Re: [Bimi] MUA Evaluation of BIMI

[Jakub Olexa <[e-mail]>]

I'd say the only thing that would be worth checking is the source of the 
A-R header and host MAY match the server host (which may often not be 
possible) or fallback to the topmost A-R header.

Keep in mind that BIMI is not a trust indicator but just a logo - 
marketing feature rather than security feature. Custom MUA of a hosting 
company may rely on the A-R headers in a different way as it would get 
those from the MTA they have control over then a public MUA that simply 
has to trust that the user chose an imap server for a reason. What's the 
point of questioning the headers authenticity? I do get that it would 
prevent a malicious actor from having a "fake" logo displayed but the 
impact would be very limited.

maybe we could require MUAs to rely on the BIMI-Indicator header added 
by MUA.

Jakub Olexa
Founder & CEO
E-mail: [e-mail]
Tel: [phone] <tel:[phone]>

Mailkit - Closing the circle between Deliverability and Engagement 
<https://www.mailkit.com>

On 17.03.2022 20:35, Dave Crocker wrote:
>
>> You can tie yourself in knots here but I really doubt you're going to 
>> end up with anything better than believe your MTA's A-R or you don't.
>
>
> This seems to be trust without verification and without any meaningful 
> basis for the trust, other than having logged into an IMAP session 
> with a mailbox provider.
>
> Since 'users' certainly won't be doing a meaningful assessment, this 
> reduces to:  Random MUAs with support for displaying Bimi images must 
> use any A-R header field that shows up.
>
> Note that the trust includes having no basis for knowing whether the 
> connected servers knows about, or cares about, A-R fields.
>
> d/
>