Google Chrome is getting ready to provide a setting to restrict insecure HTTP downloads, according to a recent code change by the company. Google Chrome recently received for improved productivity on Android tablets
Google Chrome plans to block insecure HTTP downloads
Google Chrome has been updated with additional security features in recent years to encourage the use of HTTPS connections. Because so many websites deal with our personal information, HTTPS encryption is now the norm rather than the exception. Before, it was only required on sites like banks that were concerned about privacy.
The company has recently added a toggle that says “Always use secure connections” to Chrome’s security settings. If you enable this, Chrome will try to “upgrade” websites to the HTTPS version if you go to the insecure version by accident. If there isn’t a secure version, a message will appear on the screen asking if you still want to proceed.
The most important change is that any older HTTP site is now labelled “Not Secure” in the address bar. Chrome also prevents secure websites from using non-secure web forms or downloads by default. The term “mixed content” refers to this mix of secure and insecure sections.
Google intends to improve Chrome users’ protection against potentially unsafe HTTP downloads following a new code update. This goes beyond the precautions already in place for downloading mixed content because it stops downloads from any connection, even those connected to unsafe websites.
Add insecure download blocking support.
This CL adds support for insecure download blocking. When the previously added flag is enabled, all downloads that were not securely delivered will display a warning. Before the download can be completed, this warning must be explicitly ignored.
- Insecure downloads can occur as a result of the following factors:
- the initiating page being insecure,
- the final file URL being insecure, or
- Any redirection along the way is unsafe.
For example, if you click on an HTTPS download link and are redirected to an unsecured HTTP server, Google Chrome will flag the download as unsafe. Chrome also prevents downloads from HTTP-only websites.
Availability
This feature is still in development, so it is unlikely to be available for widespread testing until Chrome 111, which is scheduled to be released in March 2023. A full launch would most likely take place later in the year.
According to the code updates, it is stated that
This implementation is designed to let mixed download blocking behavior take precedence over insecure download blocking generally. That means that any download that’s a mixed download is still blocked silently.
