HTTPS with authentication
While HTTPS relies on the PKI infrastructure, making it potentially vulnerable to rogue CAs, it is perfectly adequate for "confidential but not highly sensitive" material. Using HTTP basic auth sends the password to the server, and when TLS is being used, it is additionally encrypted. This will provide you with a few guarantees which you will need when handling confidential information:
- Is the entity requesting access allowed to access this material?
- Can an authorized entity be sure the material being sent has not been tampered with on the wire?
- Can an active/passive eavesdropper view the material as it is being sent to an authorized entity?
Any good form of authentication solves the first question, and TLS solves the second two. There is no need to use basic auth specifically (as it has its limitations, being rather simple and not ideal for storing sensitive user-created and potentially re-used passwords), so long as any simple authentication system is in place to ensure that only those who are supposed to download can do so.
Depending on how important the confidentiality of this material is, and partially on exactly how little knowledge "zero IT knowledge" is, you can also use encrypted client certificates. These are certificates generated either by you or by the client, and stored in the client's browser. It is not difficult for an end-user to set them up and use them, but it requires slightly more effort than the normal internet user is used to. It requires opening up the settings for your browser and importing the client certificate file, which will open a prompt for creating a new password to encrypt it. When they later access your site over HTTPS, their browser will ask them for the certificate password and, if it is correct, it will use the certificate to authenticate them to your website. This is by far the most secure browser-based authentication method, as the client authenticates itself to the server, and the server authenticates itself to the client.
Securing a TLS connection
If you do end up with using HTTPS, you should follow best security practices for TLS deployment:
- Use a strong private key (2048 bits or larger RSA), signed by a reputable CA (e.g. LetsEncrypt).
- Disable insecure cipher suites (such as those from SSLv2-3 and non-PFS modes).
- Avoid using small or default moduli if using DHE, or just use ECDHE.
- Pin the HTTPS state by using HSTS, ideally with HSTS preloading.
- Use HPKP to pin the precise public key you use. This is safe as long as you use a backup key.
- Use OSCP stapling to check for revoked certificates.
- Make a tight CSP policy and other anti-XSS measures to reduce the risk of XSS attacks.
- If practical and feasible, require users of the site use an up-to-date browser.
- Test your site regularly with Qualys' SSL Test. Seriously. It is an amazing service.
While this is not all an absolute must, it does significantly improve the security of the whole situation closer to that of SSH, while still retaining accessibility for the technologically-handicapped. At an absolute minimum, the first four bullet points and the last bullet point should be followed.