Google Chrome to block insecure downloads starting this spring

[Adam]

Protecting users from insecure downloads in Google Chrome

Posted by Joe DeBlasio, Chrome security team Today we’re announcing that Chrome will gradually ensure that secure (HTTPS) pages only down...

security.googleblog.com

• In Chrome 81 (released March 2020) and later:
  • Chrome will print a console message warning about all mixed content downloads.
• In Chrome 82 (released April 2020):
  • Chrome will warn on mixed content downloads of executables (e.g. .exe).
• In Chrome 83 (released June 2020):
  • Chrome will block mixed content executables
  • Chrome will warn on mixed content archives (.zip) and disk images (.iso).
• In Chrome 84 (released August 2020):
  • Chrome will block mixed content executables, archives and disk images
  • Chrome will warn on all other mixed content downloads except image, audio, video and text formats.
• In Chrome 85 (released September 2020):
  • Chrome will warn on mixed content downloads of images, audio, video, and text
  • Chrome will block all other mixed content downloads
• In Chrome 86 (released October 2020) and beyond, Chrome will block all mixed content downloads.

 

[UnitPrice.org]

Sounds like a great idea to me. I think we’ve finally realized that we can’t leave it totally up to the end-user to be safe and secure. More layers of protection need to happen automatically.

I’m somewhat surprised this hasn’t been done sooner, but I suppose HTTPS has only risen to prominence in the last few years, with most sites finally enabling that.

 

[Gummibeer]

How about adding it to the CSP? And chrome only enforces a https rule?
This way we would have much more control and could disable downloads at all on a given page.
We could even harden it more by a dedicated DSP (download security policy) to define downloadable file types, source domains and possibly even public signing keys to verify the file origin.

 

[v1rtl]

sounds like a good thing. HTTPS is affordable thru Let's Encrypt so I see no reason to use HTTP outside of localhost

 

[StewAlexander]

Bummer for those like myself who have internal web servers

 

[Gummibeer]

Bummer for those like myself who have internal web servers

Like ever before add a custom or even only self signed certificate and share it in your company.