Re: [Bimi] Bimi Goals (was: Re: Thoughts about MUA/BIMI)

[John C Klensin <[e-mail]>]

Alex,

However, the key point I think Dave was trying to make (I'm sure
he will correct me if I misinterpreted him) was that, if the
goal is to convey a standardized (and, I would add, provably
authorized) image from sender to recipient, then imposing DMARC
as an a-priori requirement prevents consideration of options
that might work better or involve less complexity.  That is
independent of whether there are better options out there that
do not involve DMARC (even though I've become convinced there
are) -- the cutting off of discussion of such options is the
problem.

And, from that standpoint, making the goal "promote DMARC"
rather than just "use DMARC at part of an approach" seems even
worse, especially in the context of the IETF having an active WG
dedicated to sorting out perceived deficiencies in DMARC.

best,
  john


--On Friday, August 12, 2022 16:37 +0000 "Brotman, Alex"
<Alex_Brotman=[e-mail]> wrote:

> 
> BIMI, as currently designed, does not function without DMARC.
> When a domain adopts BIMI (and by requirements, publishes a
> DMARC of q/r for the OrgDom), every MBP who utilizes DMARC on
> inbound messaging receives the benefit of that domain having
> moved to an enforcing policy.  That happens regardless of
> whether that MBP utilizes BIMI for their users.  To me, that
> seems fairly important.  The order as stated below is
> irrelevant (and they weren't meant to be ordered by
> importance).
> 
> --
> Alex Brotman
> Sr. Engineer, Anti-Abuse & Messaging Policy
> Comcast
> 
> From: Dave Crocker <[e-mail]>
> Sent: Friday, August 12, 2022 11:22 AM
> To: Brotman, Alex <[e-mail]>; BIMI (IETF)
> ([e-mail]) <[e-mail]> Subject: Bimi Goals (was: Re:
> [Bimi] Thoughts about MUA/BIMI)
> 
> On 8/11/2022 7:21 AM, Brotman, Alex wrote:
> 
> Consider we have two primary goals (in short form):
> 
>   1.  Drive DMARC adoption
>   2.  Associate an image with properly authenticated messages
> 
> Alex,
> 
> Looking at the Bimi technical details, one sees a mechanism to
> permit a standardized way of conveying a marketing image from
> its owner to a recipient, in aid of privileged display.  It
> is, therefore, simply a mechanism to increase marketing
> 'impressions'.
> 
> That some folk working on Bimi have a hope that its use will
> produce better adoption of some existing email authentication
> mechanisms is nice -- albeit, a fragile hope, in the absence
> of a demonstrated history of such an effort succeeding -- but
> it is outside of the technical and operational basics of Bimi.
> Adoption and use of Bimi can be significantly successful, in
> terms of facilitating marketing impressions, while having no
> meaningful effect on the global use of email authentication.
> 
> At the very least, that means the ranking order you have given
> is wrong.
> 
> But there also seems to be some indication that the fragile
> goal is being used to justify sub-optimal engineering design
> and to justify rejecting better design.
> 
> d/
> 
> --
> 
> Dave Crocker
> 
> Brandenburg InternetWorking
> 
> bbiw.net