9 ms·
Blocking high-risk non-secure downloads
- chainsaw10 8y agoFrom my reading, it looks they're considering this for only non HTTPS downloads initiated from an HTTPS page Relevant quotes: > ... we will likely start by treating certain high-risk downloads initiated from secure contexts as active mixed content and block them. > We're not planning to focus on non-secure downloads initiated from non-secure contexts at the moment, because users at least see the "Not Secure" omnibox badge on those pages.
- SquareWheel 8y agoI agree with your reading. I've flagged this post as the title is misleading.
- PretzelFisch 8y agoThat's not how I read it. The nonsecure download from a secure page is their starting point. The end goal is to block all unsecure downloads of high risk types.
- toomuchtodo 8y agoIs it possible to disallow all non secure/https requests in Chrome?
- A2017U1 8y agoThe EFF's httpseverywhere extension works well, you need to set it to block if it can't upgrade the connection to tls
- Someone1234 8y agoGreat concept but the plugin is an absolute memory hog, and they've been unable to fix it. They closed the old bug for no real reason: https://github.com/EFForg/https-everywhere/issues/1775 https://github.com/EFForg/https-everywhere/issues/1775 Then let the new bug rot: https://github.com/EFForg/https-everywhere/issues/12232 https://github.com/EFForg/https-everywhere/issues/12232 They've now started deleting new comments on the new bug. I'm just not using it anymore.
- sucrose 8y agoThe DuckDuckGo Privacy Essentials¹ extension is a great alternative that I switched to. ¹ https://chrome.google.com/webstore/detail/duckduckgo-privacy-essent/bkdgflcldnnnapblkhphbgpggdiikppg https://chrome.google.com/webstore/detail/duckduckgo-privacy...
- Sahhaese 8y agoThe easiest way to do that is to use your OS provided firewall to block all outgoing HTTP requests from chrome and only allow HTTPS.
- gambler 8y agoThat's how I read it as well. Boiling the frogs.
- gambler 8y agoClever. This means users won't be able to easily download software from websites not plugged into CA tree. One more step towards eradicating the ability of people to independently host websites altogether. Increasingly, I see that the web no longer fulfills any of its original goals. On the other hand, if I look at it as a software delivery/execution platform I see a horrible mess that could have been designed a zillion times better if that was the goal to begin with.
- Avamander 8y agoAre you implying there aren't a lot of CAs to choose between? How would you design it a "zillion times better"?
- bigj0n 8y agoCouldn't you add additional certificate authorities to your browser at will? The CA system is decentralized by nature. If the existing authorities start trying to manipulate your internet by controlling who they verify, which hasn't really happened that I'm aware of, you can always add a new root certificate. Or consumer browsers can offer new CA roots out of box.
- gambler 8y agoThe point isn't what you can do as a user. The point is that Google adds more and more hurdles to running a website without plugging into the CA chain. CA chain is centralized. Plus, it requires you to have a domain name. DNS is also centralized (although to a somewhat lesser extent). Effectively, we're seeing yet another step in hyper-centralization of the web.
- ehutch79 8y agoHow many websites do you actually use don't have a domain name? also, as above, there is no one root CA. you can add and remove any ca from your system. most users don't because why would you trust a random ca from some random site. What's the actual problem here?
- grezql 8y agoI dont understand why they are doing this. .exe files are known to be dangerous so usually when one downloads it you make sure its from a safe website. How is blocking non-https .exe downloads making this any safer for end-user? I am getting fed up with Google trying to steer how the web should be. Already changed to Firefox. Also when I think about this, this only hurts legacy windows applications which probably is hosted on a non-http site. I dont like this move at all.
- deleted 8y ago[deleted]
- jmathai 8y agoNot saying this is the right solution but the vast majority of Chrome users likely do not know exe files can be dangerous.
- Ajedi32 8y agoIt doesn't matter if the website is "safe" if the download happens over plaintext HTTP. Any middleman could replace the executable with anything, or worse: just inject malicious code into the executable so you don't notice anything is amiss.
- RKearney 8y agoAnd break the code signature in the process, thus causing Windows to display a large nasty warning about the exe being unverified.
- Ajedi32 8y agoWhat, you mean this warning? https://files.brightside.me/files/news/part_46/468060/20593810-UAC_PROMPT-1516629223-1517845099-650-cf6d3a4568-1520921909.jpg https://files.brightside.me/files/news/part_46/468060/205938... I don't know any normal user who would think twice about clicking "Yes" on a prompt like that when they're trying to install a program they just downloaded. There are plenty of legitimate programs that don't have a signature, and plenty of malicious programs that do.
- lightedman 8y agoDon't block anything excepting drive-by downloads. If I click on something with the intent to download it, it shouldn't matter what the source is. This is why I use FireFox.
- Karunamon 8y agoFirefox's nannying isn't much less irritating (forced plugin signing, etc.)
- maccard 8y agoYes it should - if I'm on https://trustedsite.com https://trustedsite.com and they link to http://notsotrustedsite.com/someexe.exe http://notsotrustedsite.com/someexe.exe you are vulnerable.
- gpm 8y agoLinking from https://trustedsite.com https://trustedsite.com to https://nottustedsite.com/someexe.exe https://nottustedsite.com/someexe.exe doesn't seem to be much better. Nottrustedsite.com can serve you a malicious exe either way. Https protects you against network MITMs, not evil sites sending you evil executables.
- jasonlotito 8y agoSo, the thing is, they are working to ensure that is true. If you download it from a non-secure source, it can be changed on route. What you intend to download and what you actually download are different.
- lightedman 8y agoHash checks, file signatures, etc. make that a non-issue. At this point, with all the restrictions happening, how about we just require a license to use the internet? Just skip all this crap because that's about where we're heading now.
- nukeop 8y agoUntil you fall victim to clickjacking.
- maccard 8y agoI wonder why the focus is just on downloads from https pages. I've not thought about this for very long but why is it ok for https pages to link to http pages? If I navigate to https://trustedsite.com https://trustedsite.com, and they link to http://trustedsitesortof.com http://trustedsitesortof.com, my browser should warn me.
- moreira 8y agoIt used to warn you. IE6, I believe, used to say "you're about to leave a secure site", or something along those lines. But the world was different then, and HTTPS wasn't as common as it is today. I strongly suspect that that sort of warning will soon be coming back.
- kalleboo 8y ago> my browser should warn me I remember those dialogs in Netscape 4. They were incredibly annoying.
- Crinus 8y agoThat doesn't make sense, think HN/Reddit/etc, which are HTTPS and primarily link to other sites which can (and very often are) HTTP. There is no security compromised here nor any other link between the two than one referring to another. Linking resources (like images, files, etc) is another topic, but it doesn't make much sense to put a barrier for pages. If nothing else, you get annoying warnings that people learn to ignore.
- billpg 8y agoWhat if this was allowed: (Please excuse non-angle brackets.) [A HREF="http://example.com/SomeProgram.exe" http://example.com/SomeProgram.exe" ExpectedSha256="..."]Download[/A] If clicked, the download is checked and is quietly discarded if the hash is wrong.
- RL_Quine 8y agoYou might like subresource integrity.
- nukeop 8y agoThis exact mechanism is already used for linking scripts/stylesheets from third party websites.
- grenoire 8y agoQuiet discarding might not always be possible in a reasonable timeframe. You still have to get all the bytes to sha256 the payload, and so what? Do you expect the user to waste bandwidth and wait the check out? Often bandwidth and time both have costs attached.
- paulirwin 8y agoIt could still download it as normal, but show a warning at the end after it computes the hash and compares. Just like getting around a bad HTTPS cert, the browser could allow you to say "I know what I'm doing". Edit: To clarify, I mean it could show the warning before the browser does the rename of the file from the temporary download file to the final filename.
- grenoire 8y agoConsidering EXEs specifically (entirely dismissing tarballs and such packages which can easily go up to several gigabytes), you cannot rely on everybody being able to download files in a reasonable time frame. I'm lucky to reside in a country that allows me to download hundreds of megabytes in double-digit seconds, alas that is not true for everybody else out there.
- nukeop 8y agoYears pass, we have sci-fi level technology, and the main method of distributing programs to users on Windows is still downloading .exes from random sites and being on the lookout for the browser toolbar trying to sneak by when installing. I don't know what's worse, this, or Google trying to wrestle yet another group of website owners into obedience.
- rob74 8y agoWell, at least under Windows (and MacOS) you are still able to distribute your application using an installer which users can download from your own site, rather than being forced to use a centralized "app store". And policies like these are making this more difficult. However they won't stop shady sites which "re-bundle" open source applications and add spyware - those will have no problem getting an HTTPS certificate.
- Crinus 8y agoWhat would be a solution to that that wont end up giving 3rd parties practical control over what you can and cannot run in your own computer? (the practical bit is because in theory you can blessed repositories/app stores that users can setup, but in practice this means that the vast majority of users will keep the default repositories and thus if you want your program to be used you'll need the permission of whoever owns these default repositories - ending up with a walled garden even if in theory the walls are low and you can jump over to other gardens)
- MisterTea 8y ago> $ man 5 exe man: No entry for exe in section 5 of the manual. Looks like I'm safe. Though seriously, I don't see how this is going to stop people from getting infected. For a short time I did computer "repair" which was 99% removing malware/reinstalling Windows or fixing some silly configuration error the user made. One dude had downloaded 'jessia_alba_nude.exe' or something like that and infected his machine. I can totally see him following directions like "download jessica_alba_nude.jpg, rename to .exe, and double click to view" People are woefully ignorant and just want the carrot on the stick.
- jason2015 8y agoWhen all the HTTP security problem of the 1st download of VLC will get fixed? It seems that they are really insisting with some not-declared reason, to go against any security analysis. Is the VLC paid by EADS and/or French intelligence to enable man in the middle to inject malware in keeping HTTP in clear-text available? With Alexa top-500 website, representing more than 80% of internet traffic, being in HTTPS i can only see nasty, hidden reasons to maintain the HTTP VULNERABILITY OF VLC See https://gist.github.com/elimisteve/69077a93d21b8bf8a02a362c830fbcb1 https://gist.github.com/elimisteve/69077a93d21b8bf8a02a362c8... Is VLC paid by French intelligence to maintain this vulnerability open?
- inetknght 8y agoVLC is open source. If you don't like it using HTTP then go make it use HTTPS.
- Avamander 8y agoGiven the negative response people got from the devs about that, it won't happen. They're just super sure every component in their HTTP distribution is secure and transport security will offer no benefit. Just like APT people.
- jbk 8y agoAbsolutely not. We said our updater using HTTP is secure, since the updates are cryptographically signed, like APT. The first download is HTTPS-all-the-way since a long time: search engines get you the HTTPS version of videolan.org that redirects you to HTTPS-only mirrors (not controlled by us). However, as we do not control the mirrors and the mirrors content, this is not secure, but so far, there is no solution (until universal SRI).
- Avamander 8y ago> We said our updater using HTTP is secure, since the updates are cryptographically signed, like APT. With a 1024bit DSA key last I heard, not very secure. And that is assuming the updater doesn't contain other flaws. The same assumption APT people made, which, who the could have guessed, was wrong. > there is no solution (until universal SRI). For first initial download, indeed, unless you ship using Windows Store for example.
- peterwwillis 8y agoMalware authors are all already moving their payloads to https sites, so this will be useful for about a year until it's been worked around. Fun fact: https is a great way to mask your malware payload from filtering proxies. So now corporate laptops have client-side HTTPS filtering, which have really stupid filter rules that break existing valid use cases of downloading files. So the users then turn the filters off, and now all the malware gets through. Yay https! We may not be secure, but we've got privacy, damn it!