Re: [Bimi] (non)desire for bimi

[Thede Loder <[e-mail]>]

> On Feb 16, 2019, at 12:03, Dave Crocker <[e-mail]> wrote:
> On 2/16/2019 8:24 AM, Marcel Becker wrote:
>> On Feb 16, 2019, at 08:11, Dave Crocker <[e-mail]> wrote:
>>> Except, of course, that it will not have that effect on users, because there is extensive experience demonstrating that users mostly do not learn or use such signals.
>> While I usually tend to agree with that statement it is — in that
>> absolut form — not necessarily true. We know that, given time, users
>> are quite capable of learning and using such signals. When
>> specifically designed for that task.
> 
> 
> In real life, for this kind of task, no, they aren't.
> 
> On the average, they don't have an adequate threat model, they do not understand the security mechanisms, and they do not allocate the necessary time and effort to making the real-time decision.
> 
> If you have evidence of average users making security-related decisions in real-time -- in the midst of boring, daily tasks -- please provide it.


If end users treat messages with or without logos exactly the same, through what means will end users be made worse off or less safe when BIMI-sourced logos are widely used?  

Thede


> d/
> 
> -- 
> Dave Crocker
> Brandenburg InternetWorking
> bbiw.net
> 

—
Thede Loder
Managing Director, Skye Logicworks LLC
E: [e-mail]
M: [phone]