Can I block ALL file downloads in Chrome?

45,334

Solution 1

Chrome uses Windows Attachment Manager for handling downloads. Its KB article describes its Group Policy settings, but I’m not sure that any of those directly allows blocking of all downloads.

What you can do, however, is use IE’s URL Security Zones to block downloads by setting the policy to “disallow” for the URL Actions URLACTION_SHELL_EXECUTE_HIGHRISK, URLACTION_SHELL_EXECUTE_MODRISK and URLACTION_SHELL_EXECUTE_LOWRISK.

IE only exposes a GUI for the “high risk” category, which is the security setting “Launching programs and unsafe files”. The others can be set programatically using IInternetZoneManager::SetZoneActionPolicy() or by setting the corresponding values directly in the Registry under Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\n (where n is a zone number; 0–4 correspond to “Computer”, “Local intranet”, “Trusted sites”, “Internet” and “Untrusted sites” respectively.) The three action value names are 1806, 1807 and 1808, and the setting for “disallow” is 3.

(Chrome has slightly strange behaviour in that files are actually downloaded to temporary .crdownload files, then immediately deleted when Attachment Manager blocks the attempt to save them. At least it appears that the block can’t be subverted by removing delete permissions from the download directory...)

Solution 2

A better solution than limiting Chrome is to limit Windows, so the children will simply be unable to install or even review any downloaded content. No solution for Chrome is tamper-proof or is guaranteed to continue to work with newer versions of Chrome (which has a very fast update schedule). However, a protection using Windows is sure to continue working.

There are many tools built into Windows 7 that can give much better security to your children.

User Account Control

With the User Account Control (UAC) available in Windows 7/8 Pro you can give the children standard user accounts and set UAC to the top setting of "Always notify". That will require entering the Administrator password to affect any system changes or to use downloaded material.

Parental Controls

With Parental Controls, you can :

Set specific time limits on your children's computer use
Prevent your children from playing games you don't want them to play
Keep your children from running specific programs

See also this tutorial : How To Use Parental Controls in Windows 7.

Windows Family Safety

Windows Family Safety (requires login) extends Parental Controls with a variety of web, email, and instant messaging protections. It also allows logging, so your children will know that you see everything they do. It works across all browsers.

45,334

haimg

Updated on September 18, 2022

Comments

haimg almost 2 years

I'd like to disable all file downloads in Google Chrome. I've done this to IE with group policy trivially, however Google Chrome apparently cannot do this natively. There is a setting named "set download directory", but disabling it has no effect, and setting it to a directory inaccessible to user just makes Chrome prompt for a save location.

I also tried an extension named "EXE and msi blocker", but it blocks ALL URLs that end with .exe, there are legitimate web sites that don't serve downloads that have .EXE in URLs.

I just want to make my kid's browsing a bit safer. I prefer a secure solution (one that cannot be subverted trivially), but will settle for something less secure too, if it does the job.

Update (some more background info): We've "standardized" on Chrome in the family, so I'd prefer to use it as a default browser on all computers. I'm using K9 web protection for generic online filtering. We don't have any IMs installed on the kid's computer, so we don't need to worry about that yet. My son is 9 year old, so we try to stay on top whatever he's doing on his computer, he's not allowed to install/run/download anything on his own, etc.
- 100rabh about 11 years
  
  Chrome's download API is in experimental stage, once it reaches stable, I think you can expect few extensions which can do this.
- jasonspiro about 11 years
  
  Hi. 1. Is it crucial that your kid use Chrome? 2. If it's not crucial, then is Firefox OK? 3. What filtering and monitoring software are you using to filter and monitor your kid's Web usage, if any? 4. To filter and monitor your kid's usage of other protocols, like instant messaging? 5. If you think it's relevant: How old is your kid?
- haimg about 11 years
  
  @jasonspiro: I've added an edit with some background info.
- harrymc about 11 years
  
  Which operating system you are all using?
- haimg about 11 years
  
  @harrymc: Blend of Windows 7 and Windows 8
- harrymc about 11 years
  
  Are they Home or Pro versions?
- haimg about 11 years
  
  @harrymc: They are all PRO versions.
- avirk about 11 years
  
  @haimg I think Family safty for Windows 7/8 can do this for you. Its real name is Windows Essentials
- avirk about 11 years
  
  @haimg MSDN blog about Windows 8 for keeping your kids web surfing safely. Same thing you can find on this article.
- haimg about 11 years
  
  @avirk: I'm aware of this "feature". I'd rather not send every URL my kids visits to Microsoft, moreover it does not appear to be working very well (msdn.microsoft.com/en-us/library/windows/desktop/…), and it does not support domain accounts, and it does not have a feature I asked specifically about (block all downloads).
- jasonspiro over 9 years
  
  Thanks for the edit. One aside: Even some 10-year-olds watch Web pornography. In Maclean's, Emma Teitel has written: "In the fifth grade, my friends and I had a special afternoon tradition. When school let out at 3:30, we would walk to Katherine’s house ... go upstairs to her bedroom, lock the door and watch Internet pornography. ... This is how we gained the indispensable knowledge that some women like to be ravished by farmhands, and others by farm animals." Why not install filtering and monitoring software? K9 plus Advanced YouTube Filtering is good.
haimg about 11 years

Thank you. Unfortunately, Windows Family Safety: 1. Does not specifically do what I wanted (to block all file downloads). 2. Does not work with domain accounts at all. UAC should be enabled of course, though, and not only for kids...
harrymc about 11 years

Most downloads of executables are today called ".zip" to avoid just this kind of security. It is very frequent to download files named "???.exe.zip". By using all the above tools and giving the children limited accounts with limited access permissions to the disk folders, you can achieve close to hermetical security. Of course, this is much more work than just installing a Chrome extension (if one exists).
haimg about 11 years

Actually, this solution actually works, to my huge surprise. (Chrome honors IE security zones, as far as downloads are concerned). This is confusing to the user (file downloads, and then Chrome says "download failed"), and can be subverted by the user by editing the registry, but this solution does block ALL downloads in Chrome, without affecting anything else.