Are there any security reasons why a network admin would block downloads over HTTP, but allow them over HTTPS?
If we talk about static file downloads without any authentication, the ability to ensure data integrity is one reason. However, encrypting the connection is just one tool for that as you could also use checksums to make sure that the data haven't been modified during the transmission.
However, blocking all HTTP downloads from anywhere will cause more problems than it would solve, as some content is only available on HTTP. From the opposite perspective, it's perfectly fine to provide downloads only via HTTPS for data integrity, and it additionally helps protecting the information on who downloaded what.
On the other hand, HTTP downloads have one advantage from the perspective of network administration: you can run virus (and other content) checks against the file in a firewall/UTM, before it even gets to the client computer. With HTTPS you would need to decrypt the TLS first; that would technically be a man-in-the-middle attack, while it has a legitimate purpose.
I think yes, there are some reasons why downloads via http could be dangerous.
- without https you could suffer of Man-In-The middle attacks.
- e.g. somebody tries to download software from a trusted page, but instead he gets a file with a virus
- without https you can see the full request uris in your http traffic, with https you see only the hosts
- if you do download from a page with http-login, someone could "see" your login-data when you are not using https
I think because HTTPS is an encrypt message and protects your download content against eavesdropping and tampering