If they understand that they are bound to respect this, why don't they add the name constraints to their CA certificate?
The problem as I see it is that whatever method used is optional and insufficient to protect users until the browser highlights the source is not real public trust. Google knows this and started with the claim they prioritize user security while ending with the work around to prioritizing user security. (And without the slightest warning that sending your users to a bunch of financial institutions using improper trust chains is ethically dubious and requires more consideration than the time it takes to click the settings.)
Name constraints have not been supported by browsers for very long. And they can’t solve this problem for private CA certificates that already exist. (Hmm, I wonder if issuing a new CA certificate with name constraints using an existing private key could be made to work.)
Comments
If they understand that they are bound to respect this, why don't they add the name constraints to their CA certificate?
The problem as I see it is that whatever method used is optional and insufficient to protect users until the browser highlights the source is not real public trust. Google knows this and started with the claim they prioritize user security while ending with the work around to prioritizing user security. (And without the slightest warning that sending your users to a bunch of financial institutions using improper trust chains is ethically dubious and requires more consideration than the time it takes to click the settings.)
Name constraints have not been supported by browsers for very long. And they can’t solve this problem for private CA certificates that already exist. (Hmm, I wonder if issuing a new CA certificate with name constraints using an existing private key could be made to work.)