Re: [Bimi] (non)desire for bimi

[Thede Loder <[e-mail]>]

> On Feb 14, 2019, at 13:44, Stephen Farrell <[e-mail]> wrote:
>> On 14/02/2019 17:08, Terry Zink wrote:
>> Are you saying these are all fine but in the sender photo it isn't?
>> What's the fundamental difference between seeing a company's logo in
>> the sender photo vs seeing it in the body of an email? Is it just a
>> matter of turning of HTML and preventing those from loading?
> 
> I don't see sender photos and do not render HTML, except on
> mobile device MUAs where I do not get that choice, which is,
> for me, negative. Were bimi standardised it is entirely
> unclear to me how various MUAs might handle it. But I very
> much doubt that mobile device MUAs would provide that level
> of user-control for bimi as they do not for bodies. And all
> of us here are likely far more capable of configuring things
> than most users.

Hi Stephen, 

Knowing your personal dislike of HTML-based email, and also that ~1 billion  
people read HTML email messages each day, many of whom like seeing 
graphics, tables, and other mark up, would you have proposed back when 
it was being considered for standardiation that it should never be developed 
or standardized?  


> 
>>> As someone who sends email (not as a bulk sender) from various
>>> domains that I operate, I do not want to pay €€€ to someone for an
>>> additional cert, nor for an "approved" logo, in order to increase
>>> the chances that my mail gets delivered.
>> 
>> Nobody is going to make you buy a cert, nobody is going to make you
>> buy a logo, and so forth. It's up to you.
>> 
>> BIMI is an add-on; it augments the default experience, the lack of it
>> doesn't downgrade the default experience.
> 
> Perhaps. Nonetheless there is at least one large mail service
> that sends all mail from some domains I operate (that have never
> sent spam and that have had stable IP addresses for years, DKIM
> etc all good) to /dev/null and who won't respond to any form of
> poking to try get that fixed despite a number of attempts. And
> that provider is used (as MX) by people with whom I do need to
> correspond, so I'm forced to use a different mail a/c to mail
> those folks.
> 
> Yes I do indeed fear that bimi could and would be (ab)used by
> some services to do more such dis-service. ISTM that damages
> the mail environment rather than enhances it.

Your fear is justifiable.  

One can imagine future anti-spam or anti-fraud systems.  They could  
include message scoring functions that assign messages 
from domains lacking authentication setup (or which do not have a valid 
VM Cert) lower scores.  And one can also imagine that this scoring 
strategy will have a larger negative impact on deliverability if too few 
other post-delivery derived reputation signals are available for a given 
sender.  In other words, low volume and newly registered domains.  

While potentially raising the costs differentially to prohibative levels 
for some of the “bad guys”, cost is also raised for those who were not 
causing harm under the original system design; the ‘good actors’ have 
increased costs to continue to to get what they had before.  

An analogy here from the offline world: “Because criminals abused 
ID-less open flying previously the norm for air travel, a system was 
implemented in which everyone must now present IDs at airports; 
if fliers do not have IDs they have to bear the costs of going out and 
getting them, whether or not they were a good actor or a bad actor.  “  


I think the relevant question is: 

If BIMI adoption contributes to a shift in the norms and certain costs 
associated with effectively using applicable existing media, on the 
balance, have we made these media better for the actors we care 
about?  


>> 
>> Again, I'm unclear about the context of this statement. Nobody is
>> going to make you as a sender, brand, or receiver send with BIMI.
> 
> I'm afraid that continues to be a concern of mine. (As an aside,
> I am not a "brand" and have no ambition to become one:-)
> 
>> Nobody is going to make you retrieve logos from a store, nobody is
>> going to make you verify any log, nobody is going to make you process
>> additional headers.
> 
> In fact, my reading of bimi is that it does attempt to force a
> receiving MTA/MS to actively download the image(s) and replace
> the URL with one pointing at the MS (or nearby) - not doing so
> would expose users of the MUAs using that MS to tracking once
> those MUAs de-reference bimi URLs from the sender.

Tracking is a concern and my personal take is that I’d like to see it 
become either impractical or completely transparent (or both)?.   
Can someone from the Authindicators Working Group comment on
Stephen’s interpretation?   Stephen, can you point us to a section?  


> 
>> Instead, it's about enhancing the email experience for those
>> motivated to do so. And, BIMI provides a way to do this.
> 
> I realise that's your/the proponents position. Mine is that
> bimi is only a negative.

This is certainly a valid position, and thank you for stating it.  This is 
in part what having a dialogue is about.