{"id":12053,"date":"2020-02-10T11:57:27","date_gmt":"2020-02-10T16:57:27","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=12053"},"modified":"2020-02-21T14:36:13","modified_gmt":"2020-02-21T19:36:13","slug":"browser-watch-google-chrome-to-block-http-downloads","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/browser-watch-google-chrome-to-block-http-downloads\/","title":{"rendered":"Browser Watch: Google Chrome to Block HTTP Downloads"},"content":{"rendered":"\n

Starting mid-2020, you won\u2019t be able to download certain files on Chrome \u2014 here\u2019s why<\/h2>\n\n\n\n

Time after time, we\u2019ve witnessed browser giants making security-related decisions that have a significant impact on end-users, taking the web in a more secure direction. This time it’s Google, who has announced a plan<\/a> to block HTTP downloads in Google Chrome, the most popular browser in the world<\/a>. <\/p>\n\n\n\n

Here\u2019s what Google is changing, and why it\u2019s a good thing for the web.<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n\n

Why Block HTTP Downloads?<\/h2>\n\n\n\n

As we know, Google\nChrome and other major browsers show a “Not Secure” warning when you\nvisit a non-HTTPS website. This way, everyday users are informed about the\ninsecure connection so that they (hopefully) don’t exchange any critical\ninformation with that website. This has played a pivotal role to drive user\nawareness and HTTPS adoption.<\/p>\n\n\n\n

However, that\u2019s not\nenough. <\/p>\n\n\n\n

What if there\u2019s a website that has an SSL certificate<\/a> installed on it, but is quietly serving their file downloads via HTTP? What if hackers use this opening to inject malware into your system? It\u2019s certainly a possibility!  In technical terms, such a mixture of HTTP content on an HTTPS website is referred to as “mixed content.” And with a \u201cmixed download\u201d, most users could easily fall for it as there\u2019s no indication to notify users when the download link is HTTP. It’s definitely a hole in HTTPS security, and Google has decided to fill it by blocking HTTP downloads from HTTPS websites.<\/p>\n\n\n\n

What Is Going to Be Blocked? <\/h2>\n\n\n\n

According to Google\u2019s announced plan, Chrome 83 (to be released in June 2020) will begin blocking \u201cthe file types that pose the most risk to users.\u201d These file types include executable files such as .exe and .apk. In subsequent Chrome releases, Google will include other file types and, ultimately, block all file types in Chrome 86, which is to be released in October 2020. So, after October 2020 (if you update Chrome), you won\u2019t be able to download any file that is being served over HTTP if you click the download link from an HTTPS URL.<\/p>\n\n\n\n

Note that if a website\nuses HTTP, users can still download HTTP files. This update targets HTTPS sites\nthat use HTTP download URLs, because the browser is showing the site to be\nsecure but the download actually isn\u2019t secure.<\/p>\n\n\n\n

Google\u2019s Six-Phased Approach to\nBlocking <\/h2>\n\n\n\n

Although the blocking\nprocess will be initiated with the release of Chrome 83 (to be released in June\n2020), Google first wants to educate users and also give time for website\nowners to remove mixed content from their websites. That’s why Chrome 81 (to be\nreleased in March 2020) will provide a console warning message about all mixed\ncontent downloads.<\/p>\n\n\n\n

\"Graphic
Graphic source: Google’s Chromium Blog (https:\/\/blog.chromium.org\/2020\/02\/protecting-users-from-insecure.html<\/a>)<\/figcaption><\/figure><\/div>\n\n\n\n

This process, which\nbegins in March, has been divided into six phases by Google. Here\u2019s the outline\nis given by Google for desktop platforms (Windows, macOS, Chrome OS, and Linux):<\/p>\n\n\n\n