked first and if listed then blacklist tests are ignored.
- In Linux modprobe, the
blacklist modulenameentry in a modprobe configuration file indicates that all of the particular module's internal aliases are to be ignored. There are cases where two or more modules both support the same devices, or a module invalidly claims to support a device.
- Many web browsers have the ability to consult anti-phishing blacklists in order to warn users who unwittingly aim to visit a fraudulent website.
- Many peer-to-peer file sharing programs support blacklists that block access from sites known to be owned by companies enforcing copyright. An example is the Bluetack blocklist set.
Considerations of usage
As expressed in a recent conference paper focusing on blacklists of domain names and IP addresses used for Internet security, "these lists generally do not intersect. Therefore, it appears that these lists do not converge on one set of malicious indicators." This concern combined with an economic model means that, while blacklists are an essential part of network defense, they need to be used in concert with whitelists and greylists.
An example would be the Adblock Plus blocklist that includes a number of features including whitelists within the blacklist by adding a prefix of two at symbols and two pipe symbols e.g. "@@||www.blocksite.com".
In 2018, a journal commentary on a report on predatory publishing was released making claims that 'white' and 'black' are racially-charged terms that need to be avoided in instances such as 'whitelist' and 'blacklist'. The journal hit mainstream in Summer 2020 following the George Floyd protests in America wherein a Black man was murdered by an officer sparking protests on police brutality.
The premise of the journal is that 'black' and 'white' have negative and positive connotations respectively. It states that since 'blacklist's first recorded usage was during "the time of mass enslavement and forced deportation of Africans to work in European-held colonies in the Americas," the word is therefore related to race. There is no mention of 'whitelist' and its origin or relation to race.
This issue is most widely disputed in computing industries where 'whitelist' and 'blacklist' are prevalent (e.g. IP whitelisting). Despite the commentary-nature of the journal, some companies and individuals in others have taken to replacing 'whitelist' and 'blacklist' with new alternatives such as 'allow list' and 'deny list'.
Those that oppose these changes question its attribution to race, citing the same etymology quote that the 2018 journal uses. The quote suggests that the term 'blacklist' arose from 'black book' almost 100 years prior. 'Black book' does not appear to have any etymology or sources that support ties to race, instead coming from the 1400's referring "to a list of people who had committed crimes or fallen out of favor with leaders" and popularized by King Henry VIII's literal usage of a book bound in black. Others also note the prevalence of positive and negative connotations to 'white' and 'black' in the bible, predating attributions to skin tone and slavery. It wasn't until the 1960's Black Power movement that "Black" became a widespread word to refer to one's race as a person of color in America (alternate to African-American) lending itself to the argument that the negative connotation behind 'black' and 'blacklist' both predate attribution to race.
- Shimeall, Timothy; Spring, Jonathan (2013-11-12). Introduction to Information Security: A Strategic-Based Approach. Newnes. ISBN 9781597499729.
- "Domain Blacklist Ecosystem - A Case Study". insights.sei.cmu.edu. Retrieved 2016-02-04.
- Rainer, Watson (2012). Introduction to Information Systems. Wiley Custom Learning Solutions. ISBN 978-1-118-45213-4.
- "Archived copy". Archived from the original on 2015-08-11. Retrieved 2015-08-10.CS1 maint: archived copy as title (link)
- "Fabelsources - Blacklist".
- "Guidelines". www.surbl.org. Retrieved 2016-02-04.
- "B.I.S.S. Forums - FAQ - Questions about the Blocklists". Bluetack Internet Security Solutions. Archived from the original on 2008-10-20. Retrieved 2015-08-01.
- Metcalf, Leigh; Spring, Jonathan M. (2015-01-01). Blacklist Ecosystem Analysis: Spanning Jan 2012 to Jun 2014. Proceedings of the 2nd ACM Workshop on Information Sharing and Collaborative Security. pp. 13–22. doi:10.1145/2808128.2808129. ISBN 9781450338226. S2CID 4720116.
- Kührer, Marc; Rossow, Christian; Holz, Thorsten (2014-09-17). Stavrou, Angelos; Bos, Herbert; Portokalidis, Georgios (eds.). Paint It Black: Evaluating the Effectiveness of Malware Blacklists. Lecture Notes in Computer Science. Springer International Publishing. pp. 1–21. doi:10.1007/978-3-319-11379-1_1. ISBN 9783319113784. S2CID 12276874.
- Spring, Jonathan M. (2013-01-01). "Modeling malicious domain name take-down dynamics: Why eCrime pays". 2013 APWG e Crime Researchers Summit. ECrime Researchers Summit (ECRS), 2013. pp. 1–9. CiteSeerX 10.1.1.645.3543. doi:10.1109/eCRS.2013.6805779. ISBN 978-1-4799-1158-5. S2CID 8812531.
- Houghton, F., & Houghton, S. (2018). "“Blacklists” and “whitelists”: a salutary warning concerning the prevalence of racist language in discussions of predatory publishing."
- Taylor, Derrick Bryson (2020-07-10). "George Floyd Protests: A Timeline". The New York Times. ISSN 0362-4331. Retrieved 2020-10-14.
- "Pinchin, Malcolm Cyril, (4 May 1933–3 June 2002), County Education Officer, Surrey, 1982–93", Who Was Who, Oxford University Press, 2007-12-01, retrieved 2020-10-14
- "IP Whitelisting - Documentation". help.gooddata.com. Retrieved 2020-10-14.
- Cimpanu, Catalin. "GitHub to replace "master" with alternative term to avoid slavery references". ZDNet. Retrieved 2020-10-14.
- "blacklist | Origin and meaning of blacklist by Online Etymology Dictionary". etymonline.com. Retrieved 2020-10-14.
- "What is Little Black Book?". Writing Explained. Retrieved 2020-10-17.
- Grammarian, Angry. "Is 'master bedroom' a racist term? As language evolves, consider history and usage. | The Angry Grammarian". inquirer.com. Retrieved 2020-10-14.
- Martin, Ben L. (1991). "From Negro to Black to African American: The Power of Names and Naming". Political Science Quarterly. 106 (1): 83–107. doi:10.2307/2152175. ISSN 0032-3195.
- Squidblacklist.org - Blacklists For Squid Proxy and Content Filtering Applications.
- ipfilterX by Nexus23 Labs - Blocks P2P Crawlers, Malware C&C IPs, Institutions and many more.
- OpenBL.org - abuse reporting and blacklisting
- / Adblock Plus Filter Features - Adblock blacklist / whitelist features