Blacklisting vs Code Scanning: Which is better?

Discussion in 'other anti-malware software' started by sg09, May 28, 2010.

Thread Status:
Not open for further replies.
  1. sg09

    sg09 Registered Member

    Joined:
    Jul 11, 2009
    Posts:
    2,713
    Location:
    Kolkata, India
    Hi Guys,
    I want your comment on the two technologies adopted by browser plugins.
    1. Code Scanning (AVG LinkScanner, Finjan SecureBrowsing)
    2. Website Blacklisting (Rest all)
    Code Scanning is like HIPS and Blacklisting is like signature based protection. Which one in your opinion is better? And is their any plugin that adopts both?
     
  2. Konata Izumi

    Konata Izumi Registered Member

    Joined:
    Nov 23, 2008
    Posts:
    1,544
    having both would be good.
    for code scanning I prefer that the scannng would be made locally on my computer. (ie. Avast Webshield)
    same goes with website blacklisting (ie. avast network shield).

    PROS:
    code scanning = protection from unknown malicious sites/scripts
    website blacklisting = protection from known malicious sites/scripts.

    CONS:
    might impact browsing performance. ^^
     
  3. progress

    progress Guest

    Blacklisting can never be up-to-date, that's the problem ...
     
  4. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Not to mention that blacklisting must contain every sub-domain of a given domain.

    But, just like Konata Izumi mentioned, both would be great. Of course, there would exist a little loss in browsing performance. Not that much of a loss, still, not the same as not having any blacklisting.

    In case of IE, for example, the more domains and IPs that are blacklisted, it will take a just a tad more for the browser to open.
    But, if you use IE, and don't mind that extra second for the browser to open, then why not - Spyware Blaster + Spybot - Search & Destroy immunizations would help protect you.
    And, not only those two will blacklist domains and IPs, but also prevent the installation of forms of malware. So, they also provide a real-time protection, without consuming any system resources. Of course, you would need to disabled Spybot's TeaTimer module.

    Adding to that AVG Linkscanner, then more will be covered, real-time.
     
  5. ALiasEX

    ALiasEX Registered Member

    Joined:
    Mar 30, 2010
    Posts:
    240
  6. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    First, no security application will provide 100% security. So, that means that Linkscanner won't be 100% effective.

    There are other options that can be used together or alone, like PC Tools Browser Defender.
    Or, running the browsers isolated from the rest, too.

    But nor will any blacklist provide 100% protection, and for two reasons:

    1. At the moment you enter a website, it may already be clean, yet it will be blocked. Or, it may not exist any longer.

    2. There's no way to keep up with all malicious domains that come up by the minute. It also needs all sub-domains to be blocked in order to be effective.

    In the end it comes down to what you need and what you need it to do. There are plenty options; some great, others not that great.

    One thing we cannot forget: None will provide us 100% security. That's a dream, unfortunately.

    Also, remember that to be protected from websites hosting viruses, spyware and other sort of malware, you're better off with other security. That's not the job for AVG Linkscanner.

    It may also report a website as green, but block any redirection to a domain containing active malicious content.

    It's a matter of finding the one that better fits your needs.
     
  7. 0strodamus

    0strodamus Registered Member

    Joined:
    Aug 23, 2009
    Posts:
    1,047
    Location:
    United Surveillance States
    For me it's all about performance. I tried Finjan SecureBrowsing and it was too slow in showing results. I know WOT isn't perfect, but it is quick so my vote would be for blacklisting. Another vote in WOT's favor is that it can be customized to work with more search engines (i.e. scroogle).
     
  8. sg09

    sg09 Registered Member

    Joined:
    Jul 11, 2009
    Posts:
    2,713
    Location:
    Kolkata, India
    I think Prevx Safeonline for facebook includes both techniques... Am I right?
    And what about Rapport?

    Personally I use nothing just use sandboxed Chrome or FF. And to know about ratings often use URLVoid.

    btw, is there any way to manually scan webpages with Finjan like linkscanner?
     
  9. Konata Izumi

    Konata Izumi Registered Member

    Joined:
    Nov 23, 2008
    Posts:
    1,544
    Rapport = blacklist of phishing sites only
     
  10. progress

    progress Guest

    No, btw: Finjan is really slow :(
     
  11. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Yes, there is.

    http://www.finjan.com/Content.aspx?id=574

    But, when I opened it just now, it said couldn't find the page. I did opened it yesterday, so it may be down for maintenance.
     
  12. LoneWolf

    LoneWolf Registered Member

    Joined:
    Jan 2, 2006
    Posts:
    3,408
    Site is working fine here.
     
  13. AvinashR

    AvinashR Registered Member

    Joined:
    Dec 26, 2009
    Posts:
    2,060
    Location:
    New Delhi Metallo β-Lactamase 1
    Agree and even i'll never ever suggest Finjan to anybody.

    I am happy with WOT & Browser Defender...with Sandboxed Browser. :)
     
  14. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Could you tell me if Browser Defender stills displays a small green box in IE? I ask this, because if you go here www.browserdefender.com you'll see by the images that it looks different. I downloaded it, thinking there was a new version and still looks the same.

    Odd.
     
  15. AvinashR

    AvinashR Registered Member

    Joined:
    Dec 26, 2009
    Posts:
    2,060
    Location:
    New Delhi Metallo β-Lactamase 1
    To be very honest i have never used IE8 for browsing, and never installed any kind of Link-Scanner or Site Scanner in it...About firefox i can tell you that sometimes it didn't show anything even on legitimate site (But that too while searching on google only)
     
  16. ALiasEX

    ALiasEX Registered Member

    Joined:
    Mar 30, 2010
    Posts:
    240
    I realize that but it's good to let others know.
    Have you looked into LinkExtend? It shows results from WOT, Browser Defender and 5 other services. It doesn't block websites, though, yet.
     
  17. sg09

    sg09 Registered Member

    Joined:
    Jul 11, 2009
    Posts:
    2,713
    Location:
    Kolkata, India
    Great, Thanks a Lot.:thumb:
     
  18. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    No, I can't say I have. There is one other similar service, though: www.urlvoid.com

    These sort of services are always great, but as you mentioned they do not block access to malicious domains. That's one major downside.

    It would be nice to have a tool using those services that would actually block access to malicious domains, regardless of the web browser.
     
  19. AvinashR

    AvinashR Registered Member

    Joined:
    Dec 26, 2009
    Posts:
    2,060
    Location:
    New Delhi Metallo β-Lactamase 1
    I haven't used LinkExtend till date...I will try when my main system will up. :)
     
  20. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Interesting thing about McAfee Site Advisor

    Source: http://www.siteadvisor.com/webmasters/index.html
     
  21. ALiasEX

    ALiasEX Registered Member

    Joined:
    Mar 30, 2010
    Posts:
    240
    LinkExtend is a Firefox and Flock addon. Blocking websites will be added. (Don't know when.)
     
  22. sg09

    sg09 Registered Member

    Joined:
    Jul 11, 2009
    Posts:
    2,713
    Location:
    Kolkata, India
    Any opinions on AVG link scanners? How good it is compared to finjan. No speed issue please.
     
  23. progress

    progress Guest

    I have searched for some warez with both of them - while AVG gave me about 25 warnings I got only 1 warning from Finjan :doubt:
     
  24. sg09

    sg09 Registered Member

    Joined:
    Jul 11, 2009
    Posts:
    2,713
    Location:
    Kolkata, India
    hmm...;)
     
  25. Konata Izumi

    Konata Izumi Registered Member

    Joined:
    Nov 23, 2008
    Posts:
    1,544
    ^ wow...i saw lots of plugins/extensions here :D
    I wonder what browsing data gets sent on their servers to provide you service. ;)

    maybe all urls you visit? wow. no privacy :<


    I prefer Avast Web Shield for realtime scanning and blocking malicious sites locally on my computer.
     
Loading...
Thread Status:
Not open for further replies.