Re: [Bimi] Today's BoF

[John C Klensin <[e-mail]>]

--On Tuesday, April 2, 2019 15:54 -0400 John Levine
<[e-mail]> wrote:

> In article <DD71F5FAA85F312FDB5EF7E4@PSB> you write:
>> ...  So someone comes
>> along, someone who is clearly not BigCo, and obtains
>> BigCo.evil (remember, all they need is ability to pay and an
>> email address).   They have little trouble obtaining
>> certificates in that name because, as far as the DNS
>> environment is concerned, they legitimately hold it.
> 
> Nobody is assuming that you can get a bimi cert (or whatever)
> merely with a domain name similar to the target trademark.

Understood.   However, unless just about every MUA in the world
was upgraded to understand the difference between a bimi link
and cert, I can't imagine a typical user being able to tell the
difference between a bimi-blessed logo (or whatever) and the
same logo presented via some other mechanism.  

If I correctly understood last week's discussion, bimi is
dependent on mechanisms, including DKIM/SPF/DMARC that are,
unless I'm missing something, dependent in turn on some
assumptions about binding of the identity of a domain name
holder with the domain name.   My point was one cannot push
those assumptions very hard without running into questions of
registrar integrity and what it means to own (or hold) a domain
name.   

And, before you tell me that, statistically, everyone is using
web interfaces and MUAs don't count and/or that statistically
everyone is using one of those gorilla systems so it is
reasonable to ignore the deployment issues for the tiny minority
of people who are left, I suggest that a corollary to those
conclusions is that a code of common practices among said
gorillas and an advertising campaign to try to convince people
that they would much safer if they didn't communicate with, or
accept mail from, anyone who was not using a gorilla system.  Of
course that approach would have interesting antitrust
implications, but that, statistically, has not be a problem yet,
so why worry?  :-(

>  I
> gather that one of the gorillas accidentally made this mistake
> in their informal logo collection system and a motivation for
> bimi is to keep it from happening again.

If one conbines that sentence with the "Nobody is assuming..."
one above, then a motivation for bimi is to cure (or prevent)
stupidity.  Perhaps it will work this time, but the track record
of other efforts to apply such cures has not been good.

> Of course this returns us to the major question of whether it's
> possible to invent an effective system to check bimi
> applications.  I could invent one that involved a staff of
> trademark lawyers, but I don't think anyone outside the S&P
> 500 would find that usable.

Indeed.

best,
   john