IETF Logo Mail Archive

Re: [Bimi] Possible security flaw in BIMI spec / interaction of BIMI-supporting MUA with non-BIMI-supporting MTA

Dave Crocker <dhc@dcrocker.net> Sun, 05 May 2024 17:51 UTC

Return-Path: <dhc@dcrocker.net>
X-Original-To: bimi@ietfa.amsl.com
Delivered-To: bimi@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B895C14F691 for <bimi@ietfa.amsl.com>; Sun, 5 May 2024 10:51:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.094
X-Spam-Level:
X-Spam-Status: No, score=-2.094 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=dcrocker.net
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JKf2TgDQwMnj for <bimi@ietfa.amsl.com>; Sun, 5 May 2024 10:51:34 -0700 (PDT)
Received: from seagreen.cherry.relay.mailchannels.net (seagreen.cherry.relay.mailchannels.net [23.83.223.160]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11619C14F605 for <bimi@ietf.org>; Sun, 5 May 2024 10:51:33 -0700 (PDT)
X-Sender-Id: hostingeremail|x-authuser|dhc@dcrocker.net
Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 44D54C2976 for <bimi@ietf.org>; Sun, 5 May 2024 17:51:32 +0000 (UTC)
Received: from nl-srv-smtpout4.hostinger.io (unknown [127.0.0.6]) (Authenticated sender: hostingeremail) by relay.mailchannels.net (Postfix) with ESMTPA id A57ADC2576 for <bimi@ietf.org>; Sun, 5 May 2024 17:51:31 +0000 (UTC)
ARC-Seal: i=1; s=arc-2022; d=mailchannels.net; t=1714931491; a=rsa-sha256; cv=none; b=J9Y5G4MNtqET1UnmRh8ZY5oT+LkyFBctSjBYYaJ5c4JwNLNsAwbe5Z4DqwTaNv7Sctgwlb QaX+JhgNWoalLDnrKOOVIgtQ+7nUISD5WXtGY3YSXbB88qvVPW739cvi7BtFGRG3Vyw2Ln aVv3mM8uUKU3hrM/BZIcS63YybXhsYb3VJsL+dNBhkAI2VxVZG8X2MQUGi+P5UOOjtWMb6 ILX4IITcS9DEodQFKuHQSrEyXKxa4Fo0M0YcHMEdsMrbNA/OOIKpLkpcDI3lsj+fB+vdsL z6nPjM3OTyPMhiU9ehkNvy+JUbPC0kU0ll0lQlrA/1+ol6d49361wxKbj3kS8w==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1714931491; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type:in-reply-to:in-reply-to: references:references:dkim-signature; bh=BTjK4neUGaCHZngasiHAcpfWMbMbTEe7kCURD1NDd5g=; b=fkGGWyyY2+yfyHEIZAgoWFXxyAQywSEYUhzD501LuQhGsQGdyMYAgz04TnXPT2qENe7xBi rW+5xhxH+7aTegvWTjGfd+JaIRdmuePBmEuT+RknNHhqBPIrpE4QphRYeNqN4QSU8ntraq QlIlBG67vaQR/C1+g3atpfKibEfyzRuyBoQG8n9pJMqqS0ErhjWMbemiIiaPiOfbRqUAhe IImzdeaY1xBYQHJK666sU3nU3hTJBGTyqWpcBuAKx2bZ1Ur7lve610i7eInwjWuO8QSMgU Ui7YeJukbczIfBbziETSP+IUlJzenMLii5Ic8/xlDs6gb3Al6mMevO6JyVQkmg==
ARC-Authentication-Results: i=1; rspamd-7d788cf479-j8lzv; auth=pass smtp.auth=hostingeremail smtp.mailfrom=dhc@dcrocker.net
X-Sender-Id: hostingeremail|x-authuser|dhc@dcrocker.net
X-MC-Relay: Neutral
X-MailChannels-SenderId: hostingeremail|x-authuser|dhc@dcrocker.net
X-MailChannels-Auth-Id: hostingeremail
X-Company-Slimy: 07b2d08f293e2c3d_1714931492154_247046896
X-MC-Loop-Signature: 1714931492154:3645532073
X-MC-Ingress-Time: 1714931492154
Received: from nl-srv-smtpout4.hostinger.io (nl-srv-smtpout4.hostinger.io [145.14.159.45]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.123.115.39 (trex/6.9.2); Sun, 05 May 2024 17:51:32 +0000
Content-Type: multipart/alternative; boundary="------------qO17WtD7yNF0AxVXVssldxAK"
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dcrocker.net; s=hostingermail-a; t=1714931490; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type:in-reply-to:in-reply-to: references:references; bh=BTjK4neUGaCHZngasiHAcpfWMbMbTEe7kCURD1NDd5g=; b=rP9jvdpgKyswj4VvJMB65gAUEESlqTLiKQg84zkGlW7RaMz9lwhyxn250bvfB0Wx7F4cxM 8JIJwT9uM+8kwC9o7w10+wvB2sIPz2ANPE5IOVfXQsAJd6zwtzuALLO5ptBkCKXhPRk2tN w6XJfKN/PE24EHverUmThBvxzmr0YXJWy9WzRLKGKkSbKFyBiMV445gwOOjFNkZWgFG/E/ DNvhfb9Di+h1z0VBQfyr1+xTXOegABGB2kHVd1QABeV+Dw/YsGAcjCSxEs/lrUdYReZPhh Ia/a3kqfaE2B8jVBzY6J10surx0bpkBqz9Kmr1OinnUc03RE1Lt2l/TR8XzrbA==
Message-ID: <8662e644-7965-422b-851c-a12ff564e8f9@dcrocker.net>
Date: Sun, 05 May 2024 10:51:27 -0700
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Reply-To: dcrocker@bbiw.net
Content-Language: en-US
To: "Brotman, Alex" <Alex_Brotman=40comcast.com@dmarc.ietf.org>, "bimi@ietf.org" <bimi@ietf.org>
References: <20240505132144.1b62ff64@computer> <2e590032-1a46-4460-af1b-e00d6c540f2e@dcrocker.net> <CAHzjHH=RvGCTrAkbC=pbdbwUEGic8wyh6NzyHHe15aH3d9=n1g@mail.gmail.com> <6b6f0de8-d136-479d-999c-206aacb89b7f@dcrocker.net> <MN2PR11MB4351799162BAE25BE0FE10EBF71D2@MN2PR11MB4351.namprd11.prod.outlook.com>
From: Dave Crocker <dhc@dcrocker.net>
Organization: Brandenburg InternetWorking
In-Reply-To: <MN2PR11MB4351799162BAE25BE0FE10EBF71D2@MN2PR11MB4351.namprd11.prod.outlook.com>
X-CM-Analysis: v=2.4 cv=OPYh3zaB c=1 sm=1 tr=0 ts=6637c722 a=f0NN86htvrvSmWFZ/FiWJw==:117 a=f0NN86htvrvSmWFZ/FiWJw==:17 a=r77TgQKjGQsHNAKrUKIA:9 a=k7Ga1wGzAAAA:8 a=dA5Mk85SshnMfGANDQ0A:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=UqCG9HQmAAAA:8 a=372x1FeLPFm1iynxHEcA:9 a=_W_S_7VecoQA:10 a=lqcHg5cX4UMA:10 a=qVr7E2A3_3_y-ckUomBQ:22 a=ijMaxGghyylP-n2pFjDB:22
X-CM-Envelope: MS4xfAtBoH0eUSlDy0hBRKyW3D1irvF6tjGwYoDWkVv1HszNCIr+oWXleO7Q9uHxd+6b5fpRzAy5gNDBYyJ7DFOrfEstxFYlbXvqMPT2X1rh2O79kwUDo5WT ARAJMBGRw704OQLx8VeM8rhVsttUWg7Mx1fi9T3UiJhA1K1XdzaHN5NmDL7ke198yQq1khFSiRHlnfwF6JNhAjqOUthNWuDCrPHe4E05OandH7U5/k5zn8uy f6cZ7Pzmwvx840z4OUdOsA==
X-AuthUser: dhc@dcrocker.net
Archived-At: <https://mailarchive.ietf.org/arch/msg/bimi/S7s3DdGyEmEMEyxHr5zgVAvqPZs>
Subject: Re: [Bimi] Possible security flaw in BIMI spec / interaction of BIMI-supporting MUA with non-BIMI-supporting MTA
X-BeenThere: bimi@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Brand Indicators for Message Identification <bimi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/bimi>, <mailto:bimi-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/bimi/>
List-Post: <mailto:bimi@ietf.org>
List-Help: <mailto:bimi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/bimi>, <mailto:bimi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 05 May 2024 17:51:39 -0000

On 5/5/2024 10:37 AM, Brotman, Alex wrote:
> I should caveat that it's not been adopted by the BIMI working group thus far.

Alex,

Since the IETF does not have a BIMI working group, where might this 
adoption  decision take place?

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net
mast:@dcrocker@mastodon.social

v2.46.0 | Report a Bug | By Email | System Status