Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'd like to disable all file downloads in Google Chrome. I've done this to IE with group policy trivially, however Google Chrome apparently cannot do this natively. There is a setting named "set download directory", but disabling it has no effect, and setting it to a directory inaccessible to user just makes Chrome prompt for a save location.

I also tried an extension named "EXE and msi blocker", but it blocks ALL URLs that end with .exe, there are legitimate web sites that don't serve downloads that have .EXE in URLs.

I just want to make my kid's browsing a bit safer. I prefer a secure solution (one that cannot be subverted trivially), but will settle for something less secure too, if it does the job.

Update (some more background info): We've "standardized" on Chrome in the family, so I'd prefer to use it as a default browser on all computers. I'm using K9 web protection for generic online filtering. We don't have any IMs installed on the kid's computer, so we don't need to worry about that yet. My son is 9 year old, so we try to stay on top whatever he's doing on his computer, he's not allowed to install/run/download anything on his own, etc.

share|improve this question
    
Chrome's download API is in experimental stage, once it reaches stable, I think you can expect few extensions which can do this. –  Sathya Apr 5 '13 at 6:38
    
Hi. 1. Is it crucial that your kid use Chrome? 2. If it's not crucial, then is Firefox OK? 3. What filtering and monitoring software are you using to filter and monitor your kid's Web usage, if any? 4. To filter and monitor your kid's usage of other protocols, like instant messaging? 5. If you think it's relevant: How old is your kid? –  jasonspiro Apr 9 '13 at 16:29
    
@jasonspiro: I've added an edit with some background info. –  haimg Apr 9 '13 at 17:42
    
Which operating system you are all using? –  harrymc Apr 9 '13 at 20:23
    
@harrymc: Blend of Windows 7 and Windows 8 –  haimg Apr 9 '13 at 21:10

2 Answers 2

up vote 6 down vote accepted
+150

Chrome uses Windows Attachment Manager for handling downloads. Its KB article describes its Group Policy settings, but I’m not sure that any of those directly allows blocking of all downloads.

What you can do, however, is use IE’s URL Security Zones to block downloads by setting the policy to “disallow” for the URL Actions URLACTION_SHELL_EXECUTE_HIGHRISK, URLACTION_SHELL_EXECUTE_MODRISK and URLACTION_SHELL_EXECUTE_LOWRISK.

IE only exposes a GUI for the “high risk” category, which is the security setting “Launching programs and unsafe files”. The others can be set programatically using IInternetZoneManager::​SetZoneActionPolicy() or by setting the corresponding values directly in the Registry under Software\​Microsoft\Windows\​CurrentVersion\​Internet Settings\​Zones\n (where n is a zone number; 0–4 correspond to “Computer”, “Local intranet”, “Trusted sites”, “Internet” and “Untrusted sites” respectively.) The three action value names are 1806, 1807 and 1808, and the setting for “disallow” is 3.

(Chrome has slightly strange behaviour in that files are actually downloaded to temporary .crdownload files, then immediately deleted when Attachment Manager blocks the attempt to save them. At least it appears that the block can’t be subverted by removing delete permissions from the download directory...)

share|improve this answer
    
Actually, this solution actually works, to my huge surprise. (Chrome honors IE security zones, as far as downloads are concerned). This is confusing to the user (file downloads, and then Chrome says "download failed"), and can be subverted by the user by editing the registry, but this solution does block ALL downloads in Chrome, without affecting anything else. –  haimg Apr 11 '13 at 18:43

A better solution than limiting Chrome is to limit Windows, so the children will simply be unable to install or even review any downloaded content. No solution for Chrome is tamper-proof or is guaranteed to continue to work with newer versions of Chrome (which has a very fast update schedule). However, a protection using Windows is sure to continue working.

There are many tools built into Windows 7 that can give much better security to your children.

User Account Control

With the User Account Control (UAC) available in Windows 7/8 Pro you can give the children standard user accounts and set UAC to the top setting of "Always notify". That will require entering the Administrator password to affect any system changes or to use downloaded material.

Parental Controls

With Parental Controls, you can :

  • Set specific time limits on your children's computer use
  • Prevent your children from playing games you don't want them to play
  • Keep your children from running specific programs

See also this tutorial : How To Use Parental Controls in Windows 7.

Windows Family Safety

Windows Family Safety (requires login) extends Parental Controls with a variety of web, email, and instant messaging protections. It also allows logging, so your children will know that you see everything they do. It works across all browsers.

See also Protecting your kids with Family Safety.

image

share|improve this answer
    
Thank you. Unfortunately, Windows Family Safety: 1. Does not specifically do what I wanted (to block all file downloads). 2. Does not work with domain accounts at all. UAC should be enabled of course, though, and not only for kids... –  haimg Apr 11 '13 at 18:00
    
Most downloads of executables are today called ".zip" to avoid just this kind of security. It is very frequent to download files named "???.exe.zip". By using all the above tools and giving the children limited accounts with limited access permissions to the disk folders, you can achieve close to hermetical security. Of course, this is much more work than just installing a Chrome extension (if one exists). –  harrymc Apr 11 '13 at 18:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.