Allow us to whitelist domains and filetypes for downloads via group policy

[levicki]

Description

Brave (and Chome and Microsoft Edge and Firefox) are so annoying with blocking of supposedly "dangerous" downloads unless I cave in and enable Safe Browsing.

Well let me tell you something — I don't want your Safe Browsing. I don't want you or anyone else scanning the huge database of blacklisted URLs (whether local or through some cloud service is irrelevant) every time I open a link or download a file.

I would like to have a whitelist of domains and filetypes that I can configure myself for a handful of websites which I frequently visit.

I just downloaded those files:

And I had to click the Keep button for every single one of them.

Needless to say, none of them are dangerous in any way.

Steps to Reproduce

1. Disable Safe Browsing
2. Try downloading a bunch of popular program installations

Actual result:

You need to confirm each and every download.

Expected result:

File is downloaded like I asked without further prompting.

Reproduces how often:

Easily reproduced

Brave version (brave://version info)

Brave	1.51.114 Chromium: 113.0.5672.92 (Official Build) (64-bit)
Revision	b6f521170062a1fa8a82c33fb223b06fec566da1-refs/branch-heads/5672_63@{#10}
OS	Windows 10 Version 22H2 (Build 19045.2965)

Version/Channel Information:

• Can you reproduce this issue with the current release? Yes
• Can you reproduce this issue with the beta channel? Yes
• Can you reproduce this issue with the nightly channel? Yes

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields? No
• Does the issue resolve itself when disabling Brave Rewards? No
• Is the issue reproducible on the latest version of Chrome? Yes

Miscellaneous Information:

Microsoft Edge already has an implementation for whitelisting of file extensions per domain (with wildcards) using group policy but sadly said policy works only on domain joined computers. You could make something simple like the existing search engine customization UI where we could add domains and list of file extensions that can be downloaded without prompting from each domain. Wildcards for domain and for file extensions should also be supported.

If that is too much work, then the browser should at least remember my decision for that site on the first visit, and allow me to download from it next time without prompting.

In any case, this prompting is annoying and it needs to go. On Windows files are saved with Mark Of The Web so the operating system will prompt me when I try to start them anyway and then at least I will get shown additional info like publisher and whether it is signed or not to be able to make an informed decision. Built-in browser prompt is nothing but an annoyance at this point given how it doesn't give you any information about the file and expects you to decide only based on the filename. It just trains people to ignore warnings.

[fmarier]

Note that we now have a flag to disable these warnings entirely: #28917

[levicki]

@fmarier Thanks for letting me know. I would have preferred if this was possible to manage using GPO like in Microsoft Edge though. I am also skeptical about the longevity of the feature flag.

[fmarier]

I am also skeptical about the longevity of the feature flag.

We are no plans to remove that flag.

[levicki]

@fmarier

I am also skeptical about the longevity of the feature flag.

We are no plans to remove that flag.

And as I suspected, it no longer works (for me) in Brave version 1.60.114 Chromium: 119.0.6045.124 (Official Build) (64-bit).

Plans are one thing, the reality is usually much more ugly.