Re: [Bimi] (non)desire for bimi

[Terry Zink <[e-mail]>]

Hi, Stephen,


I won't respond to all of your points, only a handful in the interest of keeping these responses manageable.


> The desire for dancing kittens in HTML body parts does sometimes
> make emails less comprehensible. I reckon incorporating images as
> per bimi would have a similar effect.


Do you think it's kind of a stretch to equate dancing kittens and general late-90's annoyance in HTML with a sender photo? Even in my mail client right now, there's a sender photo - it's a letter "B" for bimi @ ietf.org. If my email client decided to show the logo for the IETF instead, you'd find that as distracting as loud HTML?

> But I very much doubt that mobile device MUAs would provide that level
> of user-control for bimi as they do not for bodies. And all
> of us here are likely far more capable of configuring things
> than most users.


It sounds to me like you're saying you want to turn off BIMI logos in an email client. All you need is a checkbox in the MUA?


>> Again, I'm unclear about the context of this statement. Nobody is
>> going to make you as a sender, brand, or receiver send with BIMI.

> I'm afraid that continues to be a concern of mine. (As an aside,
> I am not a "brand" and have no ambition to become one:-)


I'm trying to understand your position here, but I still don't get it.


BIMI is an add-on service; literally every domain in the world could publish a BIMI logo, and you might not, and you'd be none the wiser if you stuck to your plain text emails and MUAs. Are you saying that email receivers would eventually then force you to set up a BIMI record because the lack of it would cause your email/domain to suffer deliverability problems? That they would eventually strong-arm you into publishing BIMI records?


>> Nobody is going to make you retrieve logos from a store, nobody is
>> going to make you verify any log, nobody is going to make you process
>> additional headers.

> In fact, my reading of bimi is that it does attempt to force a
> receiving MTA/MS to actively download the image(s) and replace
> the URL with one pointing at the MS (or nearby) - not doing so
> would expose users of the MUAs using that MS to tracking once
> those MUAs de-reference bimi URLs from the sender.


Where does it say that in the BIMI spec?


I helped write and edit some of the first documents for BIMI. For the brand, you upload an image somewhere, and create a DNS record that points to it. You then have it signed so that it can be verified by an email receiver. As a mail receiver, you use a bunch of DNS checks along with standard email auth checks to figure out where and if to pull the image.


As an email receiver, you could choose to pull it from where the brand publishes it (and therefore deal with the unreliability of everyone else's architecture), or you could pull it locally and replicate it on your own infrastructure. Indeed, that's already done today. If I'm an email receiver and I'm showing images based upon my best guess of what a brand's logo is, and a brand instead tells me what the authoritative source is, then I go pick it up from there instead of scraping it from the web.


If BIMI requires the things you say it does, I'd like to understand where.

-- Terry

________________________________
From: Stephen Farrell <[e-mail]>
Sent: Thursday, February 14, 2019 10:44 AM
To: Terry Zink; [e-mail]
Subject: Re: [Bimi] (non)desire for bimi


Hi Terry,

(I agree with both John and Dave's points upthread so will try
not repeat those, but I'm happy to elaborate if it's useful.)

On 14/02/2019 17:08, Terry Zink wrote:
> Thanks for your comments, Stephen. Here are my thoughts.
>
>> I'd be interested in some kind of verifiable backup for that "clear
>> demand" claim
>
> To me, it seems intuitively obvious. For example, in the Office 365
> web interface, I see logos from several different companies in the
> list view and the sender photo when I open the message - Amazon,
> Lyft, Facebook, LinkedIn, Netflix, BackCountry, Quora, etc (this is
> displayed via Microsoft's Brand Cards program). My old Yahoo Mail
> interface has something similar. For a while, Gmail showed a company
> logo pulled from its Google+ page.
>
> How does this not show demand? Isn't this an example of web mail
> providers wanting to enhance the user experience, and companies
> happily obliging, and me as a user being pleased?
>
> I am not representative of the entire space, but I really *like*
> those sender photos.

Right. And nor am I representative in my dislike of such.

>
>> I use the Internet. I do not want logos added to mail headers that
>> increase the attack surface of my MUAs, (and MS/MTAs), that likely
>> enable additional tracking of mail users, including me, and where
>> mobile device and web MUAs are unlikely to offer me an option to
>> turn all that off, even if some desktop MUAs might (eventually), at
>> the risk of making messages harder to comprehend.
>
> I'm not sure I understand this comment.

I'm not sure which bit of my para above you mean. If it's the last
point - I often get mail now where substantive parts of the mail
are only present in HTML and I don't render that in my latop MUA,
which forces me to occasionally delve into the raw message to
find out what some correspondent means. The desire for dancing
kittens in HTML body parts does sometimes make emails less
comprehensible. I reckon incorporating images as per bimi would
have a similar effect.

> The logos are not added to
> mail headers, but instead headers point to a location where the logo
> can be picked up and then shown to the end user. What's the
> difference between the sender/brand providing an authoritative source
> (DNS record that points to a CDN) vs Office 365/Yahoo pulling from
> their own internal database?

Aside from John and Dave's points another difference is that I
don't need to care about the latter, (as I don't use 'em)
whereas where bimi a standard that got deployed then my MUA may
add such (from my POV) broken-ness.

>> I also just do not want to see your logos, thanks.
>
> Again, I am not sure I understand this comment.

John answered that I think.

> Logos are everywhere. Most large companies have Facebook and Twitter
> pages, and they all have logos. You see logos painted on the sides of
> walls, on stores, on TV, in newspapers, on web pages, as favicons,
> etc.
>
> Are you saying these are all fine but in the sender photo it isn't?
> What's the fundamental difference between seeing a company's logo in
> the sender photo vs seeing it in the body of an email? Is it just a
> matter of turning of HTML and preventing those from loading?

I don't see sender photos and do not render HTML, except on
mobile device MUAs where I do not get that choice, which is,
for me, negative. Were bimi standardised it is entirely
unclear to me how various MUAs might handle it. But I very
much doubt that mobile device MUAs would provide that level
of user-control for bimi as they do not for bodies. And all
of us here are likely far more capable of configuring things
than most users.

>> As someone who sends email (not as a bulk sender) from various
>> domains that I operate, I do not want to pay €€€ to someone for an
>> additional cert, nor for an "approved" logo, in order to increase
>> the chances that my mail gets delivered.
>
> Nobody is going to make you buy a cert, nobody is going to make you
> buy a logo, and so forth. It's up to you.
>
> BIMI is an add-on; it augments the default experience, the lack of it
> doesn't downgrade the default experience.

Perhaps. Nonetheless there is at least one large mail service
that sends all mail from some domains I operate (that have never
sent spam and that have had stable IP addresses for years, DKIM
etc all good) to /dev/null and who won't respond to any form of
poking to try get that fixed despite a number of attempts. And
that provider is used (as MX) by people with whom I do need to
correspond, so I'm forced to use a different mail a/c to mail
those folks.

Yes I do indeed fear that bimi could and would be (ab)used by
some services to do more such dis-service. ISTM that damages
the mail environment rather than enhances it.

>> I also do not want to have to check if someone else has abused a
>> logo I may use in some CT log. I do not want to have to process
>> additional headers in my MTAs nor retrieve and store your logos in
>> some new image store. I do not want to have to deal with any of the
>> new problems that'll arise when any of that breaks.
>
> Again, I'm unclear about the context of this statement. Nobody is
> going to make you as a sender, brand, or receiver send with BIMI.

I'm afraid that continues to be a concern of mine. (As an aside,
I am not a "brand" and have no ambition to become one:-)

> Nobody is going to make you retrieve logos from a store, nobody is
> going to make you verify any log, nobody is going to make you process
> additional headers.

In fact, my reading of bimi is that it does attempt to force a
receiving MTA/MS to actively download the image(s) and replace
the URL with one pointing at the MS (or nearby) - not doing so
would expose users of the MUAs using that MS to tracking once
those MUAs de-reference bimi URLs from the sender.

> Instead, it's about enhancing the email experience for those
> motivated to do so. And, BIMI provides a way to do this.

I realise that's your/the proponents position. Mine is that
bimi is only a negative.

Cheers,
S.

>
> --Terry
>
> ________________________________ From: bimi <[e-mail]>
> on behalf of Stephen Farrell <[e-mail]> Sent:
> Thursday, February 14, 2019 2:57 AM To: [e-mail] Subject: [Bimi]
> (non)desire for bimi
>
>
> (Sorry for not replying in-thread but I just subscribed to the list,
> and this perhaps also deserves a separate thread.)
>
>>>> * Internet users want it - clear demand
>>>
>>> That claim keeps being made but I've never seen any serious
>>> documentation for it.
>>
>> Marketing people want it -- that may not be documented but I have
>> sufficient anecdotes to hand to believe it be the main driver
>> here.
>
> I'd be interested in some kind of verifiable backup for that "clear
> demand" claim - I'm unaware that such exists, other than perhaps as
> Richard says for marketing purposes, and ISTM those purposes are
> amply met already via mail bodies.
>
> Meanwhile...
>
> I use the Internet. I do not want logos added to mail headers that
> increase the attack surface of my MUAs, (and MS/MTAs), that likely
> enable additional tracking of mail users, including me, and where
> mobile device and web MUAs are unlikely to offer me an option to turn
> all that off, even if some desktop MUAs might (eventually), at the
> risk of making messages harder to comprehend.
>
> I also just do not want to see your logos, thanks. Imposing those on
> me would decrease the utility of mail. And regardless of what PKI
> were built I would not treat bimi'd messages any better, more likely
> I'd consider them badly.
>
> As someone who sends email (not as a bulk sender) from various
> domains that I operate, I do not want to pay €€€ to someone for an
> additional cert, nor for an "approved" logo, in order to increase
> the chances that my mail gets delivered. Things in that respect are
> bad enough, and this proposal seems to me likely to only worsen the
> situation for those who operate small domains, presumably to the
> benefit of those who operate large mail infrastructures and CAs who
> issue certs for money.
>
> I also do not want to have to check if someone else has abused a logo
> I may use in some CT log. I do not want to have to process additional
> headers in my MTAs nor retrieve and store your logos in some new
> image store. I do not want to have to deal with any of the new
> problems that'll arise when any of that breaks.
>
> So: No thanks, from me. Personally, as a mail user I only see
> downsides to this whole idea.
>
> Thanks, S.
>
>