Re: [Bimi] Today's BoF

[Wei Chuang <[e-mail]>]

*From: *John C Klensin <[e-mail]>
*Date: *Tue, Apr 2, 2019 at 2:03 PM
*To: *John Levine
*Cc: * <[e-mail]>


>
> --On Tuesday, April 2, 2019 15:54 -0400 John Levine
> <[e-mail]> wrote:
>
> > In article <DD71F5FAA85F312FDB5EF7E4@PSB> you write:
> >> ...  So someone comes
> >> along, someone who is clearly not BigCo, and obtains
> >> BigCo.evil (remember, all they need is ability to pay and an
> >> email address).   They have little trouble obtaining
> >> certificates in that name because, as far as the DNS
> >> environment is concerned, they legitimately hold it.
> >
> > Nobody is assuming that you can get a bimi cert (or whatever)
> > merely with a domain name similar to the target trademark.
>
> Understood.   However, unless just about every MUA in the world
> was upgraded to understand the difference between a bimi link
> and cert, I can't imagine a typical user being able to tell the
> difference between a bimi-blessed logo (or whatever) and the
> same logo presented via some other mechanism.
>

Those are really good points.  The main solution will be that the MUA has
to help the user navigate through the UI (and done carefully).


> If I correctly understood last week's discussion, bimi is
> dependent on mechanisms, including DKIM/SPF/DMARC that are,
> unless I'm missing something, dependent in turn on some
> assumptions about binding of the identity of a domain name
> holder with the domain name.   My point was one cannot push
> those assumptions very hard without running into questions of
> registrar integrity and what it means to own (or hold) a domain
> name.
>

Yes BIMI very much depends on the integrity of the DNS system, both at the
registrar level and the protocol.  The latter might be defended by DNSSEC.
If that's not to your liking and attacks like Route 53 are more common
place, we could use only DKIM/DMARC and require that the DKIM public key
align with the certificate's public key.  Regarding the former, agreed
that's issue.  If attacks like what Dave disclosed (DNSpionage), then we'll
need to depend less on DNS or at least detect the attack.  Again the just
mentioned DKIM/DMARC restriction can help.  This all said if we have
serious worries about DNS being authoritative, then a bigger issue is
outside of BIMI i.e. the domain based authentication system that's very
much deployed and used extensively by receivers.

-Wei


> And, before you tell me that, statistically, everyone is using
> web interfaces and MUAs don't count and/or that statistically
> everyone is using one of those gorilla systems so it is
> reasonable to ignore the deployment issues for the tiny minority
> of people who are left, I suggest that a corollary to those
> conclusions is that a code of common practices among said
> gorillas and an advertising campaign to try to convince people
> that they would much safer if they didn't communicate with, or
> accept mail from, anyone who was not using a gorilla system.  Of
> course that approach would have interesting antitrust
> implications, but that, statistically, has not be a problem yet,
> so why worry?  :-(
>
> >  I
> > gather that one of the gorillas accidentally made this mistake
> > in their informal logo collection system and a motivation for
> > bimi is to keep it from happening again.
>
> If one conbines that sentence with the "Nobody is assuming..."
> one above, then a motivation for bimi is to cure (or prevent)
> stupidity.  Perhaps it will work this time, but the track record
> of other efforts to apply such cures has not been good.
>
> > Of course this returns us to the major question of whether it's
> > possible to invent an effective system to check bimi
> > applications.  I could invent one that involved a staff of
> > trademark lawyers, but I don't think anyone outside the S&P
> > 500 would find that usable.
>
> Indeed.
>
> best,
>    john
>
> --
> bimi mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/bimi
>