Take a look at below picture.
This page is not loaded over https, so how do modern browsers make sure this page is secure?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
What is there to secure it from? It's loaded directly within the browser. There is no connection outside of the local user context of the machine meaning there is nothing to intercept / tamper with.
To modify what you see you'd have to either modify the browser executable, memory space or modify the underlying data used to store the settings. To read the values you would have to be able to read either the browser memory space or underlying files. All of these are end-game. If a malicious actor can do that they have full control and there is no way to protect from it.
This page is not loaded over https
It's not loaded over anything. The browser is just displaying it within a browser frame because that frame already has the ability to display web forms so the same code is used to display this form, even though it doesn't come from the web.
As other answers have said, the page is secure because it is loaded from the browser, not transmitted or accessible by anyone else.
But why does Chrome bother marking such an obviously secure page as secure? To mitigate any phishing attempts. It would be trivial to make a fake 'settings' page and serve it to you to trick you into taking actions. (It seems unlikely to me someone would actually fall for opening a fake settings page, but users' gullibility always amazes me.)
This flag is just one more attempt at trying to make users more aware to avoid silly mistakes, since they are by far the weakest link in the security chain.
Settings pages are loaded from the local machine, they aren't fetched over a network and therefore can't be subject to a MITM attack. Some of these pages may request actual web resources, but these are usually received over HTTPS.
Also, browser vendors have established certain pseudo-protocols to distinguish the often privileged settings/system URLs from web resources. Examples of these are
chrome:. As an additional measure of protection, most of these URLs can't be opened from an unprivileged domain.
That is, a normal website can't even open (or link to) the browser settings page:
Look at the protocol. It is chrome:// not https.
The Internet has dozens of protocols and each one has its own security model (or lack thereof).
sftp is secure,
ftp is not,
irc is not, etc.
file:// only accesses local files on your hard drive. It doesn't communicate across the Internet at all, so it is secure.
chrome:// is similar. It stays within Chrome and is not passed anywhere, so again, secure by nature.
It's just like opening a locally stored text document.
There is no communication with another server while opening the text file and the only way for the contents of the file to be changed is if an attacker has direct access to the system.
It's a secure way to observe the contents of a file.
In the case of the settings page, it's not loaded from a web server, it's just displayed in Chrome as if it were a website.
The pages are loaded locally, which means you can load any chrome:// page without internet connection.
For that reason, theres nothing to intercept since no information ever gets transmitted to the internet (except of course for things like downloading updates, in which case it will use https to download).