Yes they could do better, but who appointed Google "chief of web security"? Google can eff right off.