From nobody Fri Mar 1 13:38:28 2019 Return-Path: X-Original-To: bimi@ietf.org Delivered-To: bimi@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 83B55130F30; Fri, 1 Mar 2019 13:09:58 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , Cc: bimi@ietf.org, aamelnikov@fastmail.fm X-Test-IDTracker: no X-IETF-IDTracker: 6.92.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <155147459853.6101.3973570425743901333.idtracker@ietfa.amsl.com> Date: Fri, 01 Mar 2019 13:09:58 -0800 Archived-At: X-Mailman-Approved-At: Fri, 01 Mar 2019 13:38:26 -0800 Subject: [Bimi] bimi - Requested session has been scheduled for IETF 104 X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Mar 2019 21:10:06 -0000 Dear Liz Flynn, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. bimi Session 1 (1:30 requested) Thursday, 28 March 2019, Afternoon Session II 1610-1810 Room Name: Karlin 3 size: 60 --------------------------------------------- iCalendar: https://datatracker.ietf.org/meeting/104/sessions/bimi.ics Request Information: --------------------------------------------------------- Working Group Name: Brand Indicators for Message Identification Area Name: Applications and Real-Time Area Session Requester: Liz Flynn Number of Sessions: 1 Length of Session(s): 1.5 Hours Number of Attendees: 50 Conflicts to Avoid: First Priority: dmarc lamps dispatch jmap extra People who must be present: Alexey Melnikov Resources Requested: Special Requests: Also avoid security area BOFs. Request Tues, Wed, Thurs --------------------------------------------------------- From nobody Mon Mar 11 09:08:53 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E84CF131151 for ; Mon, 11 Mar 2019 09:08:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.989 X-Spam-Level: X-Spam-Status: No, score=-1.989 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=valimail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J2xZHmKp1IbR for ; Mon, 11 Mar 2019 09:08:48 -0700 (PDT) Received: from mail-ua1-x92b.google.com (mail-ua1-x92b.google.com [IPv6:2607:f8b0:4864:20::92b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 510EC131170 for ; Mon, 11 Mar 2019 09:08:34 -0700 (PDT) Received: by mail-ua1-x92b.google.com with SMTP id j8so1691967uae.13 for ; Mon, 11 Mar 2019 09:08:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=valimail.com; s=google2048; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=9vxAGB0F0ijVThHAwbZt1XfXAmtTOmighGWYnbTICdg=; b=bYNw7fveY+ZAY+McHaNpHy4r1xbgj3l/8AdLXB6PT9eSD+xHS/s90b5tbAICrfT9qo 5N1Xf0C+DR1FMmF29+0pBnc9MA5C4oxhjRYbbjhUmgbsP1dy4WoZ1tE64C2Up/e5cTfI rOy/763ci8Vcq9rdNNWGnQff1kZhWOEwFK/4SLReCInd3mo21rZcRgPHQ1ZhlMUrHYSQ I4S3A2jeMTrPr+99ydEeFXKpqAsmW7GTl0Qeu6SFEG7h/M+fcL0CEd4drdeIC+YVmbhn 94jng9XepEbAarnhWEL9VWg6EfWKehHdAHyyS5n5f+6+SxM+J/UigKcbw2FbFoQwWcxM mcBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=9vxAGB0F0ijVThHAwbZt1XfXAmtTOmighGWYnbTICdg=; b=OQHBiJVo7RXZSZ8v1RvLqYerNzLcrS/ZxPXTFQignSGMg1wHEnzYufIYHXncA20Tcb jhvz8yHd/8PUF0UZvmQWTg7ep5uxHZ3CVnyKws0k/+FyFS8nt6T0lHJY+JVgfvZQqqRW NuxOirPbsgx9Czpfe4wnKyv9Y1FoZgeNvLBqVsvqom4RIum9Dc3G9TCQXkjsLs1TkBQX 9l0Q2J031ly7VpcEubLHgcQUpuedKUZmOoEIlrPnkqTE+mHMkIq9xeJ09Gg5/MdPctMl Pfywo719RwOmHaxD9BtYYrxrhlBpRp7t5wxbJpc0dzv6EvcyB3DrKEeKZjDaY/CynU7A xAog== X-Gm-Message-State: APjAAAWVDiLsumnIkcVrWVODtBzYQ40CXgm/VWybIagwLnFRVHX1Vwqz FDVyv1+elukkaHHrB7OnINnxYgs6DHF5AX3HWpSeLHPR2kI= X-Google-Smtp-Source: APXvYqwS8LN7xqEAwlZps93VWPe2IWSSiNQtuaWCZvZhPtsz9pty6WAVVLreCYH13nDt4AYED0ktjVqES4yu7onW334= X-Received: by 2002:ab0:4a1:: with SMTP id 30mr16910625uaw.86.1552320513026; Mon, 11 Mar 2019 09:08:33 -0700 (PDT) MIME-Version: 1.0 References: <155229406950.16918.2163707322967420687.idtracker@ietfa.amsl.com> In-Reply-To: <155229406950.16918.2163707322967420687.idtracker@ietfa.amsl.com> From: Seth Blank Date: Mon, 11 Mar 2019 09:08:22 -0700 Message-ID: To: bimi@ietf.org Content-Type: multipart/alternative; boundary="000000000000c1bacf0583d3c896" Archived-At: Subject: [Bimi] Fwd: New Version Notification for draft-bkl-bimi-overview-00.txt X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 16:08:52 -0000 --000000000000c1bacf0583d3c896 Content-Type: text/plain; charset="UTF-8" As requested by several people on this list, we've put together an architectural overview of BIMI. This document specifically focuses on options that were considered and the threats inherent in them. This document should provide solid groundwork for the BoF discussion in Prague. We're looking forward to your comments. Seth ---------- Forwarded message --------- From: Date: Mon, Mar 11, 2019 at 1:47 AM Subject: New Version Notification for draft-bkl-bimi-overview-00.txt To: Seth Blank , John Levine , Neil Kumaran A new version of I-D, draft-bkl-bimi-overview-00.txt has been successfully submitted by John Levine and posted to the IETF repository. Name: draft-bkl-bimi-overview Revision: 00 Title: An Overview of the Design of BIMI Document date: 2019-03-11 Group: Individual Submission Pages: 19 URL: https://www.ietf.org/internet-drafts/draft-bkl-bimi-overview-00.txt Status: https://datatracker.ietf.org/doc/draft-bkl-bimi-overview/ Htmlized: https://tools.ietf.org/html/draft-bkl-bimi-overview-00 Htmlized: https://datatracker.ietf.org/doc/html/draft-bkl-bimi-overview Abstract: Brand Indicators for Message Identification (BIMI) provides a mechanism for mail senders to publish a validated logotype that mail receivers can display with the senders' messages. This document provides a brief overview of BIMI and examines some of the trade offs and decisions in its design. Discussion venue Comments on this draft may be directed to the BIMI list at bimi@ietf.org. Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat -- Seth Blank | Director, Industry Initiatives e: seth@valimail.com |* p: *415-273-8818 This email and all data transmitted with it contains confidential and/or proprietary information intended solely for the use of individual(s) authorized to receive it. If you are not an intended and authorized recipient you are hereby notified any use, disclosure, copying or distribution of the information included in this transmission is prohibited and may be unlawful. Please immediately notify the sender by replying to this email and then delete it from your system. --000000000000c1bacf0583d3c896 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
As requested by several people on this list, we've put= together an architectural overview of BIMI. This document specifically foc= uses on options that were considered and the threats inherent in them.
=
This document should provide solid groundwork for the BoF di= scussion in Prague.

We're looking forward to y= our comments.

Seth

---------- Forwarded messag= e ---------
From: <internet-drafts@ietf.org>
Date: Mon, Mar 11, 2= 019 at 1:47 AM
Subject: New Version Notification for draft-bkl-bimi-over= view-00.txt
To: Seth Blank <seth= @valimail.com>, John Levine <standards@standcore.com>, Neil Kumaran <nmk@google.com>



A new version of I-D, draft-bkl-bimi-overview-00.txt
has been successfully submitted by John Levine and posted to the
IETF repository.

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-bkl-bimi-overview
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 An Overview of the Design of BIMI<= br> Document date:=C2=A0 2019-03-11
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 19
URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 https://www.ietf.org/internet-drafts/draft-bkl-bimi-overview-0= 0.txt
Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ht= tps://datatracker.ietf.org/doc/draft-bkl-bimi-overview/
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://to= ols.ietf.org/html/draft-bkl-bimi-overview-00
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0htt= ps://datatracker.ietf.org/doc/html/draft-bkl-bimi-overview


Abstract:
=C2=A0 =C2=A0Brand Indicators for Message Identification (BIMI) provides a<= br> =C2=A0 =C2=A0mechanism for mail senders to publish a validated logotype tha= t mail
=C2=A0 =C2=A0receivers can display with the senders' messages.=C2=A0 Th= is document
=C2=A0 =C2=A0provides a brief overview of BIMI and examines some of the tra= de offs
=C2=A0 =C2=A0and decisions in its design.

Discussion venue

=C2=A0 =C2=A0Comments on this draft may be directed to the BIMI list at
=C2=A0 =C2=A0bimi@ietf.o= rg.




Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat



--

Seth Blank | Director, Industry In= itiatives

e: seth@valim= ail.com | p: 415-273-8818<= /p>


This email and all data transmitted with it contains confide= ntial and/or proprietary information intended solely for the use of individ= ual(s) authorized to receive it.=C2=A0= =C2=A0If you are not an intended and au= thorized recipient you are hereby notified any use, disclosure, copying or = distribution of the information included in this transmission is prohibited= and may be unlawful.=C2=A0=C2=A0Please immediately notify the sender by reply= ing to this email and then delete it from your system.

--000000000000c1bacf0583d3c896-- From nobody Mon Mar 11 16:53:46 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7AB601311B9 for ; Mon, 11 Mar 2019 16:53:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MdZjd43ZqvTe for ; Mon, 11 Mar 2019 16:53:37 -0700 (PDT) Received: from mail-vs1-xe2c.google.com (mail-vs1-xe2c.google.com [IPv6:2607:f8b0:4864:20::e2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 45B61131229 for ; Mon, 11 Mar 2019 16:53:36 -0700 (PDT) Received: by mail-vs1-xe2c.google.com with SMTP id u6so487498vso.10 for ; Mon, 11 Mar 2019 16:53:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=3ijgxAdgRPNEprZCrWmdFil5lVAUPAWhuekZj50VsPM=; b=X0Gn27o616g+W98mv0xlA12b6GnVmt+dWola+WB6VJwczukAf/TqyV3co5frJ4MpXN Jgpvea/1M8tkrn+t0CN6sS6ijcgdY3WC+SNzkQnTVlZJAeRacpEI653LxBdT6kZ9s81d qy4oWdIflgTqcRY6GHAL6t+PfLDFq9Z4/niggCY0AlE/2UsZL0FWI0NcglusDzSX4wHj 5eekEBDKDmEOkglRiXEbswoMruxvJyed1VVrXQc8qjPjCuOlpURu9E1V4y0kOZkSMNP6 g63e9EQpmiZeJL+ZuBEHaERm/hNPc90d1yyOq8Wgi2B3vu9Jv9tEgEtOISnoMwTjFsCz 6QDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=3ijgxAdgRPNEprZCrWmdFil5lVAUPAWhuekZj50VsPM=; b=tih54WbHRHTctZT21KyMbEyr/sUtwC/mAiuAwWjNiSBGXgBGAR2G33XULfrHKzo6fz xX0akcGzCcZITrEQkqMRcnSKse2rRDDUTp5snQCSgs/LsSs/M10NLFgj4tEn8+q2f8cR +abaTqdaLVQn+znH5D1coaprR3eTj+x/3p+51sBScPqEJ8zIIjdhU3vVVMUIx74AuycV ajIBZlVIutCPKpjqzGncCalgIfBrl9+6XxwijRaItL5Cv3iwetEJhmgL4K0D6mnDKohM 3AElx+dDZI66EW5snZYaJbAjsuECGmxdx7bJvLtmkksCghQjfLD4NoRLWyl7XnkvOfzQ B8cw== X-Gm-Message-State: APjAAAU9Vu7LtO7HEb+JsHYeDh7wWMhXUO0JW2xq0MXWgItohvkcxum/ Ee7MHKlzVBM9HETVp0HmqgCXeNAqxrBe6uUk85p5+89AEWiRZA== X-Google-Smtp-Source: APXvYqz6Ai7a0kNZ1lCFPu32sJ7OLqioJ8LUKQu/OFYBs6KdcU6uiHMZ0FnWCQCN/NQnSXmqPOthCK+1GuhM/kRpxSc= X-Received: by 2002:a67:8355:: with SMTP id f82mr17788753vsd.89.1552348414587; Mon, 11 Mar 2019 16:53:34 -0700 (PDT) MIME-Version: 1.0 References: <155234341371.23211.18133889707810030986.idtracker@ietfa.amsl.com> In-Reply-To: <155234341371.23211.18133889707810030986.idtracker@ietfa.amsl.com> From: Wei Chuang Date: Mon, 11 Mar 2019 16:53:20 -0700 Message-ID: To: bimi@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000dc38510583da4789" Archived-At: Subject: [Bimi] Verified Mark Certificates Proposal: A Security Perspective draft X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 23:53:44 -0000 --000000000000dc38510583da4789 Content-Type: multipart/alternative; boundary="000000000000d23bea0583da47f8" --000000000000d23bea0583da47f8 Content-Type: text/plain; charset="UTF-8" Hi folks, The VMC Proposal draft is a companion to the BIMI overview draft posted by John Levine, but much more focused on the design rationale for the current BIMI/VMC certificate approach. It also is meant to provide context and pointers out to various BIMI drafts given a security sensitive perspective. Like the overview draft, this is meant to help set up the Prague BIMI BoF. We welcome your feedback. -Wei ---------- Forwarded message --------- *From: * *Date: *Mon, Mar 11, 2019 at 3:30 PM *Subject: *New Version Notification for draft-chuang-ietf-bimi-security-perspectives-00.txt *To: *Thede Loder , Weihaw Chuang < weihaw@google.com> A new version of I-D, draft-chuang-ietf-bimi-security-perspectives-00.txt has been successfully submitted by Weihaw Chuang and posted to the IETF repository. Name: draft-chuang-ietf-bimi-security-perspectives Revision: 00 Title: Verified Mark Certificates Proposal: A Security Perspective Document date: 2019-03-11 Group: Individual Submission Pages: 18 URL: https://www.ietf.org/internet-drafts/draft-chuang-ietf-bimi-security-perspectives-00.txt Status: https://datatracker.ietf.org/doc/draft-chuang-ietf-bimi-security-perspectives/ Htmlized: https://tools.ietf.org/html/draft-chuang-ietf-bimi-security-perspectives-00 Htmlized: https://datatracker.ietf.org/doc/html/draft-chuang-ietf-bimi-security-perspectives Abstract: This document motivates the need for embedding logotypes in X.509 certificates along with the certificate validation process from a security perspective. --000000000000d23bea0583da47f8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi folks,

The VMC Proposal= draft is a companion=C2=A0to the BIMI overview draft posted by John Levine= , but much more focused on the design rationale=C2=A0for the current BIMI/V= MC certificate approach.=C2=A0 It also is meant to provide context and poin= ters out to various BIMI drafts given a security sensitive perspective.=C2= =A0 =C2=A0Like the overview draft, this is meant to help set up the Prague = BIMI BoF.=C2=A0 We welcome your feedback.

-Wei=

---------- Forwarded message ---------
From: <internet-draft= s@ietf.org>
Date: Mon, Mar 11, 2019 at 3:= 30 PM
Subject: New Version Notification for draft-chuan= g-ietf-bimi-security-perspectives-00.txt
To: Thede Lode= r <thede@skyelogicworks.com<= /a>>, Weihaw Chuang <weihaw@goog= le.com>



A new version of I-D, draft-chuang-ietf-bimi-security-perspectives-00.txt has been successfully submitted by Weihaw Chuang and posted to the
IETF repository.

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-chuang-ietf-bimi-securi= ty-perspectives
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Verified Mark Certificates Proposa= l: A Security Perspective
Document date:=C2=A0 2019-03-11
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 18
URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 https://www.ietf.org/internet-drafts/draf= t-chuang-ietf-bimi-security-perspectives-00.txt
Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/draft-chuang-ietf-bimi-= security-perspectives/
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://tools.ietf.org/html/draft-chuang-ietf-bimi-security-per= spectives-00
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/html/draft-chuang-ietf-b= imi-security-perspectives


Abstract:
=C2=A0 =C2=A0This document motivates the need for embedding logotypes in X.= 509
=C2=A0 =C2=A0certificates along with the certificate validation process fro= m a
=C2=A0 =C2=A0security perspective.

=


--000000000000d23bea0583da47f8-- --000000000000dc38510583da4789 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMWMqzbpn2SydMzpfaMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE4MTExNTE4NDMwM1oXDTE5MDUx NDE4NDMwM1owIjEgMB4GCSqGSIb3DQEJAQwRd2VpaGF3QGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQDOGIfi32h8dhJEeUGHfN1nAVrJsY4ph3nisYgnB2pOA4hcNkX4 xnnbD7PDr6G2S6LqYfXegzUkLT7FoOGtptBAixwpSxBUvEWQdrlbYdYuoNK7/DBASrlp4J7UocGX ZS5dkWL0IolToc52mCmOxhTqDjbD9MG3+AvyyQPK0RVgNY5n7BZBdNZDHTeswReAtjQ4t+b1IStQ 7Y59jxTOfDPpAT2Y0ON44Lx2hBLyQ8wXYCmHHbWCyGT3xZH0p8p+cGgkKvDjaxBX3ilopH8hx4zm 5HVh6wDOBHhAnRYVU1bqmjohWNuLhz/Za6lWGiylhPD+2yFLQfvHn6OBE0a/048NAgMBAAGjggFu MIIBajAcBgNVHREEFTATgRF3ZWloYXdAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFJUPLExeOaBiYyZVRuorZTtplIumMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQBuvV1bxPXhqWWCHYz7 40fvnmDIUsNiLecW3PCDQxdpPMc3V/6T31qSKYvuFigtj2MpXMCkLqbHupVN3b14UvnqNx3jnu7b Yp+rMcjjO70W3ufBqqz/QQzSykR9ATo+Zqs09dhJtTl02ApUqYipoInGx8wu0ChTI84NwR5UUo7H GSOet+Eluj5Yjq0YdM2qzfapP/XbfO7t533yiK5Cs//IlaQagdizrM/b1DTYjJ/28b3uPMS3l6a8 BoWm7kiV6GCY7zBNF9D6Gkf6U4dZgx6SwQjQoG3mSBV1zzIs0cZYoVvq/8y+5jC9CdH1ran/ahb6 1ZtMG4auBaKMRzEe3TimMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMWMqzbpn2 SydMzpfaMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCA6SnZ2drvBgy2dKdgO4Te1 EpTYwVNIDltSlblzPRCkYDAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTAzMTEyMzUzMzVaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAcOaZgVjMUnD6KaSgeVbtSMsICPJGg9wqNN/cz+fY bLgdSBhJj+fwBGefX6MFKDq7wM97/g/X2dWasVGN+eOuvXfIyC+cDb456RUTDOW5QAvXOHMmRBEQ AW+CWrqfEYLzRVb/LnWPnzJM4ZanspcG2Ir5DrKxIiDUxIXRicY4vajeP+4+zaLeMmOpZpjN0X3b u9jngLArYmjo9hI0utpYwAI6uQ0MJ4OIrQPS86iQd3rWGEEo+X9JfORlpxzmyJ9bXtK7Jz8FFHpX bV6vEnSuOCTFygKbG7E+UbJIEJoAkt+4YuyFh/tmR2CIDxjCVkzHVLAr+EY+Vaug78iAldoeAw== --000000000000dc38510583da4789-- From nobody Wed Mar 13 11:32:12 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C1551127962 for ; Wed, 13 Mar 2019 11:32:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.989 X-Spam-Level: X-Spam-Status: No, score=-1.989 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=valimail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id liMA0dT84ZFY for ; Wed, 13 Mar 2019 11:32:08 -0700 (PDT) Received: from mail-vs1-xe35.google.com (mail-vs1-xe35.google.com [IPv6:2607:f8b0:4864:20::e35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 39FDD1275F3 for ; Wed, 13 Mar 2019 11:32:08 -0700 (PDT) Received: by mail-vs1-xe35.google.com with SMTP id e126so1434273vse.1 for ; Wed, 13 Mar 2019 11:32:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=valimail.com; s=google2048; h=mime-version:from:date:message-id:subject:to; bh=i28L6tBk2UQZG/2eGEhGEduRbOp2vcf8BipRSP20C08=; b=EYzRSQU2Nqh7otI2TasDHGGtFPp8AbJXDADPa8pk9yfQya88IitHIXjLXwR8CssJ4D luSn4Y2BkH4X1jJwfVh7DE1xFMTMHJGVyFPI0E1TmHJrcZwQIo/8D04fKGsXqUhlzcf7 Ctal8JIp0RNsuj10I5OYnF5Bjm8yRZG5BgwmUx0PLvQnyhLLuLb8xfBD+lFFdGt9NXk+ KFVFPbQfW9X32xcKZDcbfcy9LXKDkG5XHHRDvHnHzmRuWFOJFfXrcsPVzmMXDWYMdVLQ TLfyo+CAhot9npMMLJBctNo/S4NrXSg0m3udz8N3lOg2oF8/6Gu4Y3mPCjLJc8a2Ux7z PrVA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=i28L6tBk2UQZG/2eGEhGEduRbOp2vcf8BipRSP20C08=; b=a/M7HhXRB5CXfvBRAiFetEtn3zX51O+Ya1p0vY4Pssr4JWD8BCJ0uimjO1h7RTFyA5 b0I+eLPBkf0xW0JHV0bBlBUI4DBhKp1QI/KYMAgOhOVz+9S3uIX5YEf+PeQN3Q876dAu l/lNX/nLflYcPLEKKk0ql8+fPVkT0YU+9cH//FE/0Ykrdn7kZ3JeLXaLkfOQgtmA4Bvl QlMlg10kWhyewLmXYthwg2meqzGJlJso9ZFPd4kc2++/6H+4GA+UQZAgUOwdr0PZZbhW /nr7QZBeE9CMoC2y2K80KbbgjgMF6jluBYBQn+4VTF+OSEzwD2thlMc414neGhVjmZAD xL7w== X-Gm-Message-State: APjAAAU8bHd6LFeMDH0NGpplFYpIBqLjeMxwfRbW4QLVyz5GjVXqkYp8 +/n7isTnFOb7mC1iMfo2QBmIFl++H0jKR3EyVZcO45KG2823sQ== X-Google-Smtp-Source: APXvYqzX3bD8CUBm4MBt2U9vMCNQK2lvk/kQOmx1XYWdtN/H1HHXwU6oP4aBICxt+ABwGrRqELTyzf53SXYwfHr1FK4= X-Received: by 2002:a67:c287:: with SMTP id k7mr24693155vsj.225.1552501926541; Wed, 13 Mar 2019 11:32:06 -0700 (PDT) MIME-Version: 1.0 From: Seth Blank Date: Wed, 13 Mar 2019 11:31:54 -0700 Message-ID: To: bimi@ietf.org Content-Type: multipart/alternative; boundary="000000000000d870650583fe0533" Archived-At: Subject: [Bimi] BIMI image security open questions X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 18:32:11 -0000 --000000000000d870650583fe0533 Content-Type: text/plain; charset="UTF-8" These three drafts cover a myriad of security concerns: - General threats: https://tools.ietf.org/html/draft-bkl-bimi-overview-00 - Problems with certificates/CAs: https://tools.ietf.org/html/draft-chuang-ietf-bimi-security-perspectives-00 - Other more specific technical issues: https://tools.ietf.org/html/draft-blank-ietf-bimi-00#section-9 Outside of these three documents and specific guidance in https://tools.ietf.org/html/draft-blank-ietf-bimi-00#section-5.1.2 (which itself refers to https://tools.ietf.org/html/rfc6170#section-5.2), I believe the only top line threat that's not well documented are related to the image payload itself. Details below from M3AAWG technical. None of the above authors are experts on these vectors. We'd love to discuss in more depth or be connected to people or resources who can help educate us (preferably on this list). Thanks, we're looking forward to your feedback and participation in the BoF! The M3AAWG technical list has provided the following threats that are not encapsulated in the above drafts: 1) Richard Clayton provided: An issue where the image which is certified may not be the actual image that is rendered unless care is taken to specify the nature of the rendering: https://pdfs.semanticscholar.org/e8c5/6fe612c0edd436361b1f07551c832c0f1fb8.pdf 2) Joe St. Sauver provided: Steganography in SVG: https://github.com/japplebaum/svgsteg Script tags in SVG: https://www.redteamsecure.com/evil-svg-project/ The script tag is mediated by the requirements of https://tools.ietf.org/html/rfc6170#section-5.2, but is still worth calling out explicitly. -- Seth Blank | Director, Industry Initiatives e: seth@valimail.com |* p: *415-273-8818 This email and all data transmitted with it contains confidential and/or proprietary information intended solely for the use of individual(s) authorized to receive it. If you are not an intended and authorized recipient you are hereby notified any use, disclosure, copying or distribution of the information included in this transmission is prohibited and may be unlawful. Please immediately notify the sender by replying to this email and then delete it from your system. --000000000000d870650583fe0533 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
These three drafts cover a myriad of security concerns:
- Other more specific technical issu= es:=C2=A0https://tools.ietf.org/html/draft-blank-ietf-bim= i-00#section-9

Outside of these three document= s and specific guidance in=C2=A0https://tools.ietf.or= g/html/draft-blank-ietf-bimi-00#section-5.1.2=C2=A0(which itself refers= to=C2=A0https://tools.ietf.org/html/rfc6170#section-5.2), I believe= the only top line threat that's not well documented are related to the= image payload itself. Details below from M3AAWG technical.

<= /div>
None of the above authors are experts on these vectors. We'd = love to discuss in more depth or be connected to people or resources who ca= n help educate us (preferably on this list).
<= div dir=3D"ltr">
Thanks, we're looking f= orward to your feedback and participation in the BoF!


The M3A= AWG technical list has provided the following threats that are not encapsul= ated in the above drafts:

1) Richard C= layton provided:=C2=A0

An = issue where the image which is certified may not be the actual image that i= s rendered unless care is taken to specify the nature of the rendering:
=

https://p= dfs.semanticscholar.org/e8c5/6fe612c0edd436361b1f07551c832c0f1fb8.pdf

2) Joe St. Sauver provided:
<= br>
Steganography in SVG:=C2=A0https://github.com/japplebaum/svgsteg


The script tag is mediated by the requireme= nts of https://= tools.ietf.org/html/rfc6170#section-5.2, but is still worth calling out= explicitly.

--

Seth Blank | Director, Industry Initiatives

e: seth@valimail.com | p: 415-273-8818


This email= and all data transmitted with it contains confidential and/or proprietary = information intended solely for the use of individual(s) authorized to rece= ive it.=C2=A0=C2=A0If you are not an intended and authorized recipient you a= re hereby notified any use, disclosure, copying or distribution of the info= rmation included in this transmission is prohibited and may be unlawful.=C2=A0=C2=A0Please immediately notify the sender by replying to this email and th= en delete it from your system.

--000000000000d870650583fe0533-- From nobody Thu Mar 14 14:06:39 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D05D8130EF1 for ; Thu, 14 Mar 2019 14:06:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.979 X-Spam-Level: X-Spam-Status: No, score=-0.979 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MISSING_HEADERS=1.021, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=drkurt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pPm-7-fngaaB for ; Thu, 14 Mar 2019 14:06:35 -0700 (PDT) Received: from mail-it1-x136.google.com (mail-it1-x136.google.com [IPv6:2607:f8b0:4864:20::136]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E29B130EE3 for ; Thu, 14 Mar 2019 14:06:35 -0700 (PDT) Received: by mail-it1-x136.google.com with SMTP id o76so3880104ita.3 for ; Thu, 14 Mar 2019 14:06:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=drkurt.com; s=20130612; h=mime-version:references:in-reply-to:from:date:message-id:subject:cc; bh=9d9BotTR7QCVzgjuEfyx3kPAZDPF5TIdFvZe4zDgKBg=; b=Lb8IlgdcQi7kk/yYq2N/N0W2L+W6LiRYuYMRuDgMxgmYZdiNzgBiAZuleEOeIf9pIw C45C77WYEXmqrKflKI0sy+DWmJGisAKgpR6yIHJkxJ1LeF6QU5ud/F+kj9MYlz2M7ZiA t8h1jASJj4+NZl9wBHLX+GlMeYl3Oj0lEbV7E= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:cc; bh=9d9BotTR7QCVzgjuEfyx3kPAZDPF5TIdFvZe4zDgKBg=; b=ffQRi61FIcEUqnfvC+aYpEmsSw8LPkxuEBeXsbF5iAoWixy/9jq1MHIeoc1TA52ACq 1+9AIjXMx4GcvtfJiOeq2SdxhXgFe1wjg6h99qFZeZS57yQzYi5VX/Os2rQcIALs/Q46 RtDqsWO0whSvDWr314JVT9FMPDBsqH6Mofqxhjq7dUqte+z0TksBJ/eFFGQrFHYCDyuG 8XKwwUXRpuZ8ms8b5qFT4Wmc5+Z0rAXJF3rCgz6tupuBm8AKyp6tFQ9jKh4Cz6sH/sLd 86ECGX0e89rwhlwjBX0MIJlVoU93Lf6nAoUxqk/HqubJgED49J7xPINXFcMdSbc8ZfGR KXNw== X-Gm-Message-State: APjAAAXmMXPMjdalYrfoAyyfw8+AyG0hTdvspczYeaWP7PN7yNaFg+Xj fEvPu4YgIF5wjX5D4C9bYLRWmSqJZn8eG6PBlqair7KrsMw= X-Google-Smtp-Source: APXvYqwHFDWeEKghwKt5kRA3+j6vOCl4dW6Zh3H6/sixwFEN2sOJD5PXdSrRepRN6+w1ItwbBgqVWuJ0Mk5nWsW9E0w= X-Received: by 2002:a24:b143:: with SMTP id c3mr361129itj.79.1552597594115; Thu, 14 Mar 2019 14:06:34 -0700 (PDT) MIME-Version: 1.0 References: <155229406950.16918.2163707322967420687.idtracker@ietfa.amsl.com> In-Reply-To: From: "Kurt Andersen (IETF)" Date: Thu, 14 Mar 2019 14:05:59 -0700 Message-ID: Cc: bimi@ietf.org Content-Type: multipart/alternative; boundary="00000000000013a5a90584144c20" Archived-At: Subject: Re: [Bimi] draft-bkl-bimi-overview-00 X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 21:06:37 -0000 --00000000000013a5a90584144c20 Content-Type: text/plain; charset="UTF-8" A couple of minor comments while awaiting a more thorough discussion in the IETF104 BoF: In section 3, the opening sentence refers to benefits for senders and recipients. I think it should also identify that there are potential benefits to receivers and operators of MUAs too. In section 3.1, there is a reference to "changes the secret handshake". I think that the point of having a public standard is that the crucial change is to make is a non-secret handshake. I appreciate that this is qualified with "if implemented poorly", but that should perhaps be changed to "if specified poorly (or obscurely)". --Kurt --00000000000013a5a90584144c20 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
A couple of minor comments while awaiting a more thorough = discussion in the IETF104 BoF:

In section 3, the opening= sentence refers to benefits for senders and recipients. I think it should = also identify that there are potential benefits to receivers and operators = of MUAs too.

In section 3.1, there is a reference = to "changes the secret handshake". I think that the point of havi= ng a public standard is that the crucial change is to make is a non-secret = handshake. I appreciate that this is qualified with "if implemented po= orly", but that should perhaps be changed to "if specified poorly= (or obscurely)".

--Kurt
--00000000000013a5a90584144c20-- From nobody Fri Mar 15 09:09:50 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60286129BBF for ; Fri, 15 Mar 2019 09:09:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=valimail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3gUhLeQqYeJr for ; Fri, 15 Mar 2019 09:09:46 -0700 (PDT) Received: from mail-wm1-x332.google.com (mail-wm1-x332.google.com [IPv6:2a00:1450:4864:20::332]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D73E4130E6F for ; Fri, 15 Mar 2019 09:09:45 -0700 (PDT) Received: by mail-wm1-x332.google.com with SMTP id f3so7137464wmj.4 for ; Fri, 15 Mar 2019 09:09:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=valimail.com; s=google2048; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=CWDxSmT0NS4hE+3jgYluKMm1QGsP+RHBUCnBOH8B7qk=; b=Z4VKH4GjmXaC9Pe3QvJWkRfVIfk/d5KuKXB+XhjGmaP8tqdtYrJUgf0lVGtpvlbpn0 AxWaweNcvn5szk1uM7Ud9eDt1m/ZhQX2DDIsgNoLGmZlh07k9ilVAe5XDlT/umoRR3TR 1fU2511HGJlE+kKKsPrSzeAVFc462nZ52hajgoU3LuRyO03MM/Zi8Zd9GExy7n4iSGpu gbEv+xb1l5FKiyPyqPeaWUKWxtL4HcNmeMx2r7sV/rBOgnOKhocjNEM1iEIgDfojBGI1 UsE9rT3MC32xEFiRVz5WYEg9SyBH0eoO0126RqsjwPKYkAkF+suDrLXG/ilGUVOVvJpq LGXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=CWDxSmT0NS4hE+3jgYluKMm1QGsP+RHBUCnBOH8B7qk=; b=RyKnTJkmr/O4IKJM+8NhzXbv1JQuJYrs6qUynSeXOSb0dQQLkINYOCfWSClpRpXUn+ ouqHoVKJxPQyoAN6P3r3UhVpGS47FOI80HMyJEzDHv+u0eqUZ+qFUiITRywDzYCl4mzU ewQztpQS8ECbEbQMQh/2q8j0yioCGpRJgsOa2/UagUnGleCUguHbIghTXW6ag0xY/rUR wbcJU7WUVHqNI4m4i1CbzSx59UrVdNpJaO0/4GlLg7R1gbJKOzQ8cufBGCc5PslZ5N8J 4VFAxpaXfcw2/3vn2HpFuz1BiTMFOxV05mp9Ga8c/9eIkDlr33SMnqvoWKqui8nnh+Rb dzkA== X-Gm-Message-State: APjAAAXYBv73IJdFfD39pDjblqiRkUAv6vt6nmmJlyXktA8Nc4kjdroJ lXt1Or/XIJ/NScZ5O2HDbYw/8wE9dTMeJpWO3t3EDQ== X-Google-Smtp-Source: APXvYqyd8oEr4aTWh6o51LLnh6LGAfutqigk69w0pUSjSa/0iLG6XEhuZgiyYnTsqjVztxAkZRnXLr6qGToTYADKbQ4= X-Received: by 2002:a1c:4e05:: with SMTP id g5mr2829747wmh.53.1552666183989; Fri, 15 Mar 2019 09:09:43 -0700 (PDT) MIME-Version: 1.0 References: <155229406950.16918.2163707322967420687.idtracker@ietfa.amsl.com> In-Reply-To: From: Seth Blank Date: Fri, 15 Mar 2019 09:09:32 -0700 Message-ID: To: "Kurt Andersen (IETF)" Cc: bimi@ietf.org Content-Type: multipart/alternative; boundary="0000000000005a372c058424449b" Archived-At: Subject: Re: [Bimi] draft-bkl-bimi-overview-00 X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 16:09:48 -0000 --0000000000005a372c058424449b Content-Type: text/plain; charset="UTF-8" On Thu, Mar 14, 2019 at 2:06 PM Kurt Andersen (IETF) wrote: > In section 3, the opening sentence refers to benefits for senders and > recipients. I think it should also identify that there are potential > benefits to receivers and operators of MUAs too. > Excellent point. > In section 3.1, there is a reference to "changes the secret handshake". I > think that the point of having a public standard is that the crucial change > is to make is a non-secret handshake. I appreciate that this is qualified > with "if implemented poorly", but that should perhaps be changed to "if > specified poorly (or obscurely)". > Do the current drafts present a framework that clears the bar? Opinions differ, but there's a reasonable argument that the bar is still only clearable if you're a large US/EU organization, and the goal of being approachable to all domain owners has not yet been met. This is a crucial question for the BoF. Seth --0000000000005a372c058424449b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Mar 14, 2019 at 2:06 PM Kurt Ande= rsen (IETF) <kurta+ietf@drkur= t.com> wrote:
In section 3, the op= ening sentence refers to benefits for senders and recipients. I think it sh= ould also identify that there are potential benefits to receivers and opera= tors of MUAs too.

Excellent poi= nt.
=C2=A0
In section 3.1, there is a reference to "change= s the secret handshake". I think that the point of having a public sta= ndard is that the crucial change is to make is a non-secret handshake. I ap= preciate that this is qualified with "if implemented poorly", but= that should perhaps be changed to "if specified poorly (or obscurely)= ".

Do the current drafts p= resent a framework that clears the bar? Opinions differ, but there's a = reasonable argument that the bar is still only clearable if you're a la= rge US/EU organization, and the goal of being approachable to all domain ow= ners has not yet been met. This is a crucial question for the BoF.

Seth
--0000000000005a372c058424449b-- From nobody Sun Mar 17 14:14:21 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90D2912865D for ; Sun, 17 Mar 2019 14:14:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=zMBPyN9R; dkim=pass (1536-bit key) header.d=taugh.com header.b=fh5PKgL+ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q_zEXpo6dO4p for ; Sun, 17 Mar 2019 14:14:19 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 118C41277D7 for ; Sun, 17 Mar 2019 14:14:18 -0700 (PDT) Received: (qmail 83216 invoked from network); 17 Mar 2019 21:14:17 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=1450e.5c8eb8a9.k1903; bh=D68X1ZBPtFNlJGPWJ6jNaOSvLjLV0Z40p58qLRtCJOM=; b=zMBPyN9RY4AgQBS5N41Pb7noHXOBmdG9YFqMhc3scHptFFuVfmqfgGyn8r702+J1sUQmd5eg4RLSVRAGXUgm7JQecPjd4eFoyTpByJPD70k+vH8onUc0Izs0xSloWvVzvSDbAY95z85kdSWo37f5j85N5ZG7/I0hY160rnp9X65IvE/ZKGSjAYe2jKG6X+eGcaYSFEkh6YcgRkyIh7L5jxrtLtQqCiJ8PeYNZ4ZneCv1xHrJHR00C2FcZeC50t1A DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=1450e.5c8eb8a9.k1903; bh=D68X1ZBPtFNlJGPWJ6jNaOSvLjLV0Z40p58qLRtCJOM=; b=fh5PKgL+NFKYX7qxLuqeB6LHSK9+3N3ad/BkMG/jte12afbM4XejqtJtcbLhV9DzFJBsH/uQP0GyH98JPezaRucWIQ8Uccgv8LBTGFceLgJF6iuy3SlgBJXTfibiEndBUNUXs9kraB89dqGAfNGWIctlFsdzqhc5ikFCIJvLcpmNplocD4dCyQEqajSOwwoikeIXVAQdkjusiSOaA2nEtmGSjUdfjz9nc09eoTtrUhasV1GK7rviqWIgBIDNyIGK Received: from ary.qy ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTP via TCP6; 17 Mar 2019 21:14:17 -0000 Received: by ary.qy (Postfix, from userid 501) id 3F62A200FF7F2A; Sun, 17 Mar 2019 17:14:16 -0400 (EDT) Date: 17 Mar 2019 17:14:16 -0400 Message-Id: <20190317211417.3F62A200FF7F2A@ary.qy> From: "John Levine" To: bimi@ietf.org Cc: seth@valimail.com In-Reply-To: Organization: Taughannock Networks X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 8bit Archived-At: Subject: Re: [Bimi] draft-bkl-bimi-overview-00 X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Mar 2019 21:14:20 -0000 In article you write: >> recipients. I think it should also identify that there are potential >> benefits to receivers and operators of MUAs too. I would want to see more than speculation there. As Dave Crocker often reminds us, human factor research has made it clear that most humans are completely unable to do anything useful with security indicators. That's one of the reasons that browsers aren't showing EV cert indicators any more, and have made it a lot harder to click through invalid cert warnings. I'm not aware of any research specifically about indicators on mail messages. Perhaps that would be a good place to toss some money at academic researchers. R's, John From nobody Sun Mar 17 14:24:03 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 338E6127964 for ; Sun, 17 Mar 2019 14:24:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=valimail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DpaXE7xTO9Zg for ; Sun, 17 Mar 2019 14:23:59 -0700 (PDT) Received: from mail-wm1-x32a.google.com (mail-wm1-x32a.google.com [IPv6:2a00:1450:4864:20::32a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A4DB1277D7 for ; Sun, 17 Mar 2019 14:23:59 -0700 (PDT) Received: by mail-wm1-x32a.google.com with SMTP id o10so12992863wmc.1 for ; Sun, 17 Mar 2019 14:23:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=valimail.com; s=google2048; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=UY6aUSTUuzjPvRKXUyBQJS/gVmMdST+X1ogmsEtphZM=; b=Yu7xqk+A+kTbMzk9SDEICSO/+f76WFjYWTlKyuY72Dbj+53B/rLtsoWD4XCoJ72KXN cI7E48gU0JmDFouvTrQfebjCuNObU2A+rfbv3QSrqxVkKG8e2rjM1y/j8mBMR128yki4 pVdzIPSEqL9uLATddDCjibBZUov5C4bRkXHo9gwBKN6YMZvNLl8vLNLak7LEvAV4c2dI g2PBg5Dd7VsQ2JWwNy95QC9WEOMcYBpIP6pIhSMOzrBW4htI00LoyB3UOmp66lUYP2nP 81y0otxKewRFYtlKpwR/pWfprMdvEActeNevriVxdizSDC0wyegLFtKw/Ksn5tssRmGw OpsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=UY6aUSTUuzjPvRKXUyBQJS/gVmMdST+X1ogmsEtphZM=; b=n5mpEn0sLwc/tMraQykWqUwUkipxeY+16XYCLbi07bWlaPtcb6tYJR2lCyhYCpXxnc sMUVn/bziEooSYke/Jwpd0jKnUmj9J3LKhlbxBk5K6UBMvQ1Y92Csfr3YDZ2SFO5Ung4 PSaI02XuFKdK4iwt0eL93LaQhCEXvxE0qdQ/OynvDfyQKd0JjoNEUQP8BMjqN8U2eXw9 UYKHBADweYS8MntW0lxyo4AL1R8K2vaGgc6JQtTZImXBh7hYti6Ukoye7yhvU/5RR0VM xfdttgReLwmWUT2ZrbgTuOrW2ROtpnHVogrZwIJqXOv0ctLxfuH21KEXyHa5/ioYDD0/ GpKw== X-Gm-Message-State: APjAAAX3oZyR8g05tNghHFrIVnGhffQt12KH6NgXANaHylNFgBgV8DRH pQz807gr8PSgJ3CHZu7wyyEeac3y5O5V2arUAEV5Zp+xvLI= X-Google-Smtp-Source: APXvYqw5DRYJVNYe5PH1g2Xke0bT6tN3JOyNjd4Caz1SkxxpBIYsf5jen++IN4PcCYLxRmuKnnpeuNnIT9pcRMK6m4o= X-Received: by 2002:a1c:e2c2:: with SMTP id z185mr8513960wmg.84.1552857837317; Sun, 17 Mar 2019 14:23:57 -0700 (PDT) MIME-Version: 1.0 References: <20190317211417.3F62A200FF7F2A@ary.qy> In-Reply-To: <20190317211417.3F62A200FF7F2A@ary.qy> From: Seth Blank Date: Sun, 17 Mar 2019 14:23:46 -0700 Message-ID: To: bimi@ietf.org Content-Type: multipart/alternative; boundary="000000000000c7cc78058450e3dc" Archived-At: Subject: Re: [Bimi] draft-bkl-bimi-overview-00 X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Mar 2019 21:24:01 -0000 --000000000000c7cc78058450e3dc Content-Type: text/plain; charset="UTF-8" On Sun, Mar 17, 2019 at 2:14 PM John Levine wrote: > In article QH_w@mail.gmail.com> you write: > >> recipients. I think it should also identify that there are potential > >> benefits to receivers and operators of MUAs too. > > I would want to see more than speculation there. BIMI is about standardizing logo discovery, making a currently siloed process approachable to domain owners and smaller receivers. This is the value I believe Kurt was alluding to (for receivers and thick mail clients) - nothing at all about the user impact, for the exact reasons you outlined. Seth --000000000000c7cc78058450e3dc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sun, Mar 17, 2019 at 2:14 PM John Levi= ne <johnl@taugh.com> wrote:
In article <CAOZAAfOKm=3DNO4w=3DGwgxMLcqYKkkHgh00NSd5spFBs-5t= p=3DQH_w@mail.gmai= l.com> you write:
>> recipients. I think it should also identify that there are potenti= al
>> benefits to receivers and operators of MUAs too.

I would want to see more than speculation there.

BIMI is about standardizing logo discovery, making a currently siloed= process approachable to domain owners and smaller receivers.
This is the value I believe Kurt was alluding to (for receivers= and thick mail clients) - nothing at all about the user impact, for the ex= act reasons you outlined.

Seth
--000000000000c7cc78058450e3dc-- From nobody Mon Mar 18 06:56:15 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDC67127970 for ; Mon, 18 Mar 2019 06:56:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=drkurt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jMVU_OruL7S5 for ; Mon, 18 Mar 2019 06:56:11 -0700 (PDT) Received: from mail-it1-x131.google.com (mail-it1-x131.google.com [IPv6:2607:f8b0:4864:20::131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C26BE127598 for ; Mon, 18 Mar 2019 06:56:08 -0700 (PDT) Received: by mail-it1-x131.google.com with SMTP id w18so20522342itj.4 for ; Mon, 18 Mar 2019 06:56:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=drkurt.com; s=20130612; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=TOCfVb9xLZbZLviR6skcdLn+sLPCNIH9U8XBPTfWUmA=; b=PdgoR2DSuEjzkgduai04dWxGBevSYMnlUhJxzmR3fJqTCpzKgXhFtmQn0TnILKnCkb zUeOALtK7KV2mLGOADj93p9o9+h6iXMasKVdiJYD3uCjhqdhXagTT+2ZZJQyDE9j9wvR 4xpmSDpsw6JuU0egJHD3phpKaUIBfgBYJz8Z0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=TOCfVb9xLZbZLviR6skcdLn+sLPCNIH9U8XBPTfWUmA=; b=bHj1bC5HTYFHHUmzDotUzuwbgfYFdcslpHwF9MjzxbuZXNw+5LDrSESET28EOVemOt dAE9A4YalHoqzXUSAYNRe4p6n5wW3dkMNNt1yTegJTlGDLyHJxbFcxVNMZC0DnhAw6aZ Htl06ym5qghjLBDDk9TqVg0RXroiz2xW1aPQ7roHlscemV9xWP9s0LFEjxTcbGc6InsB rYjnI39R/SzRx0MJ5D71Ep3PmuxAxbpGPt4Qn8BT4fyIrh9JznRqhRAlrdw+brMo0k8U CTp+GhkHUncN6+2yywN10djD6XPUG1lFC/GOWqdtOrDMNXeyXQiimTQsff+4D49+ipxI GSeQ== X-Gm-Message-State: APjAAAUaI5qr+SIPhD+oybymhTVm0vup0FEkxkeYJi9YvRDMqEn8qwk3 Es2qoPWFcP78P0Fsn4ld79MVigCAy0E0Uy05azPGKSB+ X-Google-Smtp-Source: APXvYqyeBybxDLryMkZRh5VFOp/mFiPaJCXRd4Lpjte6GiMDKv78Snar8uaGV5krPCCllxoTyWB8VPx7LRO+EJL7aj0= X-Received: by 2002:a24:b143:: with SMTP id c3mr11027445itj.79.1552917367900; Mon, 18 Mar 2019 06:56:07 -0700 (PDT) MIME-Version: 1.0 References: <20190317211417.3F62A200FF7F2A@ary.qy> In-Reply-To: <20190317211417.3F62A200FF7F2A@ary.qy> From: "Kurt Andersen (b)" Date: Mon, 18 Mar 2019 06:55:55 -0700 Message-ID: To: John Levine Cc: bimi@ietf.org, Seth Blank Content-Type: multipart/alternative; boundary="00000000000014580005845ec0af" Archived-At: Subject: Re: [Bimi] draft-bkl-bimi-overview-00 X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 13:56:14 -0000 --00000000000014580005845ec0af Content-Type: text/plain; charset="UTF-8" Benefits to receiver/operators are clear: no more roll your own logo scraping systems are needed. Benefits elsewhere are less clear even though you called them in the doc. --Kurt On Sun, Mar 17, 2019, 14:14 John Levine wrote: > In article QH_w@mail.gmail.com> you write: > >> recipients. I think it should also identify that there are potential > >> benefits to receivers and operators of MUAs too. > > I would want to see more than speculation there. As Dave Crocker > often reminds us, human factor research has made it clear that most > humans are completely unable to do anything useful with security > indicators. That's one of the reasons that browsers aren't showing EV > cert indicators any more, and have made it a lot harder to click > through invalid cert warnings. > > I'm not aware of any research specifically about indicators on mail > messages. Perhaps that would be a good place to toss some money at > academic researchers. > > R's, > John > > -- > bimi mailing list > bimi@ietf.org > https://www.ietf.org/mailman/listinfo/bimi > --00000000000014580005845ec0af Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Benefits to receiver/operators are clear: no more roll yo= ur own logo scraping systems are needed.

Benefits elsewhere are less clear even though you called them in= the doc.

--Kurt

On= Sun, Mar 17, 2019, 14:14 John Levine <johnl@taugh.com> wrote:
In= article <CAOZAAfOKm=3DNO4w=3DGwgxMLcqYKkkHgh00NSd5spFBs-5tp=3DQH_w@m= ail.gmail.com> you write:
>> recipients. I think it should also identify that there are potenti= al
>> benefits to receivers and operators of MUAs too.

I would want to see more than speculation there.=C2=A0 As Dave Crocker
often reminds us, human factor research has made it clear that most
humans are completely unable to do anything useful with security
indicators.=C2=A0 That's one of the reasons that browsers aren't sh= owing EV
cert indicators any more, and have made it a lot harder to click
through invalid cert warnings.

I'm not aware of any research specifically about indicators on mail
messages.=C2=A0 Perhaps that would be a good place to toss some money at academic researchers.

R's,
John

--
bimi mailing list
bimi@= ietf.org
https://www.ietf.org/mailman/listinfo/bimi<= br>
--00000000000014580005845ec0af-- From nobody Tue Mar 26 01:28:00 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E89BF120291 for ; Tue, 26 Mar 2019 01:27:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.989 X-Spam-Level: X-Spam-Status: No, score=-1.989 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=valimail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fVieNwKKnnDg for ; Tue, 26 Mar 2019 01:27:53 -0700 (PDT) Received: from mail-wm1-x32b.google.com (mail-wm1-x32b.google.com [IPv6:2a00:1450:4864:20::32b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 91515120292 for ; Tue, 26 Mar 2019 01:27:52 -0700 (PDT) Received: by mail-wm1-x32b.google.com with SMTP id v14so11838239wmf.2 for ; Tue, 26 Mar 2019 01:27:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=valimail.com; s=google2048; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=eC0PL6Xbl5asaLEAsNjXveYDVuOH1u9BKOdVdNctAo8=; b=JYbcMW55zSP4z+WHIyuqzvMq/GwUzvyJpRQdHvBsCmGdfKpGB6N36sZXqQo0zf4z5/ b9X0y+wcLdI3pcM/NRdPtd3pKTF/7EyoId96IypDGAbyf8z2Houwy1xW79J5XmOQegPx wCFv0DDLfzOJkQo7rIqulyTMLEGuRtFasj4tfpS9f+su0uDG9i5Abbstj93OT3/7oDxb mmto0tOpE3WYwRsq6R5xfCt/Xb+V6LB4EFFEg9AOKsnt01U8h3kbIFy+OBvZxNtpdLst OmzlZuOTDNmsjCDELvleLdD/CLkuVPqnVAmV3qNKyDI3kEU1PBumHX1E09QjpNn/ZoSZ dogQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=eC0PL6Xbl5asaLEAsNjXveYDVuOH1u9BKOdVdNctAo8=; b=L4sV8xAPxisRlYKWpuPmnyZhFR/sSZUd2REB94JjkH3/GyO2GCssmPP0ABTu73mafG 3cRoP4xOrN9QzLmPYNS4aeiOf8o4D2wkk9MGzFgHuQdINJUnCv13eRLXeG3heUHOGBTm MLG6ZbrHjjNrC35erZY9DYWSrHfz8Tj8o5nIOj2NloAlR2W34A0qxhtcOFcrJEogHyPZ 9XW3zfaGbbmWIaSjCbyJmjxEw0Lgm4UPTgRpjLRBsOpU5Mer/88eh/3moobr3jCXw3RU D/h2VXKP3IVWgQMAQ+DmcCkAwGnTqw8bGaKtkkFPntrCiBXtXrp9tmtjywSBuHECXcse 1p6Q== X-Gm-Message-State: APjAAAUhBLDjpOWkzewa54szQpj9dXSP7vtPRRFdsIb25EEs+f9IIQKT 9AKvV9A9B4Qu7uQFSJTLzRI+YtLMkRD/W6lUJPg7rsnH6bHZJA== X-Google-Smtp-Source: APXvYqxf6LY/AaEyz/e0mA8n155/FFaKdMsTdi6L79Ci73N2Cu/spf1OEPbpzNEIapgk8pFqIH7XvWI4vF73XUMfguI= X-Received: by 2002:a1c:63c3:: with SMTP id x186mr13367102wmb.47.1553588870661; Tue, 26 Mar 2019 01:27:50 -0700 (PDT) MIME-Version: 1.0 References: <155147459853.6101.3973570425743901333.idtracker@ietfa.amsl.com> In-Reply-To: <155147459853.6101.3973570425743901333.idtracker@ietfa.amsl.com> From: Seth Blank Date: Tue, 26 Mar 2019 09:27:40 +0100 Message-ID: To: bimi@ietf.org Content-Type: multipart/alternative; boundary="000000000000c389760584fb1807" Archived-At: Subject: Re: [Bimi] bimi - Requested session has been scheduled for IETF 104 X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 08:27:59 -0000 --000000000000c389760584fb1807 Content-Type: text/plain; charset="UTF-8" Just a reminder to everyone that our BoF will be this Thursday at 1610 CET / 0810 PT On Fri, Mar 1, 2019 at 10:43 PM "IETF Secretariat" wrote: > Dear Liz Flynn, > > The session(s) that you have requested have been scheduled. > Below is the scheduled session information followed by > the original request. > > > bimi Session 1 (1:30 requested) > Thursday, 28 March 2019, Afternoon Session II 1610-1810 > Room Name: Karlin 3 size: 60 > --------------------------------------------- > > > iCalendar: https://datatracker.ietf.org/meeting/104/sessions/bimi.ics > > Request Information: > > > --------------------------------------------------------- > Working Group Name: Brand Indicators for Message Identification > Area Name: Applications and Real-Time Area > Session Requester: Liz Flynn > > Number of Sessions: 1 > Length of Session(s): 1.5 Hours > Number of Attendees: 50 > Conflicts to Avoid: > First Priority: dmarc lamps dispatch jmap extra > > > > > People who must be present: > Alexey Melnikov > > Resources Requested: > > Special Requests: > Also avoid security area BOFs. Request Tues, Wed, Thurs > --------------------------------------------------------- > > -- > bimi mailing list > bimi@ietf.org > https://www.ietf.org/mailman/listinfo/bimi > -- Seth Blank | Director, Industry Initiatives e: seth@valimail.com |* p: *415-273-8818 This email and all data transmitted with it contains confidential and/or proprietary information intended solely for the use of individual(s) authorized to receive it. If you are not an intended and authorized recipient you are hereby notified any use, disclosure, copying or distribution of the information included in this transmission is prohibited and may be unlawful. Please immediately notify the sender by replying to this email and then delete it from your system. --000000000000c389760584fb1807 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Just a reminder to everyone that our BoF will be this= Thursday at 1610 CET / 0810 PT

On Fri, Mar 1, 2019 at 10:43 PM "IETF S= ecretariat" <agenda@ietf.org= > wrote:
Dear= Liz Flynn,

The session(s) that you have requested have been scheduled.
Below is the scheduled session information followed by
the original request.


=C2=A0 =C2=A0 bimi Session 1 (1:30 requested)
=C2=A0 =C2=A0 Thursday, 28 March 2019, Afternoon Session II 1610-1810
=C2=A0 =C2=A0 Room Name: Karlin 3 size: 60
=C2=A0 =C2=A0 ---------------------------------------------


iCalendar: https://datatracker.ietf.org/me= eting/104/sessions/bimi.ics

Request Information:


---------------------------------------------------------
Working Group Name: Brand Indicators for Message Identification
Area Name: Applications and Real-Time Area
Session Requester: Liz Flynn

Number of Sessions: 1
Length of Session(s):=C2=A0 1.5 Hours
Number of Attendees: 50
Conflicts to Avoid:
=C2=A0First Priority: dmarc lamps dispatch jmap extra




People who must be present:
=C2=A0 Alexey Melnikov

Resources Requested:

Special Requests:
=C2=A0 Also avoid security area BOFs. Request Tues, Wed, Thurs
---------------------------------------------------------

--
bimi mailing list
bimi@ietf.org
https://www.ietf.org/mailman/listinfo/bimi


--

Seth Bl= ank | Director, Industry Initiatives

<= p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><= span style=3D"font-size:10pt;font-family:Arial;font-weight:700;vertical-ali= gn:baseline;white-space:pre-wrap">e: seth@valimail.com<= b> | p: 415-273-8818

This email and all data transmitted with it contains confide= ntial and/or proprietary information intended solely for the use of individ= ual(s) authorized to receive it.=C2=A0= =C2=A0If you are not an intended and au= thorized recipient you are hereby notified any use, disclosure, copying or = distribution of the information included in this transmission is prohibited= and may be unlawful.=C2=A0=C2=A0Please immediately notify the sender by reply= ing to this email and then delete it from your system.

--000000000000c389760584fb1807-- From nobody Thu Mar 28 17:01:45 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF4F9120308 for ; Thu, 28 Mar 2019 17:01:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id regZ60vy9ai8 for ; Thu, 28 Mar 2019 17:01:40 -0700 (PDT) Received: from bsa2.jck.com (bsa2.jck.com [70.88.254.51]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7708120342 for ; Thu, 28 Mar 2019 17:01:40 -0700 (PDT) Received: from [198.252.137.10] (helo=PSB) by bsa2.jck.com with esmtp (Exim 4.82 (FreeBSD)) (envelope-from ) id 1h9exn-000FiI-GP for bimi@ietf.org; Thu, 28 Mar 2019 20:01:39 -0400 Date: Thu, 28 Mar 2019 20:01:31 -0400 From: John C Klensin To: bimi@ietf.org Message-ID: <309EBD4AD64BE436663E721D@PSB> X-Mailer: Mulberry/4.0.8 (Win32) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Content-Disposition: inline X-SA-Exim-Connect-IP: 198.252.137.10 X-SA-Exim-Mail-From: john-ietf@jck.com X-SA-Exim-Scanned: No (on bsa2.jck.com); SAEximRunCond expanded to false Archived-At: Subject: [Bimi] Today's BoF X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 00:01:44 -0000 Hi. Interesting presentation. I didn't get in the mic queue because most of my concerns were covered by others and almost certainly won't have time to follow the list, but I want to make a few suggestions: First, the organizers should find and read the Jabber log. There is a good deal of relevant material there that was not covered in the same way during the BoF. Warning: the tone of several comments, almost certainly including mine, probably conveys some frustration. Some of the reasons for that frustration can be deduced from the comments below. I'm an oddity as an email user. As examples, I've been using it on a near-daily basis for a _very_ long time; I (like many other IETF participants but unlike the general public) handle a large amount of traffic every day; and I am in environments often enough that, due to poor connectivity or other reasons, give me incentives to download relevant messages in batches and read and respond to them offline. It also run my own MTA. On the other hand, I've got a sibling who is significantly technology-challenged, who reads mail through a web interface, and who thinks getting a dozen messages in 24 hour is a busy day. When we agree about something involving user needs or preferences, it is nothing like the result of a controlled experiment based on a proper sample, but it is usually a rather good clue. The desires of marketers and advertisers notwithstanding, neither of us like graphical clutter in our email: images slow down the rate at which messages load, make caches and archives bigger, and, unless they actually convey useful information, are rarely actually helpful. So, if a system like this one proposes to fill screen real estate with logos or other brand identification images, I/we are likely to go looking for ways to block those images. If there are characteristics of BIMI images that make that easy, so much the better. If I can block them easily, that also helps control phishing because the only brand images that will get through will probably be attacks and the delete key is never far away. So my first observation isn't really an IETF problem, but you folks should be careful what you wish for. More into the IETF problem space, the presentation, as I understood it, seems to rely on technological ideas that have been tried and rather thoroughly demonstrated to not work or not be deployable in practice. For starters, remember that we knew by the late 1980s what a technical solution that would have dealt with all of the key targets of the BIMI proposal and many others would look like: Sign message bodies, and optionally encrypt them, using a PKI that provided very strong assurance of the binding between the certificate, the authenticated identity of the signer, and with at least some connection to reputational information. If that information did not check out on receipt, the message would either be discarded or would be delivered with very strong warnings. In particular, if brand identity information were sent with the message, the recipient could be assured of its authenticity by knowing where the message came from in much stronger ways than provided by SPF, DKIM, and/or DMARC. While the technology evolved somewhat, it never took off. It would probably be safe to say that, with the exception of a rather few extra-paranoid or extra-privacy-sensitive individuals and some special applications, adoption has been about zero. There were several people at the BOF --in the room or remote-- who could tell you at great length why that never happened (although we might have different theories about which elements were most important) but the bottom line is that, AFAICT, the model presented at today's BOF relies on either the the assumptions on that early idea and would be likely to have deployment problems for similar reasons, or relies on variations on those assumptions that are so diluted as to make attacks by a determined party rather easy. john From nobody Fri Mar 29 09:03:35 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC2FD120430 for ; Fri, 29 Mar 2019 09:03:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.801 X-Spam-Level: X-Spam-Status: No, score=-0.801 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4mfIFLreb2LH for ; Fri, 29 Mar 2019 09:03:31 -0700 (PDT) Received: from simon.songbird.com (simon.songbird.com [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 16C0512046E for ; Fri, 29 Mar 2019 09:02:32 -0700 (PDT) Received: from [192.168.1.85] (108-226-162-63.lightspeed.sntcca.sbcglobal.net [108.226.162.63]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1.1) with ESMTP id x2TG4CS6018259 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for ; Fri, 29 Mar 2019 09:04:12 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1553875453; bh=pGOsMaCpf/dFK3LL2VeDT99LnIskpSAtH6fLoSK/FEg=; h=To:Reply-To:From:Subject:Date:From; b=b+/BskMy641biIUkkZkXWDhjSHQouMOisZCtmyuZyWDrRBfKF/Wq3bZYdSB0izm7O aXg2FT53vR6Rtg0HxkUxLwIQjd7oXZX4hqYF+Zc4PLroA7slLE5H0sm6evvS+x8svZ ypqWbQ5Nx+HFQkUE6+mjXxy0Vra8pNry9bWEpOOI= To: "bimi@ietf.org" Reply-To: dcrocker@bbiw.net From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <6e99b975-73d8-9f57-450f-bfa1c2227a31@dcrocker.net> Date: Fri, 29 Mar 2019 09:02:21 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: [Bimi] Problematic cert activities X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 16:03:33 -0000 This includes some details about bad actors getting 'valid' certificates to which they were not authorized: Briefing on Dec 18 - Jan 19 DNS/IMAP Prepositioning Attacks - Bill Woodcock https://www.youtube.com/watch?v=oNF6TE75mzg&t=4s&fbclid=IwAR0-oyzrIeMrN6ufedjeNy4QugKmKOak6AF0fd0Qn7IvlFMZcbITdZzXf84 d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sun Mar 31 16:48:48 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F5A51201BE for ; Sun, 31 Mar 2019 16:48:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.501 X-Spam-Level: X-Spam-Status: No, score=-17.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zkNXQqWuxKyR for ; Sun, 31 Mar 2019 16:48:44 -0700 (PDT) Received: from mail-ua1-x932.google.com (mail-ua1-x932.google.com [IPv6:2607:f8b0:4864:20::932]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6DE90120073 for ; Sun, 31 Mar 2019 16:48:44 -0700 (PDT) Received: by mail-ua1-x932.google.com with SMTP id d5so2459202uan.6 for ; Sun, 31 Mar 2019 16:48:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=6fNEG2yBG1OdpTjE+H43lq2o30yb0VAbq2Og8llaQHQ=; b=gcNav4SbICrVR0jENFJFslPznC3kx3HhxOIk6KGdM7Xc71y2lLeJQplVqE+b3e8iqX 2lE5QXgV/DS7Uvhx0CpQ/UGmJWX2QomwDaAx5s668yuqbW2C//hiHPs5x7GzBzxs45Ev 0OtEnYDl47+pJC4B62NAIUsrCQJK3MFcZGGmA97IkF/D00OMzEW5UbQLpl4czhjryaZU kcV+iZj8zRvrMfVNsm4P9EHuwYvGf6s260aiPljZkOlymfrNNeY0C7TF8/tvRJJUKUIe a+K7hEZ9MwsQjpv4J28WyQO2Io8vc36c5v8MPfo5df4caauBjEAJZrqayNCTXYIJifp1 iq/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=6fNEG2yBG1OdpTjE+H43lq2o30yb0VAbq2Og8llaQHQ=; b=unHlxGXNxlZXTo5dFjk2ylJtUmcynn9gPsNAf/N2po25AHYey3SENnWF5rXoKhBUnE 2VZkYujj9COthvtcp4cyW24gdwlL+W4Qn52YeWZyhOqMezuSJqSckaFx/QB94LQ147EB vFTfGCAu0mIIEvpMkKNOJQ1L70hHJK/P1XgluDdU34HEW7KNRNZcHtHU1G1ApCR4ukNV Bt1vx5zUGVhjYxyzqakYLD9SrxHw75F1VKCXLR2bsG2GBIqOmy3vZwDLKP4MpnZ611zc nG+rQPQXR2tv3R9BF8ww2llhZZG4vpEe1qdO3cF032HNS6sC+f5XtCPLUJPeCXV++3OD DQNQ== X-Gm-Message-State: APjAAAVUlKmViDHdV26ixJBetnyk9kFQirx7al/RW3pnkUUpi9t1DsGx tNhCOeEZdOcNjunDo4gwM1csemstzpUjA0Qjs/3RNA== X-Google-Smtp-Source: APXvYqwrV6dKivpFAWIzacn56sBK310k1ObEW+449nFjD03xedM4wVR3dmswxPAEM0f043I+z+i7HPZTUEMNMziyDrA= X-Received: by 2002:a9f:24ee:: with SMTP id 101mr28001350uar.87.1554076122978; Sun, 31 Mar 2019 16:48:42 -0700 (PDT) MIME-Version: 1.0 References: <309EBD4AD64BE436663E721D@PSB> In-Reply-To: <309EBD4AD64BE436663E721D@PSB> From: Wei Chuang Date: Sun, 31 Mar 2019 16:48:15 -0700 Message-ID: To: John C Klensin Cc: bimi@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000004e724e05856c8b43" Archived-At: Subject: Re: [Bimi] Today's BoF X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Mar 2019 23:48:47 -0000 --0000000000004e724e05856c8b43 Content-Type: multipart/alternative; boundary="0000000000004415ec05856c8b42" --0000000000004415ec05856c8b42 Content-Type: text/plain; charset="UTF-8" John, Apologies for the delay as I was in transit. *From: *John C Klensin *Date: *Thu, Mar 28, 2019 at 5:01 PM *To: * > > More into the IETF problem space, the presentation, as I > understood it, seems to rely on technological ideas that have > been tried and rather thoroughly demonstrated to not work or not > be deployable in practice. BIMI depends on DMARC/DKIM/SPF, and if the sender/receiver chooses to validate the logo owner X.509. Certainly the former has been deployed at scale for email, and the latter web and other places at scale. > For starters, remember that we knew > by the late 1980s what a technical solution that would have > dealt with all of the key targets of the BIMI proposal and many > others would look like: Sign message bodies, and optionally > encrypt them, using a PKI that provided very strong assurance of > the binding between the certificate, the authenticated identity > of the signer, and with at least some connection to reputational > information. If that information did not check out on receipt, > the message would either be discarded or would be delivered with > very strong warnings. In particular, if brand identity > information were sent with the message, the recipient could be > assured of its authenticity by knowing where the message came > from in much stronger ways than provided by SPF, DKIM, and/or > DMARC. > On that I agree, that email sender based PKI aka S/MIME would provide much strong i.e. per sender verifiable identiy. > > While the technology evolved somewhat, it never took off. It > would probably be safe to say that, with the exception of a > rather few extra-paranoid or extra-privacy-sensitive individuals > and some special applications, adoption has been about zero. > Agreed. > There were several people at the BOF --in the room or remote-- > who could tell you at great length why that never happened > (although we might have different theories about which elements > were most important) but the bottom line is that, AFAICT, the > model presented at today's BOF relies on either the the > assumptions on that early idea The BIMI proposal depends on different, domain based authentication technologies that have been already deployed at scale. > and would be likely to have > deployment problems for similar reasons, or relies on variations > on those assumptions that are so diluted as to make attacks by a > determined party rather easy. > But agreed that using S/MIME would have been problematic, and that constraint certainly guides the BIMI proposal. My own informal polling was the key management per sender is too difficult for most senders to deploy. Even managing relatively few keys per domain as needed by DKIM and the crypto involved is burdensome to many, hence the proposal still allows for SPF. My worry, as Dave Crocker's recent message on BIMI highlights, is that these domain based authentication methods depend on the integrity of DNS, and apparently there's now viable attacks on DNS (The Route 53/BGP hijack is another). Perhaps this proposal needs to take into account such DNS attacks now rather than later. -Wei > john > > -- > bimi mailing list > bimi@ietf.org > https://www.ietf.org/mailman/listinfo/bimi > --0000000000004415ec05856c8b42 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
John,
Apologies for the delay as I was in t= ransit.

From: John C Klensin <john-ietf@jck.com>
D= ate: Thu, Mar 28, 2019 at 5:01 PM
To: <bimi@ietf.org>



More into the IETF problem space, the presentation, as I
understood it, seems to rely on technological ideas that have
been tried and rather thoroughly demonstrated to not work or not
be deployable in practice.

BIMI depends on = DMARC/DKIM/SPF, and if the sender/receiver chooses to validate the logo own= er X.509.=C2=A0 Certainly the former has been deployed at scale for email, = and the latter web and other places at scale.
=C2=A0
=C2=A0 For starters, remember th= at we knew
by the late 1980s what a technical solution that would have
dealt with all of the key targets of the BIMI proposal and many
others would look like: Sign message bodies, and optionally
encrypt them, using a PKI that provided very strong assurance of
the binding between the certificate, the authenticated identity
of the signer, and with at least some connection to reputational
information.=C2=A0 If that information did not check out on receipt,
the message would either be discarded or would be delivered with
very strong warnings. In particular, if brand identity
information were sent with the message, the recipient could be
assured of its authenticity by knowing where the message came
from in much stronger ways than provided by SPF, DKIM, and/or
DMARC.=C2=A0

On that I agree, that ema= il sender based PKI aka S/MIME would provide much strong i.e. per sender ve= rifiable identiy.
=C2=A0

While the technology evolved somewhat, it never took off.=C2=A0 =C2=A0It would probably be safe to say that, with the exception of a
rather few extra-paranoid or extra-privacy-sensitive individuals
and some special applications, adoption has been about zero.

Agreed.
=C2=A0
There were several people at the BOF --in the room or remote--
who could tell you at great length why that never happened
(although we might have different theories about which elements
were most important) but the bottom line is that, AFAICT, the
model presented at today's BOF relies on either the the
assumptions on that early idea

The BIMI pr= oposal depends on different, domain based authentication technologies that = have been already deployed at scale.
=C2=A0
and would be likely to have
deployment problems for similar reasons, or relies on variations
on those assumptions that are so diluted as to make attacks by a
determined party rather easy.

But agre= ed that using S/MIME would have been problematic, and that constraint certa= inly guides the BIMI proposal.=C2=A0 My own informal polling was the key ma= nagement per sender is too difficult for most senders to deploy.=C2=A0 Even= managing relatively few keys per domain as needed by DKIM and the crypto i= nvolved is burdensome to many, hence the proposal still allows for SPF.=C2= =A0=C2=A0

My worry, as Dave Crocker's recent m= essage on BIMI highlights, is that these domain based authentication method= s depend on the integrity of DNS, and apparently there's now viable att= acks on DNS (The Route 53/BGP hijack is another).=C2=A0 Perhaps this propos= al needs to take into account such DNS attacks now rather than later.
=

-Wei
=C2=A0
=C2=A0 =C2=A0 john

--
bimi mailing list
bimi@ietf.org
https://www.ietf.org/mailman/listinfo/bimi
--0000000000004415ec05856c8b42-- --0000000000004e724e05856c8b43 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMWMqzbpn2SydMzpfaMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE4MTExNTE4NDMwM1oXDTE5MDUx NDE4NDMwM1owIjEgMB4GCSqGSIb3DQEJAQwRd2VpaGF3QGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQDOGIfi32h8dhJEeUGHfN1nAVrJsY4ph3nisYgnB2pOA4hcNkX4 xnnbD7PDr6G2S6LqYfXegzUkLT7FoOGtptBAixwpSxBUvEWQdrlbYdYuoNK7/DBASrlp4J7UocGX ZS5dkWL0IolToc52mCmOxhTqDjbD9MG3+AvyyQPK0RVgNY5n7BZBdNZDHTeswReAtjQ4t+b1IStQ 7Y59jxTOfDPpAT2Y0ON44Lx2hBLyQ8wXYCmHHbWCyGT3xZH0p8p+cGgkKvDjaxBX3ilopH8hx4zm 5HVh6wDOBHhAnRYVU1bqmjohWNuLhz/Za6lWGiylhPD+2yFLQfvHn6OBE0a/048NAgMBAAGjggFu MIIBajAcBgNVHREEFTATgRF3ZWloYXdAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFJUPLExeOaBiYyZVRuorZTtplIumMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQBuvV1bxPXhqWWCHYz7 40fvnmDIUsNiLecW3PCDQxdpPMc3V/6T31qSKYvuFigtj2MpXMCkLqbHupVN3b14UvnqNx3jnu7b Yp+rMcjjO70W3ufBqqz/QQzSykR9ATo+Zqs09dhJtTl02ApUqYipoInGx8wu0ChTI84NwR5UUo7H GSOet+Eluj5Yjq0YdM2qzfapP/XbfO7t533yiK5Cs//IlaQagdizrM/b1DTYjJ/28b3uPMS3l6a8 BoWm7kiV6GCY7zBNF9D6Gkf6U4dZgx6SwQjQoG3mSBV1zzIs0cZYoVvq/8y+5jC9CdH1ran/ahb6 1ZtMG4auBaKMRzEe3TimMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMWMqzbpn2 SydMzpfaMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCD0V5taA5h8fYx5sE8DCGGW kHye+e5oIUVEq7LyV7LxNzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTAzMzEyMzQ4NDNaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAEDJoBieLPtoWqy9Rno+FHmNbbiu94KsPD1/Xw8iy 0Ar6St+Py5J+Whf9xpH+gs3PVetdk+AvOUkY80mdQrfTHbVxTcx7/bEgfavZgFf1PwWSalmeoTgS BH1fedE3KvaeL4hlG0SkPhp8W6OiFJpV9X6jrQq1b/NXtJcwgRJgxtNyhl1iMFUSNHebdbw3Pt3L xe1k6Ljk2m2FxZEIyX34to652SZKs+/jiG9/WoK6nf3/yQl5Vq+gu/LTgWeligXpTddZ77uJ54Qe 3juFGhyYdoqCBL5omIOOrNQxWNGWiC82tM1stKUryyOBzDAsVKVl/Q7LWyxF53HPLtzFFpBl6A== --0000000000004e724e05856c8b43-- From nobody Sun Mar 31 17:00:13 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B11B1201A3 for ; Sun, 31 Mar 2019 17:00:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.401 X-Spam-Level: X-Spam-Status: No, score=-2.401 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4MWtAGc3WtPs for ; Sun, 31 Mar 2019 17:00:10 -0700 (PDT) Received: from simon.songbird.com (simon.songbird.com [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB0F01201BE for ; Sun, 31 Mar 2019 17:00:09 -0700 (PDT) Received: from [192.168.1.85] (108-226-162-63.lightspeed.sntcca.sbcglobal.net [108.226.162.63]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1.1) with ESMTP id x3101lK2005457 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Sun, 31 Mar 2019 17:01:48 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1554076908; bh=oO7oV84QDv9J83rUsAugapzryyBfHSCmrvWxYWen72E=; h=Subject:To:Cc:References:From:Reply-To:Date:In-Reply-To:From; b=C5EXUVtXAS8B3r50wEKxK9xbOCL16viJkdpA+XAv9m9Px5j7RH3yBZQPAmpUnNh6U ohLQd21eDHTd5JEcDfWq0CSouddu1Gnj5wFlvUzp1XEJ6yCWKAQ260WRVKvIi00bd+ m3e3LJbyasO72QLlLt8uCI4ts1uKMzm70xZQLI5U= To: Wei Chuang , John C Klensin Cc: bimi@ietf.org References: <309EBD4AD64BE436663E721D@PSB> From: Dave Crocker Reply-To: dcrocker@bbiw.net Organization: Brandenburg InternetWorking Message-ID: Date: Sun, 31 Mar 2019 16:59:56 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Bimi] Today's BoF X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Apr 2019 00:00:12 -0000 On 3/31/2019 4:48 PM, Wei Chuang wrote: > The BIMI proposal depends on different, domain based authentication > technologies that have been already deployed at scale. The message-based domain-validation components are not the issue. The use of certificate authorities is. At scale they are problematic, in spite of the tendency to claim that their use for TLS says they aren't. And their use for linkage between domain name and logo is, since there's no history at scale. And any effort to use 'validated' logos at scale has no history, where the challenges in doing that have been well- and often-cited. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net