3

The questions I have relate to automatic downloads in Google Chrome, under Settings > Advanced > Content settings.

For starters, are there any security risks associated with allowing sites to ask when they want to download multiple files automatically to my computer after I decide to download the first file?

Can anyone here give an example of a legitimate website that does this?

This seems like something that could easily be abused by nefarious actors.

Is it really that hard to ask people to download multiple files separately, instead of allowing sites to download multiple files automatically after the first download, when downloading a program/file on the internet?

It seems like the trade off between a little bit of convenience gained and security doesn't seem worth it.

closed as primarily opinion-based by Polynomial, Xander, Jeroen - IT Nerdbox, Overmind, Rory Alsop Apr 4 at 10:45

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I've downloaded thousands of files at once, if i had to manually approve each one i would jump out the window. The context is a backup-enabling userscript that bulk downloaded student's pdf submissions to an LMS. The LMS didn't provide a way to download w/o clicking. A site could bundle many downloads into a zip, and that's usually more convenient, but it does require a bit of extra coding and might not be feasible for all providers, compared to the simplicity of triggering many downloads from <a download> tags. – dandavis Mar 14 at 16:46
  • Part 1: Thank you dandavis for taking the time to respond to my question. Reading your comment, I get the impression that allowing or blocking sites to ask whether they can download multiple files, isn't really a security issue, because if a person is going to include malware in a zip archive, then it doesn't really matter whether the victim has set their browser to allow sites to ask whether the browser can download multiple files. – John Anderson Mar 15 at 8:00
  • Part 2: Once the malicious actor is successful in tricking the user into downloading malware, it doesn't really matter whether the browser is allowed to download multiple files automatically, since a hacker could just as well include malware in a single file as he could multiple files. Is that correct? But then again this is a technical forum for security questions, so I could be wrong. Maybe blocking multiple downloads automatically would have the benefit of blocking most forms of malicious archives, since malware authors might have a tendency to split malicious code into multiple files? – John Anderson Mar 15 at 8:01
  • Part 3: When we are talking about allowing Google Chrome to download multiple files automatically, are we essentially talking about zip archives? Or can Google Chrome download multiple files after a user has chosen to download the first file in a non-zip format? – John Anderson Mar 15 at 8:20
  • 1
    it's more an an annoyance protection than a security measure. i think the approval to continue is needed for the 3rd or 4th file, which unlocks an unlimited number of downloads. the type or content (good or bad) of the file doesn't matter. – dandavis Mar 15 at 14:56

Browse other questions tagged or ask your own question.