Can I block ALL file downloads in Chrome?

Question

I'd like to disable all file downloads in Google Chrome. I've done this to IE with group policy trivially, however Google Chrome apparently cannot do this natively. There is a setting named "set download directory", but disabling it has no effect, and setting it to a directory inaccessible to user just makes Chrome prompt for a save location.

I also tried an extension named "EXE and msi blocker", but it blocks ALL URLs that end with .exe, there are legitimate web sites that don't serve downloads that have .EXE in URLs.

I just want to make my kid's browsing a bit safer. I prefer a secure solution (one that cannot be subverted trivially), but will settle for something less secure too, if it does the job.

Update (some more background info): We've "standardized" on Chrome in the family, so I'd prefer to use it as a default browser on all computers. I'm using K9 web protection for generic online filtering. We don't have any IMs installed on the kid's computer, so we don't need to worry about that yet. My son is 9 year old, so we try to stay on top whatever he's doing on his computer, he's not allowed to install/run/download anything on his own, etc.

Answer 1

Chrome uses Windows Attachment Manager for handling downloads. Its KB article describes its Group Policy settings, but I’m not sure that any of those directly allows blocking of all downloads.

What you can do, however, is use IE’s URL Security Zones to block downloads by setting the policy to “disallow” for the URL Actions URLACTION_SHELL_EXECUTE_HIGHRISK, URLACTION_SHELL_EXECUTE_MODRISK and URLACTION_SHELL_EXECUTE_LOWRISK.

IE only exposes a GUI for the “high risk” category, which is the security setting “Launching programs and unsafe files”. The others can be set programatically using IInternetZoneManager::​SetZoneActionPolicy() or by setting the corresponding values directly in the Registry under Software\​Microsoft\Windows\​CurrentVersion\​Internet Settings\​Zones\n (where n is a zone number; 0–4 correspond to “Computer”, “Local intranet”, “Trusted sites”, “Internet” and “Untrusted sites” respectively.) The three action value names are 1806, 1807 and 1808, and the setting for “disallow” is 3.

(Chrome has slightly strange behaviour in that files are actually downloaded to temporary .crdownload files, then immediately deleted when Attachment Manager blocks the attempt to save them. At least it appears that the block can’t be subverted by removing delete permissions from the download directory...)

Answer 2

A better solution than limiting Chrome is to limit Windows, so the children will simply be unable to install or even review any downloaded content. No solution for Chrome is tamper-proof or is guaranteed to continue to work with newer versions of Chrome (which has a very fast update schedule). However, a protection using Windows is sure to continue working.

There are many tools built into Windows 7 that can give much better security to your children.

User Account Control

With the User Account Control (UAC) available in Windows 7/8 Pro you can give the children standard user accounts and set UAC to the top setting of "Always notify". That will require entering the Administrator password to affect any system changes or to use downloaded material.

Parental Controls

With Parental Controls, you can :

• Set specific time limits on your children's computer use
• Prevent your children from playing games you don't want them to play
• Keep your children from running specific programs

See also this tutorial : How To Use Parental Controls in Windows 7.

Windows Family Safety

Windows Family Safety (requires login) extends Parental Controls with a variety of web, email, and instant messaging protections. It also allows logging, so your children will know that you see everything they do. It works across all browsers.

See also Protecting your kids with Family Safety.