Google has released Chrome 86 to the stable channel , bringing a number of security improvements and new APIs for developers. When it comes to security, many of the improvements have to do with password-related upgrades.
The Password-checking feature is coming to mobile versions
In December 2019, when Google released Chrome 79, it brought a new feature called “ Password Checkup .” This feature takes a user ’s passwords and checks if they have been leaked online during data breaches at companies .
Since May 2020, this feature has been known as “Safety Check” and now, with Chrome 86, it will be available on the mobile versions of Chrome for Android and iOS.
Easy change of compromised passwords
Additionally, Safety Check itself is getting some updates to enhance security. Starting with Chrome 86, Safety Check will support the “.well-known/change-password” standard.
This is a W3C standard that allows websites to specify the URL that users can use to change their passwords. This means that users can simply click a button in Chrome's password settings and go directly to that page to change their password.
Authentication with biometric data on iOS
Google is also expanding its “touch-to-fill” feature to iOS. The feature was only released for Android devices in July. Touch-to-fill was created to prevent autofilling of passwords on phishing sites. It also allows users to fill in passwords on login forms with a simple tap of their finger, without having to search for the appropriate credentials.
With Chrome 86, this feature will also be available on iOS, where to enhance security, users will be prompted to perform biometric authentication before autofilling passwords. This includes using Face ID, Touch ID, or their phone's passcode as a last resort.
Safer browsing on mobile versions
“Enhanced Safe Browsing,” a security feature used to detect phishing and malware, is expanding to mobile versions of Chrome. The feature was released with Chrome 83 in May 2020, but only on desktop versions.
Warnings for insecure forms
Chrome 86 also displays warnings when entering data into “unsecure forms.”
Such forms, according to Google, are those hosted on encrypted HTTPS pages, but which secretly submit data via unencrypted HTTP operations.
Warnings for unsafe downloads
Google will also display warnings when downloading files over HTTP from pages that appear as HTTPS.
In Chrome 86, executables and archive files are blocked by default , and Chrome displays warnings for downloading Office-related documents.
FTP removal begins
With Chrome 86, Google will begin to gradually remove support for FTP links from Chrome:
Chrome 86: FTP is still enabled by default for most users, but it is disabled for pre-release channels (Canary and Beta) and will be experimentally disabled for the 1% of stable users. In this release, users will be able to re-enable it.
Chrome 87: FTP support will be disabled by default for 50% of users, but can be re-enabled.
Chrome 88: FTP support will be disabled.
The above are some of the most basic security improvements offered by the stable version of Chrome 86, as we read on ZDNet.
