The text ends "Launching a web app? Get a high-assurance SSL certificate and still launch on time." The moment you're deploying an _app_, you've already solved

The text ends "Launching a web app? Get a high-assurance SSL certificate and still launch on time." The moment you're deploying an _app_, you've already solved the hard problem that certificates are meant to help with. Just activate certificate pinning and you get a lot more security to boot. CAs "help" in the case where you're navigating to a site via a URL bar and you have no other stored information to help identify them. An app is stored on your device already, and doesn't have a URL bar so you don't need to care about the colour of the lock icon. Of course, in a world of apps and certificate pinning, the business model for CAs looks even more questionable than on the web. In theory, your bank's site should show a green lock and if you click on a phishing link, you get a nasty red one. In practice, you'll see red on your bank's page every now and then when they forget to renew their certificate and, to quote security researcher Peter Gutmann: "The only place you're guaranteed never to see a certificate error is on a phishing site. They don't use SSL at all, and people still visit them."