Re: [Bimi] Today's BoF

[Wei Chuang <[e-mail]>]

*From: *John C Klensin <[e-mail]>
*Date: *Tue, Apr 2, 2019 at 2:03 PM
*To: *John Levine
*Cc: * <[e-mail]>


>
> --On Tuesday, April 2, 2019 15:54 -0400 John Levine
> <[e-mail]> wrote:
>
>
> ...

>
> >  I
> > gather that one of the gorillas accidentally made this mistake
> > in their informal logo collection system and a motivation for
> > bimi is to keep it from happening again.
>
> If one conbines that sentence with the "Nobody is assuming..."
> one above, then a motivation for bimi is to cure (or prevent)
> stupidity.  Perhaps it will work this time, but the track record
> of other efforts to apply such cures has not been good.
>
> > Of course this returns us to the major question of whether it's
> > possible to invent an effective system to check bimi
> > applications.  I could invent one that involved a staff of
> > trademark lawyers, but I don't think anyone outside the S&P
> > 500 would find that usable.
>
> Indeed.
>

Agreed that VMC will have a significant coverage limitation since its uses
registered trademarks that enables 3rd party verification.  Its one that
we're trying to figure out how to expand and we're very much asking for
your help and for your ideas to expand that coverage.  VMC and its 3rd
party verification system is just one approach, and is a starting point for
BIMI because we think is feasible to do in the near term, but we agree its
not a complete solution.

I should point out and has been alluded to in the above thread, that BIMI
also allows naked logos (meaning non-third party verifed) to be identified
by hash and fetched.  This depends even more heavily on reputation systems
to use safely but it may allow much more of the use cases identified in the
overview draft 5.3-5.11.
https://tools.ietf.org/html/draft-bkl-bimi-overview-00
The theory for its usage is very much like the favicon approach on the web,
and yes this approach will run headlong into all the issues you pointed
out.  The choice of its usage is up to the receiver that is interested in
that flexibility and okay with the risk.

Along the notion of exanding coverage, I just also wanted to point out 3rd
pary verification can work so long as what it tests is objective.  It might
not have to involve marks.  For example I would imagine a sender might be
associated with a place or person, and a photos of that places or person
could be reasonably verified.   Anyways we are looking for ideas to expand
coverage.

-Wei