Re: [Bimi] Today's BoF

[Wei Chuang <[e-mail]>]

*From: *Dave Crocker <[e-mail]>
*Date: *Sun, Mar 31, 2019 at 5:00 PM
*To: *Wei Chuang, John C Klensin
*Cc: * <[e-mail]>

On 3/31/2019 4:48 PM, Wei Chuang wrote:
> > The BIMI proposal depends on different, domain based authentication
> > technologies that have been already deployed at scale.
>
> The message-based domain-validation components are not the issue.
>
> The use of certificate authorities is.  At scale they are problematic,
> in spite of the tendency to claim that their use for TLS says they aren't.
>

We're very much open to looking at alternatives that lets a 3rd party
verifier attest to their verification.  However I would point out that the
X.509 CA system is mature where processes are well specced and known flaws
have a number of remediations.  Alternatives may end up repeating much of
the same issues.


> And their use for linkage between domain name and logo is, since there's
> no history at scale.
>
> And any effort to use 'validated' logos at scale has no history, where
> the challenges in doing that have been well- and often-cited.
>

Agreed these are significant risks.  What's done to mitigate this is to map
this on to the existing registered trademark system, and leverage those
precedents.

-Wei


> d/
>
> --
> Dave Crocker
> Brandenburg InternetWorking
> bbiw.net
>