Re: [Bimi] Proposal to Clarify Role of MUA in BIMI Evaluation

[Tim Hollebeek <[e-mail]>]

Thanks Todd.  I think that is the right perspective.

I’m a bit concerned about the discussion of attempting to perform the checks at any other time, and I’m even more concerned about what seems to be assertions that it’s ok if the quality of the checks “degrades over time” as if this were a natural or unavoidable state.  I think everything possible should be done to avoid that outcome.

Over in LAMPS, we’re spending a lot of time dealing with the fallout from similar issues being inadequately addressed in the past with secure email, causing exactly the phenomenon described here, where over time things just degrade.  It’s very confusing to end users, and negatively impacts confidence in the entire system when things change with time, seemingly for no reason.

-Tim

From: bimi <[e-mail]> On Behalf Of Todd Herr
Sent: Tuesday, July 19, 2022 3:15 PM
To: Scott Kitterman <[e-mail]>
Cc: [e-mail]
Subject: Re: [Bimi] Proposal to Clarify Role of MUA in BIMI Evaluation

On Tue, Jul 19, 2022 at 2:07 PM Scott Kitterman <[e-mail]<mailto:[e-mail]>> wrote:
On July 19, 2022 6:03:10 PM UTC, Dave Crocker <[e-mail]<mailto:[e-mail]>> wrote:

>Considering your comments a bit further, it appears you are suggesting that BIMI does not need to validate at the time of display.

Maybe.  I won't claim to have been following the details closely enough to have an opinion.  For underlying authentication methods, such as DKIM, I think it's critical to evaluate them at the time of receipt and store the results.  That might also be true of Bimi, but I don't know.

To me, BIMI's reliance on DMARC passing (and being at something other than p=none) means that the condition at time of message receipt is the only one that matters. The current version of the draft specification even discusses a method for recording results - https://datatracker.ietf.org/doc/html/draft-brand-indicators-for-message-identification#section-7.7 - and those results could theoretically be relied on by an MUA at display time, assuming that the MUA has reason to trust the recorded results.

--
Todd Herr | Technical Director, Standards and Ecosystem
e: [e-mail]<mailto:[e-mail]>
m: 703.220.4153
[https://hosted-packages.s3-us-west-1.amazonaws.com/Valimail+Logo.png]

This email and all data transmitted with it contains confidential and/or proprietary information intended solely for the use of individual(s) authorized to receive it. If you are not an intended and authorized recipient you are hereby notified of any use, disclosure, copying or distribution of the information included in this transmission is prohibited and may be unlawful. Please immediately notify the sender by replying to this email and then delete it from your system.