Re: [Bimi] MUA Evaluation of BIMI

[Dave Crocker <[e-mail]>]

On 3/14/2022 9:27 AM, Ken O'Driscoll wrote:
> If people begin to see value in supporting BIMI at the MUA level, then they will do so with or without the endorsement of the specification. However, if the spec. clearly articulates implementation considerations and risks, then it can only be a good thing.


I'd class it more than merely a Good Thing.

Given that BIMI relies on underlying, security-related protocols, and 
BIMI itself makes validation efforts, I'd class a serious risk, threat, 
etc. analysis -- and guidance -- to be essential, professional due 
diligence.

It's not just that people 'might choose' to do a particular 
configuration, it's that the nature of the service is end-to-end and all 
of the mechanisms can easily be placed in those end points.  So when 
someone puts an essential component somewhere else, THAT is when there 
should be concern.

In other words, BIMI (and DMARC with DKIM) all work perfectly well in 
the MUA.  So should BIMI.  And when a component is placed elsewhere -- 
as is both reasonable and likely -- then it needs to be accounted for 
during design and specification, not later when it finally starts 
getting deployed.

d/


-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net