Re: [Bimi] (non)desire for bimi

[Dave Crocker <[e-mail]>]

On 2/14/2019 10:23 AM, Terry Zink wrote:
> Thanks John, and Dave.
> 
>> 1. An axiom in usability research is to not treat developers or
>> researchers as subjects (unless they really are the target audience.) 
>> In terms of cognitive detail and usage style, such folk differ 
>> substantially from the general user population.
>> 
>> Simply put, you or I or John do not matter in this calculus.  We are the
>> essence of a biased sample...
> 
> I agree, which is why I said earlier that I am not representative of the 
> entire space.

Except that you only cited yourself and then said "How does this not 
show demand?"  You started with "To me, it seems intuitively obvious."

If there is anything in usability design that would qualify as speech of 
the devil, that sentence probably qualifies.

Usability design often needs to make choice that goes exactly against 
what is "intuitive" to one person or another.  By way of example, there 
is a common view that giving end users more information is always a good 
thing, but this flies in the face of well-understood cognitive limits.



> Yes, there are some people that don't like this type of UX. And with 
> BIMI, you'll still be able to use the same software that doesn't show 
> images, HTML, sender photos, etc. There's no change there.

This is another fundamental usability design error:  thinking that 
adding something is fine because users can turn it off.  This burdens 
users, and often creates a barrier because they don't know how to fix it 
or even that they can.


>> It makes it in effect another web bug.
> 
> Hmm...
> 
> That heavily depends upon implementation. A web bug, as I understand it, 
> helps to track user behavior - did the user open up my mail? While I 
> concede that BIMI could be used this way, it's not a particularly 
> effective way to do it.

So you are countering a security concern by saying that we should not 
worry about it because there are other vectors you consider better?

This suggests that additional attack vectors aren't to be worried 
aboout, as long as easier ones are available?


> Most large receives wouldn't serve up a BIMI logo from the actual 
> location pointed to by headers/DNS records each time they needed it. 

I don't understand how this point is relevant to the underlying concern.

How is a statement predicated on "most" a useful security concern 
counter?  It almost sounds as if systems not part of that 'most' don't 
matter...


d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net