[Bimi] Affiliation Bias (was: Re: Thoughts about MUA/BIMI)

[Dave Crocker <[e-mail]>]

On 8/11/2022 7:38 AM, Todd Herr wrote:
> I've got a long-standing bias toward the idea that the only 
> authentication/validation results that matter are the ones that were 
> arrived at when the message was written to the mailbox, because 
> results can be different upon subsequent checks,

Todd,

For authentication methods built primarily to be used to handle 
transit-time concerns, that bias makes sense.  When the authentication 
requirement includes functioning over extended periods of time, 
obviously it doesn't.  SPF, DKIM and DMARC encourage a bias towards 
shorter-term use because of the operational variability of DNS entries.  
It's not that a DNS entry cannot exist for a very long time; it's that 
it is so easy to change it or delete it, on a whim.

For something like Bimi, there is a danger of the tail wagging the dog.  
Rather than considering the nature of legitimate use and designing to 
accommodate it, pursue a Procrustean engineering design and operations 
model that cuts off otherwise-legitimate use cases that don't fit 
convenient technical choices. This is always a danger when starting with 
an existing technical foundation and layering on additional 
functionality, in the absence of a thorough exploration of the 
boundaries to legitimate use cases.

Relying on SPF, DKIM and DMARC for authentication certainly encourages 
an operational model that makes verification much after delivery risky. 
In a fully-integrated email platform provider model , which tightly 
couples the MUA, the delivery-time validation results can be stored with 
the message.  On the theory that the validity of displaying the logo 
long after validation is safe -- that is, assuming no problems, such as 
discovery of compromise, legal change of use authorization, or the like 
-- then storing the result for a long time is probably ok.

To that end, it's not clear why the platform provider cannot attach the 
result, etc. to the email object it hands to an unaffiliated MUA, as 
long as the details for doing this are standardized.  It's not as if the 
technical aspects of this are difficult, and it is not obvious how the 
semantics or risks are different.

To the extent that there is a concern that a result stored inside a 
tightly-integrated MUA environment is somehow trusted more that a result 
stored in an object passed to an unaffiliated MIA, my question is why?  
What makes the former more trusted than the latter?  It's possible that 
answering this question will disclose some useful aspects to the trust 
model being used here.


d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net