Re: [Bimi] (non)desire for bimi

[Dave Crocker <[e-mail]>]

On 2/18/2019 7:59 AM, Thede Loder wrote:
> 
>> On Feb 17, 2019, at 21:50, Dave Crocker <[e-mail]> wrote:
> Even if we assume that the premise is true (end users treat messages exactly the same), and if we agree that this implies end users will not be made worse off through their own choices as a consequence, it says nothing of other mechanisms through which users might be made worse off (or better off). 

Yes, limiting the scope of discussion to the topic at hand is certainly 
constraining.

So, how is your point relevant to an evaluation of /this/ proposal?


> I asked the question to help move the discussion forward.  Maybe we can agree on some things.

Thede, there has already been a number of very substantial concerns 
raised.  You seem to be focusing on trying to raise new ones rather than 
dealing with the ones already raised.  Your summary list, below, is more 
helpful.


> If people believe that end users treat messages with and without logos exactly the same, then we could potentially move on from considering the positive or negative implications of end user-mediated choices. 

We could do that if Bimi documentation and its advocates didn't keep 
suggesting improvements in recipient handling of email.


> End user choices can neither be a cause of improvement nor a cause of worsening.

That implies that a user's choosing to believe a phishing message 
doesn't make things worse.


> On the other hand, and given that end user security and safety is really really important, it might not be the wisest thing to assume away end-user mediated choices as a potential factor of change in outcomes.

That seems to suggest ignoring the long and solid track record that 
expecting end-user mediated choices will happen has been wrong. Please 
explain why that's being ignored.


> If we let in the possibility that changes in choices could exist and may make users worse off, we have to let in the possibility that end-user choices may be a means through which we can make users better off.  One cannot have it both ways.

You're introducing a view that hasn't been put forward.

What's been put forward is that justifying a security mechanism based on 
an expectation of recipient decision-making during message processing is 
known to be inappropriate.


> My personal opinion is that we need to leave open the possibility, because to do otherwise violates the engineering practice of ‘fail-safe’.

Please explain.


> (That said, none of BIMI’s proponents are arguing that end users' choices resulting from the display of logos will be a primary or substantive cause of improvement in outcomes. 

They have.  And some of the documentations can be taken to imply that it 
will.


> No one is saying that this mechanism should even be considered for reasons other than for its potential to reduce safety. 

The mechanism will /reduce/ safety???


> What I hear from the above as additional concerns are:
> 
> A) larger strategic opportunity costs
> B) narrow, increased security exposures
> C) plausable misuse
> D) extremely expense of doing a standard
> 
> 
> Can you elaborate on A?  Help us understand these costs.

An effort like this both sets expectations and consumes resources.  The 
former won't be met and will disappoint the market which will incline it 
to have lower receptiveness to the next proposal.  People working on 
this won't be working on other strategic effort.  Both of these are 
significant downsides.


> Can you provide examples for B and C so that we can begin a discussion of mitigation strategies?

I believe Stephen offered B.

As fort C, cf DMARC.


> Regarding D, let’s begin a larger discussion of costs.  Given your experience, where do you see the costs in doing a standard?

Consider the aggregate effort to produce a standard and consider the 
cost of the people who do that work.  30 years ago, I estimated at least 
US$1M for the simplest IETF standard.  It hasn't gotten cheaper.

d/


-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net