Re: [Bimi] (non)desire for bimi

[Richard Clayton <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In message <[e-mail]1
1.prod.outlook.com>, Terry Zink <tzink=[e-mail]>
writes

>    That heavily depends upon implementation. A web bug, as I 
>    understand it, helps to track user behavior - did the user open up 
>    my mail? While I concede that BIMI could be used this way, it's not 
>    a particularly effective way to do it. It would require setting up 
>    a lot of DNS records, and then being able to stand up 
>    infrastructure that can handle all those requests.

... and surely marketing people would never do that ?+

>    Most large receives wouldn't serve up a BIMI logo from the actual 
>    location pointed to by headers/DNS records each time they needed 
>    it. Instead, they'd periodically poll the logos/certs they need, 
>    upload them into a local database, and then pull from there.

Please explain how they would "poll the certs they need" ?

I understand that they might cache certificates that they had already
fetched once, but that's not the same thing at all.

How do they know what certificates they need a priori ? is it just for
the brand owners who have sent them cheques to pay for the display of
their logo ??

>    So, as 
>    a sender/brand, you might send out 100,000 messages to a single 
>    receiver and intend to use BIMI to see how many people interacted 
>    with the message. But in reality, you might see only 1 request - 
>    the one where that receiver saw it needed your logo and then 
>    downloaded it after verifying it. And then 30 days later, you saw 
>    them download it again.

the way you would get tracking (and of course mess up the caching
behaviour by the mail receiver) would be to use a different (sub)domain
for every email...

... so if you wish to forbid this (or make it expensive) you need
language about wildcard certificates.  Where do I find that in the spec?

>    So, while a web bug is a possible concern, a large receiver (and I 
>    would think even a medium sized one) would have to make use of more 
>    efficient architectural implementations to make the web bug 
>    concerns a minor one on the list of things to worry about.

the reverse -- without protocol restrictions the large receiver would be
worried that their caching architecture was subject to attack

- -- 
richard                                                   Richard Clayton

Those who would give up essential Liberty, to purchase a little temporary 
Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755

-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1

iQA/AwUBXGW4fDu8z1Kouez7EQL6iwCfWUNBwQvx20LG1lzQ4YDaHiEI7TYAmgJd
wOsceIENtEVbG51TLit0kTod
=2QC5
-----END PGP SIGNATURE-----