Chrome 84 released with support for blocking notification popups on spammy sites

Image: Google

Google has released today Chrome 84 to the Chrome official stable channel. Users can update Chrome using the browser’s built-in update feature to move to this new release and get access to new features and security updates.

Chrome 84 is not a massive release when compared to previous Chrome versions as it contains very few changes to the Chrome UI or with user-facing features. Instead, the vast majority of new additions are to Chrome’s underbelly — its developer tools and Web APIs.

Edge Super Duper Secure Mode turns off the JavaScript JIT compiler for extra security

Security company warns of Mitsubishi industrial control vulnerabilities

Black Hat: This is how a naive NSA staffer helped build an offensive UAE security branch

In this release, we have a new Web OTP API, a new animations control system in the form of the new Web Animations API, and a few experimental features such as the Wake lock API, the Idle Detection API, and the Content Indexing API.

Furthermore, Chrome 84 is also the first Chrome release that blocks notification popups on websites that are known to abuse this feature, a feature that has already shipped with Firefox to great reviews since late last year.

Below is a rundown of all the new major features.

Web OTP API

The Web OTP API is actually an Apple creation, but which Google eventually agreed to support. It’s a new system through which mobile web browsers can detect incoming SMS messages that contain one-time passcodes (OTP) sent as part of two-factor authentication (2FA) procedures.

The new API allows Chrome to detect the incoming SMS message and automatically import the one-time code into a web page just by a single screen tap from the user. The API was created as a way to standardize OTP SMS codes, but also as a security feature to protect users from OTP phishing attacks.

Web Animations API

The Web Animations API sounds like a fancy name, but, in reality, is just a collection of new JavaScript functions that developers can use to have much better control of animation sequences that take place inside a web browser.

Details about this new API are available here.

Screen Wake Lock API

This is an experimental feature that was added as a trial inside Chrome. It’s not entirely decided if this will remain in Chrome going forward.

However, it is a very useful feature, and one that’s very likely to stick around. According to Google, the new Screen Wake Lock API provides a way to prevent devices (smartphones and tablets) from dimming or locking the screen when a Chrome browser needs to keep running.

Websites need to ask permission from users for this API to be used. Expect the API to be used on cooking websites that show the steps of a recipe; websites that show barcodes, tickets, or other content that needs to be scanned; and for online games were interaction with the screen is not needed all the time but the user is clearly looking at the screen (such as sudoku or other similar puzzle games).

Idle Detection API

Another experimental feature added in Chrome, solely for developers to play around with, is the new Idle Detection API. As its name hints, this new developer tool lets website owners and Chrome app developers detect when a user has become idle — such as when Chrome detects a lack of interaction with the keyboard, the mouse, the phone screen, the screensaver becomes active, the phone screen gets locked, or the user moves to a different screen.

Expect more websites to use this API to shut down or pause CPU-heavy operations and help users save battery life.

Content Indexing API

The new Content Indexing API is also an experimental feature. It’s a purely developer tool and is basically a list of resources that Chrome has already cached about a web page or web app.

Developers will use this feature to create better offline viewing experiences, allowing them to cache content locally with a better accuracy and make sure websites don’t break when there’s no internet connection or the connection has temporarly timed out.

No more notification spam

Chrome 84 is also the first Chrome version where notification popups on some sites (with a spammy reputation) are now hidden by default. Notification popups on these sites are now hidden under an icon in the Chrome URL bar.

See Google’s official explanation on how this new feature works.

Chrome removes TLS 1.0 and TLS 1.1

Google has now removed support for the TLS 1.0 and TLS 1.1 ciphers. These two ciphers are considered insecure. Websites that load via HTTPS and use these two ciphers will be blocked in Chrome by default and users will see an error message like the one below.

Chrome and all other major browsers have announced plans to dump TLS 1.0 and TLS 1.1 since 2018, so most websites have already updated their HTTPS certificates. However, there’s always sites that lag behind. Users should expect some of these messages to pop up once in a while as they try to access older or unmaintained websites.

Just like many recent Chrome features, this was actually scheduled to go into effect earlier this year, in Chrome 81, but Google delayed its rollout because of the coronavirus pandemic. Google believed this would have resulted in extra work for webmasters and system administrators who were already busy dealing with new work-from-home schedules.

Chrome blocks downloads for files hosted on HTTP URLs

Starting today, Chrome will also show visible warnings for files downloaded via HTTP from HTTPS sites.

Google calls this “mixed content” and it considers it a dangerous practice as it gives users the impression they’re downloading files safely via HTTPS because of the HTTPS in the address bar, but says users might not be aware that the actual download takes place via HTTP.

This new downloads “alerting” system was planned to go into effect with Chrome 82, but Google delayed it to Chrome 84 after the COVID-19 outbreak messed up Google’s Chrome release timeline and Chrome 82 got canceled altogether.

The “download warnings/blocks” will start with Chrome 84 and will only a small subset of file types in the beginning (executables in Chrome 84). Google said they’ll cover all the dangerous file types eventually, and plans to add new file types to be blocked with each new Chrome release until Chrome 88. A detailed rollout plan is available here.

But we only touched on the major Chrome 84 additions. Users who’d like to learn more about the other features added or removed from the Chrome 84 release can check out the following links for more information.