Re: [Bimi] BIMI & the MUA

[Taavi Eomäe <[e-mail]>]

Hi,

The draft RFC (draft-brotman-bimi-mua-00) seems to add a very 
significant amount of complexity to the BIMI process with no clear benefit.

This additional complexity can introduce vulnerabilities, implementation 
inconsistencies and would cause additional resource usage in both MTAs 
and MUAs. If it is implemented at all, considering the complexity.

Using DNS as a key-value store is also quite wasteful (especially with 
DNSSEC) if not simply abuse or misuse of DNS. Such DNS usage also 
introduces additional risks, especially if you take into account how 
rare (O)DoH(3) or DoT is.

Inherently the MUA has to trust that the MTA that received the letter. 
Thus simply looking at Authentication-Results and if it contains 
"bimi=pass", should be sufficient for the MUA.

The VMC itself contains expiration, if that's important to the MUA. If 
there is a need for faster revocation, looking into OCSP would be a 
better choice.

If one of the goals is to further cache logos (and to increase privacy), 
instead of the massive "BIMI-Receiver-Signature" header, the logo's 
base64 could be added for the MUA. For example "BIMI-Logo".

It should be noted that we (Zone Media OÜ) are maintaining and 
developing a web-based MUA that currently supports BIMI 
<https://bimigroup.org/bimi-infographic/>. (In addition to our own MTA 
and MSA.) Alternative approaches should be heavily considered instead of 
this draft RFC.


Best Regards,
Taavi Eomäe
Zone Media OÜ