Re: [Bimi] (non)desire for bimi

[Thede Loder <[e-mail]>]

> On Feb 15, 2019, at 11:16, Stephen Farrell <[e-mail]> wrote:
> 
> Hi Terry,
> 
> Just on this point for now...
> 
> On 14/02/2019 23:36, Terry Zink wrote:
>>> In fact, my reading of bimi is that it does attempt to force a
>>> receiving MTA/MS to actively download the image(s) and replace
>>> the URL with one pointing at the MS (or nearby) - not doing so
>>> would expose users of the MUAs using that MS to tracking once
>>> those MUAs de-reference bimi URLs from the sender.
>> 
>> Where does it say that in the BIMI spec?
> 
> I'd have to go check the drafts again, but that's how it
> was described to me at [1] and that matches my recollection
> of the drafts.
> 
> Cheers,
> S.
> 
> [1] https://mailarchive.ietf.org/arch/msg/spasm/cf-jmY5tOx-zIdklMyfLGdp9YqY <https://mailarchive.ietf.org/arch/msg/spasm/cf-jmY5tOx-zIdklMyfLGdp9YqY>


Stephen, thanks for this reference.  While its technically possible that a receiver
might fetch a certificate at message-receipt time, receivers not wishing to 
enable sender tracking have another straightforward option: they can maintain 
access to the Certificate Transpareny logs, and therefore have a copy of 
every issued certificate (and their embedded list of FQDNs) and so retrieve
relevant contents without any outbound communication to the net.  In practice, 
receivers might implement daily DNS checks, during which they lookup and 
confirm the current BIMI record for the set of domains known to be publishing 
them, or to discover new ones that have begun doing so. 

Thede