Slashdot Mirror
Google Chrome Is Getting Automatic Blocking of Malicious Downloads
An anonymous reader writes "Google today announced Chrome is getting an automatic download blocking feature for malware. Google has already added the new functionality to the latest build of Chrome Canary. All versions of Chrome will soon automatically block downloads and let you know in a message at the bottom of your screen. You will be able to "Dismiss" the message, although it's not clear if you will be able to stop or revert the block."
I shouldn't have to install IE if I want to set up a little virtual ecosystem.
So it already has a drive-by download installed and running. Just sayin'.
Laughter is the Spackle of the Soul.
Yet they wont let me disable the god forsaken auto complete in the address bar. I completely ditched Chrome because of that damned evil annoyance.
Do not look at laser with remaining good eye.
Chrome already blocks malicious downloads. Not sure how this is new. Maybe it's a more advanced version of the existing feature.
The existing feature already looks like the current screenshot, except the text might be different. And yes, you can allow downloads using the drop down on the right.
Possibly this is integration of anti-virus hooks? I think the existing version might just use a Google list of known safe and dangerous downloads.
Now, can you let me choose for myself which filetypes are safe or not? For my job, I have to download many PDFs (up to 100 at a time) and Chrome asks me EVERY... SINGLE... FUCKING... TIME "This type of file can harm your computer. Do you want to keep <filename> anyway?"
LISTEN IDIOT: These PDFs come from a trusted source. Yes, I have to download them. No, I don't want to view them in the browser right this second. Also, I'm on a Mac, and also also, I don't use Acrobat, and also also also, this is my work machine, and IF anything would happen to it, I'd let I.T. blow it away and re-image it if needed. LET ME DOWNLOAD THE GODDAMN FILE. Every few months I search to see if there's a way to disable this, and so far I've come up empty.
Needless to say, I don't use Chrome for this part of my job.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
...software contrary to corporate (RIAA/BSA) interests?
Microsoft has tried something similar. Each distinct executable has to build up a reputation over some long period before IE SmartScreen stops flagging it as "not commonly downloaded". The only way to make an executable build up reputation faster is to apply for an Authenticode software publisher certificate from a commercial CA ($$$) and keep it renewed ($$$ per year), which lets good reputation spill over from other executables from the same publisher that have earned good reputation. This especially messes with the release early, release often mentality of amateur free software developers who might not be willing to form an LLC and buy and maintain an Authenticode certificate.
When IE introduced this feature everyone said it was bad, because your download links were scanned by Microsoft.
Is this good now because the Google is doing it?
it would be nice if there was a Windows program to install programs from a centralized repository of software that was actually scrutinized to ensure it's malware free and perhaps a security risk rating. It certainly would make open source programs more attractive because they could quickly be certified as being malware free. the rest wouldn't be able to be certified as being 100% malware free since there cant be a true analysis of the software without REing the whole thing unless they submit the source but keep it secret.
every program having it's own updater running is annoying, uses more resources and introduces another security risk.
Anons need not reply. Questions end with a question mark.
So it blocks the download of itself?
You mean it might stop offering to install Flash for me?
That would be nice.
Lost at C:>. Found at C.
On MacOS there's a setting, "Allow Apps Downloaded from", under the security and privacy section of the control panel that controls this behavior. If I have that set to download from anywhere, it should download from anywhere.
Chrome usage has been falling by approx 0.25% market share per month for the last year or so. It's like they're just trying to accelerate it now. Plus, I'm 99% sure this is an exact clone of a feature included with IE7. The IE10 version is even more popular with it's 5 or so clicks to finally get to the "I don't give a fuck if you haven't heard of this download, it's from fucking Sourceforge, don't delete it and let me run the damn thing. Yes I know it's a fucking MSI file" button. REAL popular feature.
Especially because reputation spillover could have been implemented just as easily with the key continuity management (KCM) paradigm. In KCM, each software publisher acts as its own CA and self-signs its own code signing certificate. This way a developer can prove that he's the same developer as last time without having to prove the developer's real world identity. Android code signing uses KCM, as does SSH. OS X used to before 10.8 when Apple introduced GateKeeper with default settings to block running code from unidentified developers.
Then why does Chrome for Android display a scare bar for PDF downloads even on a platform to which Adobe Reader isn't even ported?
Stupidity is here to stay choice is not.
"If any question why we died, Tell them because our fathers lied."
If this feature is implemented as a cloud service, i.e. each URL will be checked by Google before the browser is executing it then say good-bye privacy. It would be the last thing that you would like to have: a browser that spies on you.
If this feature is implemented with a signature file that is updated from time to time, then it is the same snake-oil as each anti-virus and is probably not harmful. It might even be useful for those people who also have use for anti-virus software.
Chrome asks me EVERY... SINGLE... FUCKING... TIME "This type of file can harm your computer. Do you want to keep anyway?"
seems like this is a common and unnecessary annoyance for non-Windows people.
this will remove the down warning for all file types.
1) open preference file /Users/yourusername/Library/Preferences/com.google.Chrome.plist
-- OS X:
-- Linux: ~/.config/chromium/Default/Preferences
-- Windows: GFY, you need this warning.
2) replace the "download" section with this
"download": {
"directory_upgrade": true,
"prompt_for_download": false
},
Anons need not reply. Questions end with a question mark.
Yeah, Sure, Blocking malicious downloads has the potential for bad, but it also has the potential for good. You get hit with Cryptolocker and not have any good backups then tell me how much you hate a feature like this. I have already seen it too many times, companies that loose data because of that virus and the sysadmins that are too proud to pay the ransom. Or even worse, the employees who get hit with it then doesn't say anything until after the timer runs out. People might hate on features like this, but at the business level it can be a life saver.
Is Chrome going to stop illegally violating the trademarks and copyrights of small businesses by replacing their web sites with often inaccurate warnings about how they are responsible for malware?
When did Google become the Internet police and by what authority do they presume to deface a third party's web site and publicly accuse that third party of distributing malware?
Malicious, but malicious to WHOM? If they ever start blocking useful tools which "could" be used to break laws or otherwise do harm, that will be the end of Chrome.
You see? You see? Your stupid minds! Stupid! Stupid!
Is Google considered malware that this thing will block since it has so many privacy breeches, etc.
...so my parents can't install random search engines, toolbars and plugins.
It is such a simple feature (one assumes) but it would mean when I see the old folks on a Sunday I might actually be able to catch up with them before the inevitable.
Chrome usage has been falling by approx 0.25% market share per month for the last year or so. It's like they're just trying to accelerate it now. Plus, I'm 99% sure this is an exact clone of a feature included with IE7. The IE10 version is even more popular with it's 5 or so clicks to finally get to the "I don't give a fuck if you haven't heard of this download, it's from fucking Sourceforge, don't delete it and let me run the damn thing. Yes I know it's a fucking MSI file" button. REAL popular feature.
Terrible example. Sourceforge has started bundling Ask Toolbar and other crapware with their products where the project administrators have agreed. For example, Filezilla default download now comes bundled with such shite.
https://forum.filezilla-project.org/viewtopic.php?f=2&t=30240&start=120
The really cool part is it blocks poisonous viral meme downloads, too, so you only see a black screen when you go to Huffington Post*.
*Substitute Drudge Report for humor effect if you are already infected with the Huffington meme defense mechanism.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Depends on perspective.
Yes, identifying malware is a hard problem: (It often is altered so no two copies have the same checksum, the latest malware won't be caught, etc), but if something is *known malware* where is the issue in just blocking the download?
If Google did its job right, an attacker would need to hack not only the update distribution servers but also Google's code signing server. Machines for signing important code are supposed to be kept disconnected from the Internet for just this reason.
If a lot of people install a program, and nobody reports it to Microsoft as malware, then yes, Internet Explorer stops warning people about it.
That means Firefox will be copying its big brother about 10 minutes later. Are they trying to make me use IE against my will?