Comment #13 on issue 2541 by [email protected]: Opening a site using "--app" does not allow you to see if the site uses SSL correctly http://code.google.com/p/chromium/issues/detail?id=2541
sketchee: An SSL indicator confirms that you have a secure connection to the server in the address bar. Without an address bar, there is no use for an indicator. When you create an --app shortcut, you should check that you are using the right address and that the connection is secure (if you want a secure connection) before you create it. After that, you should always be secure. As you mentioned, there are two things that can change your security after you have created the shortcut: 1) An attacker could modify the shortcut. This would allow him/her to take over your machine completely anyway, so there is no use in supplying an SSL indicator. 2) An attacker could compromise the website. This would allow him/her to take over the website including SSL, so there is no use in supplying an SSL indicator. I see no scenario in which an SSL indicator could add any value. -- You received this message because you are listed in the owner or CC fields of this issue, or because you starred this issue. You may adjust your issue notification preferences at: http://code.google.com/hosting/settings --~--~---------~--~----~------------~-------~--~----~ Automated mail from issue updates at http://crbug.com/ Subscription options: http://groups.google.com/group/chromium-bugs -~----------~----~----~----~------~----~------~--~---
