Can Websites automatically install files just from clicking on them?

Pizzaman45 wrote:

If a website started downloading a file or installing it (i don’t know the difference) would it tell you or could it secretly do it if it were a malicious website or does apple prohibit this?

Downloads don’t happen by magic.

Downloads don’t happen in secret.

App installs don’t happen via website.

Websites cannot scan your device.

If any of that happened, we’d all soon be overrun with full devices and weird files and data breaches.

Where folks get in trouble is (for instance) accepting notifications from websites, or accepting calendar subscriptions, which advertisers can then use to yammer at users. Or believing that a website “scanned” your iPhone and “found (3) viruses!!!” or some such rubbish.

Since you’re asking security questions, some reading for you:

… Apple Platform Security - Apple Support

… Personal Safety User Guide - Apple Support

Both have PDFs available at the bottom, containing the entire document.

Pizzaman45 wrote:

Thanks for the reply! I saw a post where someone said a site automatically downloaded a file to their files app so that is why I ask. Is it possible for a file to download from a website in secret or would it tell you?

Hello. Thank you for your question.

The question is whether a website can “secretly” download a file.

Your question is also implicitly whether someone misrepresented, misunderstood, or got confused. Or met a bug.

Web sites work by serving HTML, and the browser rendering that and running ECMAScript or Web Assembly, and such.

Web sites can also stream video, audio, and other content. And can download and cache data and cookies.

Web sites can offer notifications and calendars, though those require the users to accept the chatter

Web browsers can sometimes get confused about a website-related file, and download it. This is very rare.

Web sites cannot download arbitrary files without permission. Were that “secret” download to happen, our devices would all quickly be full. Browsers work to prevent that download, and prevent HTML and ECMAScript and Web Assembly from escaping out of the browser context.

In simplest terms—and the modern web is ever-further from simple—web sites cannot download files in secret.

Pizzaman45 Said:

"Can Websites automatically install files just from clicking on them?:"

-------

You are welcome.

Automatic Installs from Sites:

Q1. "One more question, since nothing can be directly downloaded there, it is manually placed there correct like when you save a file you choose where in the files app you want it, a website wouldn’t be able to do all of this on your device correct?"

A1. The Web browser will download things as you perform things. But, it will not install it. As for where it would be downloaded, that would be based off of the default download locations.

Automatic Downloads from Sites:

Q1. "[...]The reason i ask is because i saw another question on here and the person said that the site automatically downloaded a file to their files app."

A1. It was probably an anchor within the HTML code that lead to the download. A common reply of mine --see the fist link --it is an anchor to the download location. So, download, install, and then run Malwarebytes for Mac, just to be safe.

Use MalwareBytes for Mac

This is software that searches for malware/adware. So, scan with it and then remove what is found. Once removed, uninstall MalwareBytes for Mac. Then restart the Mac. This software has been created by Long Time Users of these Forums. So, that makes it reliable for Macs.

Downloads:

1. Malwarebytes Anti-Malware for Mac
2. Malwarebytes uninstaller

Pizzaman45 Said:

"Can Websites automatically install files just from clicking on them?: If a website started downloading a file or installing it (i don’t know the difference) would it tell you or could it secretly do it if it were a malicious website or does apple prohibit this?"

-------

Downloads Vs. Installs:

• Downloading is taking it from another and placing it in a storage location on your computer ("Downloads" is the folder, by default of a Web browser).

• Installing is where you run an executable file, and it writes scripture on your drive.

• So, if you open the download, then that is when the install occurs.

• Installing something is action that you, as a user, muse perform.

• Once installed, things on its own can install --Such as automatic updates.

Pizzaman45 Said:

"Can Websites automatically install files just from clicking on them?:"

-------

You are welcome.

Q1. Cloud Storage:

"Ok thanks for the info! So could a website secretly download files to your phone via files app or onedrive or would it tell you."

A1. No. OneDrive and iCloud are storage services of their own --downloads cannot be downloaded directly to them, nor an an app be installed on it. So, telling you that is just not a thing that would ever occur.

Q2. Viruses and Hacked iPhones:

"The reason I ask is because i’m aware viruses are rare on iphone but my onedrive is connected to my pc and phone and i visited a sketchy website on my phone and worried if it secretly downloaded something like a malicious file"

A2. No. You'll never get a virus on your iPhone. Unfortunately, there is no way to determine if it has been hacked, unless you know that it has been jailbroken. The only way for an iPhone to have hacked is if it has been jailbroken.

Reset to Factory Settings:

If you are so concerned, then reset you iPhone to factory settings, as if you were to sell it. Go here: What to do Before you Sell, Give Away, or Trade in your iPhone, iPad, or iPod touch - Apple Support. Perform as instructed there, including the backup creation and iCloud logout.

Pizzaman45 Said:

"Can Websites automatically install files just from clicking on them?"

-------

Websites Automatically Installing Files:

It would download, but not install. If the link is an anchor to a downloadable item, then a download can occur on its own.

Pizzaman45 wrote:

Thanks once again! So a website will not be able to save random files to my files app and place them in places such as onedrive correct?

In simplest terms—and the modern web is ever-further from simple—web sites cannot download files in secret.

Where and how a particular file arrived, whether it involved a user or an app, or whether something expected or unexpected happened within OneDrive, no one here can answer.

Given how you are repeating the same question, I’d assume there is much more to this than you have stated, and would suggest discussing whatever did or did not happen with a lawyer.

You will either see an icon next to the site name, or if you click AA there will be a downloads section where you can check downloads.

Pizzaman45 Said:

"Thanks for the reply again! So you’re saying he was probably prompted to download something just from clicking the website, is that what an anchor is or is it a link that will start a download without user permission"

-------

Yes.

A Web site contains the anchor within its HTML code. The link accesses the anchor. Here is a direct link:

https://www.malwarebytes.org/mac-download/

Viewing the Source Code:

Create a Bookmark with the code I've provided at my user tip: How to: View a Web Page's HTML Code in Plain Text (Courier New) - Use Tip

Pizzaman45 wrote:

Sorry but these answers are over complicated for me to understand. My basic question is yes or no, if a website downloaded a file on iphone, would it tell you like show you on the screen?

The shifting questions you are asking here are more subtle and more complex than you realize.

If I give you the “simple” answer you seek, it will be both right, and wrong.

But if I give you that far too simplistic answer, sure, file downloads will be initiated by user activity.

Pizzaman45 Said:

"Thank you! So would an individual website be able to download files to your iphone files app or only to the browser? Doesn’t apple not allow other applications to access others so would this prohibit a website from doing this without permission and if it did, it would tell you that something is downloading correct? files can’t secretly download from a website right?"

Go Apple-for-Apple:

Don't worry it. All Apple devices are safe from Viruses. Apple has an App Store, and that is where to get the apps. So, scan you Mac with Malwarebytes Anti-Malware for Mac, and you'll be set. The free version is all you need. Qs for an iPhone, purchase it from Apple, and you'll be safe.

Use Time Machine:

Things will download, and backing up your devices is ideal for instances like this. Be certain you Create a Time Machine Backup of your Mac every so of often, so that way you can have something to restore your Mac from, should anything go wrong. I create one prior to every update and app install.