Re: [Bimi] Thoughts about MUA/BIMI

[John C Klensin <[e-mail]>]

--On Thursday, August 11, 2022 10:38 -0400 Todd Herr
<todd.herr=[e-mail]> wrote:

> On Thu, Aug 11, 2022 at 10:21 AM Brotman, Alex <Alex_Brotman=
> [e-mail]> wrote:
> 
>> In thinking more about the MUA proposal, we are trying to
>> find a solution for the case where an unaffiliated[1] MUA
>> would like to be able to either independently validate
>> message authentication details (to support DMARC), or rely
>> upon the validation process from the MBP.
>> 
>> [snip]
>> 
> 
> I've got a long-standing bias toward the idea that the only
> authentication/validation results that matter are the ones
> that were arrived at when the message was written to the
> mailbox, because results can be different upon subsequent
> checks, mainly due to potential differences in the
> resolvability and content of the various DNS records retrieved
> during the validation processes.

I have the same bias, but it leads me to a different place.
That, again, is to conclude that the BIMI data is content
information, best expressed as a body part.  Body parts,
signatures over them, and other validation are far more stable
than header fields and combinations of them.  And, of course,
they do not require interactions with DMARC at all.  In
addition, body parts generally survive message forwarding, which
ought to be an advantage in this case.

> In this case, my bias would argue for the unaffiliated MUA to
> do no validation, and instead rely on signals inserted in the
> message by the MBP at the time of delivery.

Which turns things into a very complex "who do you trust"
problem in which transmitting a BIMI not only requires an
affiliated MUA but an affiliated MBP that can prove its
trustworthiness to both the receiving user/MUA (which we usually
assume, but it is not hard to imagine attacks) and to the
originating or brand-attaching system(s).

> I recognize, however, that this method is fraught with peril,
> specifically due to the possibility of forged headers inserted
> by abusers and ignored by MBPs that are not BIMI-aware. I also
> recognize that the idea of results changing due to new
> information being available is not always a bad thing, as I
> recall some MBPs in the past talking about automatically moving
> messages from the Inbox to the Spam folder based on new
> information learned after the message was written to the
> mailbox (assuming, of course, that the message had not yet
> been seen by the recipient).

Yes, all of the above.

> On the other hand, I also recognize that attempts by an MUA to
> perform authentication/validation checks on messages are
> perhaps not as thorough (Alex's message recommends against
> doing any SPF check) and that the DKIM result might
> erroneously be "fail" due to changes made by the MBP during
> writing of the message to the mailbox, even if it passed DKIM
> checks performed by the MBP.
> 
> I'm trying to talk myself out of my bias, but I can't get
> there yet, because I can't yet see a way for the unaffiliated
> MUA to get the same results as the MBP got at the time of
> delivery.

And, again, that leads me in the direction of a body part and
special content type and not having to mess with or rely on
message header information at all.

 best,
   john