From nobody Mon Apr 1 09:10:06 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C6D71202C0 for ; Mon, 1 Apr 2019 09:10:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dfoaNYVrG0Jx for ; Mon, 1 Apr 2019 09:10:00 -0700 (PDT) Received: from mail-vs1-xe36.google.com (mail-vs1-xe36.google.com [IPv6:2607:f8b0:4864:20::e36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 835651202BB for ; Mon, 1 Apr 2019 09:10:00 -0700 (PDT) Received: by mail-vs1-xe36.google.com with SMTP id g187so5845629vsc.8 for ; Mon, 01 Apr 2019 09:10:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Y3v/BvOGgjuMtojRYuZZPlxR1MNWzlqCyFKnrJej44U=; b=B7lvtiTpBZ32FHiVLDmymrdwdc2c5a9W7K8zBEpNSsrcFDxkmRZzeQnoEjJOmE9UMX OBrk0SKmc/1LdRrWQDwjqc6ZSrGmHvhoG4PJ/Ogp7Gpofol/mgon/JrgY1+pGTcwbdDW wOH/NVVS3v0oEUO+/59RThz47C1SnoGByZDgD4NqEP6/VqJO7iwzJofYQ4tO/xHXEeeG GNjlazBGz9cuTzn6fpKtaOSk1mBV7rS/OU39/fTma10+2cWjr+FW5WEQg1WPDa22rCVb lB0+sKoFIgsVPuXWaUxMCwlEbL0NeQhIB/63+flHT7IyliLaZNDbAms+StlS2D33bVOw BAHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Y3v/BvOGgjuMtojRYuZZPlxR1MNWzlqCyFKnrJej44U=; b=syTxEyASUOhQs6TRjf5nqzCtG8NYPunaiBrm36Usfhpb8jiQWR6fUhRK8e421qeaVt DJzLeYWNMu8zevC3u3AUV9LWv30687YFejA0/BpsUYu/PiFEdPKOkW12WhbJtaYalMC0 aVsa/dibABXpTZKCLbjC7++cqGWCW4nR4GZs5chCGtuF5cN2gk2Wl85VobW8S/JMzh6P VXuyQk/KCsZRVarQ+E0uBhekCbl0n+iqu7U86be/nti/BSmRypR+cDX0ztKfoX3Pfeqd xzmrD64kfy0FIELxboDhX+5R3/2P++P+fKdyhDv9oVQjh6bf3RW+rrFpKBopLYm4kSMw p0mw== X-Gm-Message-State: APjAAAV5CBd6+kbUIUtJh6AZcVqw6hqEcKPkBdXM1uHWIPO/fItnhpIq WNQ5j6cTaAqyu0+8W8tI882yoxKT++eVYmFqbb6cgsiAkop4Ew== X-Google-Smtp-Source: APXvYqyu2M58NWz6pkNKg8hTzJ8tTzGsjheC3+qH+PXxknoPmBbCyUU3d/VLaLJAPLyFmXM/BXp6pA5krAMlaxKH/n0= X-Received: by 2002:a67:8e85:: with SMTP id q127mr17515958vsd.50.1554134998433; Mon, 01 Apr 2019 09:09:58 -0700 (PDT) MIME-Version: 1.0 References: <6e99b975-73d8-9f57-450f-bfa1c2227a31@dcrocker.net> In-Reply-To: From: Wei Chuang Date: Mon, 1 Apr 2019 09:09:41 -0700 Message-ID: To: Dave Crocker Cc: bimi@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000009156c405857a402a" Archived-At: Subject: Re: [Bimi] Problematic cert activities X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Apr 2019 16:10:04 -0000 --0000000000009156c405857a402a Content-Type: multipart/alternative; boundary="000000000000842fe005857a40c8" --000000000000842fe005857a40c8 Content-Type: text/plain; charset="UTF-8" I realized that I removed the bimi list for this thread (as my kids were hopping around me as I was writing the reply). I'll forward your reply too. -Wei *From: *Wei Chuang *Date: *Sun, Mar 31, 2019 at 4:18 PM *To: *Dave Crocker Dave, > Thank you for the Youtube link! The preliminary attack disclosure by > Woodcock@PCH is a really nice find! as it shows another recent instance > of a functioning attack on DNS registry system and on using proof of > control of a domain to show ownership. I'll admit it involves a number > technologies/protocols I'm not really familiar with. If I understand this > correctly, the attack initially starts with the EPP protocol run by DNS > registries to obtain control of the domain, and from their get Let's > Encrypt and apparently Comodo certificates, so they can harvest IMAP > credentials. From the Youtube presentation, one claim is that proper > validation of DNSSEC could have prevented this attack (which I don't > actually follow, and if anyone could shed further light on this, I would > greatly appreciate it) > > With regards to VMC, in theory there's a face-to-face validation step to > could mitigate this though that is only done on the initial request. I'll > have to check if subsequent certificate requests are vulnerable or if other > measures protect against this type of attack. > > -wei > > PS Sorry for the delay in getting back to this as I was in transit. > > *From: *Dave Crocker > *Date: *Fri, Mar 29, 2019 at 9:03 AM > *To: *bimi@ietf.org > > This includes some details about bad actors getting 'valid' certificates >> to which they were not authorized: >> >> Briefing on Dec 18 - Jan 19 DNS/IMAP Prepositioning Attacks - Bill >> Woodcock >> >> >> >> https://www.youtube.com/watch?v=oNF6TE75mzg&t=4s&fbclid=IwAR0-oyzrIeMrN6ufedjeNy4QugKmKOak6AF0fd0Qn7IvlFMZcbITdZzXf84 >> >> >> >> d/ >> -- >> Dave Crocker >> Brandenburg InternetWorking >> bbiw.net >> >> -- >> bimi mailing list >> bimi@ietf.org >> https://www.ietf.org/mailman/listinfo/bimi >> > --000000000000842fe005857a40c8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I realized that I removed the bimi list f= or this thread (as my kids were hopping around me as I was writing=C2=A0the= reply).=C2=A0 =C2=A0I'll forward your reply too.

-Wei

From: Wei Chuang <weihaw@google.com>
D= ate: Sun, Mar 31, 2019 at 4:18 PM
To: Dave Cro= cker

Dave,
Thank you for the Youtube = link!=C2=A0 The preliminary attack disclosure by Woodcock@PCH is a really n= ice find! as it shows another recent instance of a functioning attack on DN= S registry system and on using proof of control of a domain to show ownersh= ip.=C2=A0 I'll admit it involves a number technologies/protocols I'= m not really familiar with.=C2=A0 If I understand this correctly, the attac= k initially starts with the EPP protocol run by DNS registries to obtain co= ntrol of the domain, and from their get Let's Encrypt and apparently Co= modo certificates, so they can harvest IMAP credentials.=C2=A0 From the You= tube presentation, one claim is that proper validation of DNSSEC could have= prevented this attack (which I don't actually follow, and if anyone co= uld shed further light on this, I would greatly appreciate it)=C2=A0=C2=A0<= /div>

With regards to VMC, in theory there's a face-= to-face validation step to could mitigate this though that is only done on = the initial request.=C2=A0 I'll have to check if subsequent certificate= requests are vulnerable or if other measures protect against this type of = attack.

-wei
<= br>
PS Sorry for the delay in getting back to this as I was in transit= .

From: Dave Crocker <dhc@dcrocker.net>
Date: Fri, Mar 29, 2019 at 9:03 AM
To: bimi@ietf.org

This includes some details about bad actors getting '= ;valid' certificates
to which they were not authorized:

=C2=A0 =C2=A0 =C2=A0 Briefing on Dec 18 - Jan 19 DNS/IMAP Prepositioning At= tacks - Bill
Woodcock


https://www.youtube.com/watch?v= =3DoNF6TE75mzg&t=3D4s&fbclid=3DIwAR0-oyzrIeMrN6ufedjeNy4QugKmKOak6A= F0fd0Qn7IvlFMZcbITdZzXf84



d/
--
Dave Crocker
Brandenburg InternetWorking
bbiw.net

--
bimi mailing list
bimi@= ietf.org
https://www.ietf.org/mailman/listinfo/bimi<= br>
--000000000000842fe005857a40c8-- --0000000000009156c405857a402a Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMWMqzbpn2SydMzpfaMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE4MTExNTE4NDMwM1oXDTE5MDUx NDE4NDMwM1owIjEgMB4GCSqGSIb3DQEJAQwRd2VpaGF3QGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQDOGIfi32h8dhJEeUGHfN1nAVrJsY4ph3nisYgnB2pOA4hcNkX4 xnnbD7PDr6G2S6LqYfXegzUkLT7FoOGtptBAixwpSxBUvEWQdrlbYdYuoNK7/DBASrlp4J7UocGX ZS5dkWL0IolToc52mCmOxhTqDjbD9MG3+AvyyQPK0RVgNY5n7BZBdNZDHTeswReAtjQ4t+b1IStQ 7Y59jxTOfDPpAT2Y0ON44Lx2hBLyQ8wXYCmHHbWCyGT3xZH0p8p+cGgkKvDjaxBX3ilopH8hx4zm 5HVh6wDOBHhAnRYVU1bqmjohWNuLhz/Za6lWGiylhPD+2yFLQfvHn6OBE0a/048NAgMBAAGjggFu MIIBajAcBgNVHREEFTATgRF3ZWloYXdAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFJUPLExeOaBiYyZVRuorZTtplIumMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQBuvV1bxPXhqWWCHYz7 40fvnmDIUsNiLecW3PCDQxdpPMc3V/6T31qSKYvuFigtj2MpXMCkLqbHupVN3b14UvnqNx3jnu7b Yp+rMcjjO70W3ufBqqz/QQzSykR9ATo+Zqs09dhJtTl02ApUqYipoInGx8wu0ChTI84NwR5UUo7H GSOet+Eluj5Yjq0YdM2qzfapP/XbfO7t533yiK5Cs//IlaQagdizrM/b1DTYjJ/28b3uPMS3l6a8 BoWm7kiV6GCY7zBNF9D6Gkf6U4dZgx6SwQjQoG3mSBV1zzIs0cZYoVvq/8y+5jC9CdH1ran/ahb6 1ZtMG4auBaKMRzEe3TimMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMWMqzbpn2 SydMzpfaMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCA5dgnRcsoVHnI7pyRoFOoS et+DN64LvfF50re16XoObjAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA0MDExNjA5NTlaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAbE+dTUtOzLO+Q778ND0mIgszxHSrBev2hHH071pW c2qJ1+BpqOJYyqHL+thCWufGm5lnDqbRWFnPKKQkAnjonoGXfuUgM8qbRHFDytFqXR8fKwai8c/y MOUspfKJG+mRpdSBjqu6COaVEhVXUXPrHx8YZn6k7ko8kayi+MShU9A9HF1CkLHd4zPs0k6nsWQU 3NI8W5VKAvFuw0EbGhLdD7B/Vl00C7jZ85mkNz8AOAVuq8RMgfikcnuXcyZt0a8t01lRcwxNWaWb HbuqmlETYPfbYlrd3V5o3lHSXnM1+LvwX6WMk/wY0MsdOMZbE4H/lCCzPlHHweNdz/Bqwte5xw== --0000000000009156c405857a402a-- From nobody Mon Apr 1 09:10:34 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 98B181202C6 for ; Mon, 1 Apr 2019 09:10:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yKyO9DNB_BNg for ; Mon, 1 Apr 2019 09:10:30 -0700 (PDT) Received: from mail-vs1-xe32.google.com (mail-vs1-xe32.google.com [IPv6:2607:f8b0:4864:20::e32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 414AF1202BB for ; Mon, 1 Apr 2019 09:10:30 -0700 (PDT) Received: by mail-vs1-xe32.google.com with SMTP id d8so4826658vsp.2 for ; Mon, 01 Apr 2019 09:10:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=EMnDDJ8zWFm76WPNbpRpFuZAXjkjWOp9pnztJW3Nii4=; b=f8Yn+pU56yMDJ4t1s1QBn//uIXKok670UHpCXECPDajneWN/UPYbgTpqPhOEJF3ojQ ILuzuy7CvPyg/a0gSaYHVhkdOBRWxQE+L86IAMQxlRtdVeKP2UCDZIouQmMwDuP2ETpG d5w9Yi5m3/N2Je0pUbRUbdUhsqrCjXBVz3A6qDWbRSMfPl+5+oakJx2R7xW+ceLySwUR TOILzhXyXh7Bl0xxJxE8Ngnc4M0TnbsyLCsmwyGJxdm3qj5v/ncsU7rVAd3o8S9nrwfQ s5b4hYIBNVm6B0gFTwCIieAZZtWi2/wPi6CqPerU+vmMzqp4UJePXU2GdGXt8Aq2ChYw DsYw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=EMnDDJ8zWFm76WPNbpRpFuZAXjkjWOp9pnztJW3Nii4=; b=j1OyrVHYSehiOoKkHm/JMUi1FMayBbi/yqe+1SlN/CCoq1Gj2pEGgSB13EVEp6u+B7 E7RIk+thLn7R+fmJX9g8TQ5MSyo216kM69pATXnP+GdnVmzG8k8xF7HloX9o96zQTgUD yWT06rcKJyvqlTIZlQ6KaAY5Xspc3XCYs/ZgKExMCCCzK4LAicGDwK0B8QI5/uF+4d52 k7MYrU7kAaMY3AXgWJ0uWIhZRLf/EYudX7DUd0+/QKJCgAjTrBJEgTZ241mCtvjoFICc Xn3xrxdy2dJGo9QmtnZzY96Jn5tDfw3GJ9wgpse9R77OAb9gCenYEDCfK/dDDZVHwEeu EbwA== X-Gm-Message-State: APjAAAV+YzWq2QHRisqnbz6l/3Yk0eew6QIVhwl6JSSyNhQhmkjb0zoI 5bwq7tZSuNdg1Nb2Gc5gAXrt1LQqjCv944fZD68swNDBbv0= X-Google-Smtp-Source: APXvYqzk8oVoNkAucS7j5QSs39Zv0MQrJbHRg+QD40sZ03BtZ5gmxUIhdnf5rFajNFV6bO+L/a72+FrCGGJj0M9GFxE= X-Received: by 2002:a67:e30a:: with SMTP id j10mr15622114vsf.103.1554135026895; Mon, 01 Apr 2019 09:10:26 -0700 (PDT) MIME-Version: 1.0 References: <6e99b975-73d8-9f57-450f-bfa1c2227a31@dcrocker.net> <5cd60888-b690-2cde-2156-5ed145394a01@bbiw.net> In-Reply-To: <5cd60888-b690-2cde-2156-5ed145394a01@bbiw.net> From: Wei Chuang Date: Mon, 1 Apr 2019 09:10:13 -0700 Message-ID: To: bimi@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="00000000000040242105857a42dd" Archived-At: Subject: [Bimi] Fwd: Problematic cert activities X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Apr 2019 16:10:34 -0000 --00000000000040242105857a42dd Content-Type: multipart/alternative; boundary="000000000000367f0205857a428e" --000000000000367f0205857a428e Content-Type: text/plain; charset="UTF-8" ---------- Forwarded message --------- *From: *Dave Crocker *Date: *Sun, Mar 31, 2019 at 4:33 PM *Subject: *Re: [Bimi] Problematic cert activities *To: *Wei Chuang On 3/31/2019 4:18 PM, Wei Chuang wrote: > With regards to VMC, in theory there's a face-to-face validation step to > could mitigate this though that is only done on the initial request. > I'll have to check if subsequent certificate requests are vulnerable or > if other measures protect against this type of attack. In an unrelated, and relatively random conversation today, I had a bit of insight that is no doubt obvious to serious security folk but hadn't occurred to me: We have the concept of 2FA, with two independent channels that provide validation of the requestor. But we ought to add the idea of two-factor confirmation. So rather than just sending an email to confirm that the owner of the cited email address agrees with whatever the transaction is, do a second, separation confirmation -- eg, via the phone number. The set of attack behaviors described by Bill are such that I doubt this would have made a difference -- there were more basic holes being exploited -- but I suspect there is value to be had with it. The broader point is that we seem not to take a holistic approach to protection of infrastructure services... > PS Sorry for the delay in getting back to this as I was in transit. Delay? There was a delay? ... d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net --000000000000367f0205857a428e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


---------- Forwarded message ---------
From: Dave Crocker <dcrocker@bbiw.net>
Date: Sun, Mar 31, = 2019 at 4:33 PM
Subject: Re: [Bimi] Problematic cert ac= tivities
To: Wei Chuang <weihaw@google.com>


On 3/31/2019 4:18 PM, = Wei Chuang wrote:
> With regards to VMC, in theory there's a face-to-face validation s= tep to
> could mitigate this though that is only done on the initial request. <= br> > I'll have to check if subsequent certificate requests are vulnerab= le or
> if other measures protect against this type of attack.


In an unrelated, and relatively random conversation today, I had a bit
of insight that is no doubt obvious to serious security folk but hadn't=
occurred to me:=C2=A0 We have the concept of 2FA, with two independent
channels that provide validation of the requestor. But we ought to add
the idea of two-factor confirmation.=C2=A0 So rather than just sending an <= br> email to confirm that the owner of the cited email address agrees with
whatever the transaction is, do a second, separation confirmation -- eg, via the phone number.

The set of attack behaviors described by Bill are such that I doubt this would have made a difference -- there were more basic holes being
exploited -- but I suspect there is value to be had with it.

The broader point is that we seem not to take a holistic approach to
protection of infrastructure services...


> PS Sorry for the delay in getting back to this as I was in transit.
Delay?=C2=A0 There was a delay? ...


d/

--
Dave Crocker
Brandenburg InternetWorking
bbiw.net
--000000000000367f0205857a428e-- --00000000000040242105857a42dd Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMWMqzbpn2SydMzpfaMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE4MTExNTE4NDMwM1oXDTE5MDUx NDE4NDMwM1owIjEgMB4GCSqGSIb3DQEJAQwRd2VpaGF3QGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQDOGIfi32h8dhJEeUGHfN1nAVrJsY4ph3nisYgnB2pOA4hcNkX4 xnnbD7PDr6G2S6LqYfXegzUkLT7FoOGtptBAixwpSxBUvEWQdrlbYdYuoNK7/DBASrlp4J7UocGX ZS5dkWL0IolToc52mCmOxhTqDjbD9MG3+AvyyQPK0RVgNY5n7BZBdNZDHTeswReAtjQ4t+b1IStQ 7Y59jxTOfDPpAT2Y0ON44Lx2hBLyQ8wXYCmHHbWCyGT3xZH0p8p+cGgkKvDjaxBX3ilopH8hx4zm 5HVh6wDOBHhAnRYVU1bqmjohWNuLhz/Za6lWGiylhPD+2yFLQfvHn6OBE0a/048NAgMBAAGjggFu MIIBajAcBgNVHREEFTATgRF3ZWloYXdAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFJUPLExeOaBiYyZVRuorZTtplIumMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQBuvV1bxPXhqWWCHYz7 40fvnmDIUsNiLecW3PCDQxdpPMc3V/6T31qSKYvuFigtj2MpXMCkLqbHupVN3b14UvnqNx3jnu7b Yp+rMcjjO70W3ufBqqz/QQzSykR9ATo+Zqs09dhJtTl02ApUqYipoInGx8wu0ChTI84NwR5UUo7H GSOet+Eluj5Yjq0YdM2qzfapP/XbfO7t533yiK5Cs//IlaQagdizrM/b1DTYjJ/28b3uPMS3l6a8 BoWm7kiV6GCY7zBNF9D6Gkf6U4dZgx6SwQjQoG3mSBV1zzIs0cZYoVvq/8y+5jC9CdH1ran/ahb6 1ZtMG4auBaKMRzEe3TimMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMWMqzbpn2 SydMzpfaMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCDYOwjZt4YnfTpFQoxJFpPx fyqXkdAWy8Rzp0i5i9hlNDAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA0MDExNjEwMjdaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAk10+KVTc0bUqfos2QHM4z85m7oAjcrYOrYrFNaed RfasekVs5CHPs7VvGHwFiop6BDtDR71wIDXYm8I+eH5mP7h1HzOrk8TOlllex2HS/ZDIKReAFCAT nuAGvuDhWJ5VXHb/51gmm1BoUUnGRPWzLZXZSYf7/Iq04Br9EKFaIhoQp4aRgWiAdbc38WfTjWh6 T6q638KN1SR3QKkQyu3i05d5KUdndD0R+RMtrFqQkwGyAHzw4dcJD4RXNJsZ1s55tBxHysT66riu 0BO5SB7yk7zACEENy0rrJZGY4++TN6RiNxQZlRBcne3jlJX1prHWF+GViK5/0rvOVwoE+H+aDA== --00000000000040242105857a42dd-- From nobody Mon Apr 1 09:24:05 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0705F120375 for ; Mon, 1 Apr 2019 09:24:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.49 X-Spam-Level: X-Spam-Status: No, score=-17.49 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y1rd1koRbome for ; Mon, 1 Apr 2019 09:24:00 -0700 (PDT) Received: from mail-it1-x133.google.com (mail-it1-x133.google.com [IPv6:2607:f8b0:4864:20::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98D4E120379 for ; Mon, 1 Apr 2019 09:23:56 -0700 (PDT) Received: by mail-it1-x133.google.com with SMTP id z126so15673788itd.5 for ; Mon, 01 Apr 2019 09:23:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4T9Oe7OEXXyCah3nX+fZKvQfQShYd7E3Dr+vg4ZFo+M=; b=MQL1x7tVWGdEwtzvduBtjthxRENwnVjmqVwTVPTdLiw4oQRccrv1DRuiwAeaXpqbSb iu9ZNeOl02eo2Ibwo/qOaOvWJytbp2Ma4PDeB8pEOLH9+ZOB62UWD0THrWHJj0cmwUjc Qae4O4HRwN4wL4rEPYU4CgsWNLSmQHUy/7qbhecSgw7cZdI8dpRcY1mV7u77ZMvpNr/8 Pei88my1zllDzEpqZ93kGsOLNwVqynC/yGNS9LcekMCBNnrC/ynjnfrwza89gzzhKe0v cwFRO9FBumHPg4Z9UtCP5a1YN9J7oBZbiZo+OBxSkepRbBcR4jLDEXJXfb1x/S1gStBu LK6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4T9Oe7OEXXyCah3nX+fZKvQfQShYd7E3Dr+vg4ZFo+M=; b=H5tOsV7BlBrGKKmV18pXc5aLhcmxI//zEcBrAmyvecBcIc6D6LC/rXZwcQKuaTsktn R/BmDGrZqKhuGdv365VdGjQYtYftkesEtX6ftaSpTQttXFhLMDLXSEzX8/i3knK/Qo4c weCKvBBwmgx+gJEKUozgMLKnZpv9va/DOtQcsCoJV5As7wcYsy1Y6ojlxGs+CA5Jf93c yvdT86pHo6EnfZaWOyMRZNt7nuV5xnjohW2kpAwo/ueUJyjj4GQ7GY7IEbhC79oWmAdP iYtHkbqJhY5NariH3+5ZXnVcWDJaD8WOSzwu6DUkysQ7HB7a6q2VmEzznsCa7dsCSru2 8qBQ== X-Gm-Message-State: APjAAAXHEgTJ/AiMLhoGPQUDSR8QIf9d1I6XJ+ZIILroplj35VBCw8YQ /GfBFYI1OU1VPf404iOEUMAq9LwwQrt5pEBE5D8eMGv43IY= X-Google-Smtp-Source: APXvYqxmPe88Njukw+Ht5YcnJv9UHawWiWtMwAbRJCDYwU+i7jIMiNBrH2uzsIh6H1eJ1pdmNt04vhpR7wPiByB3NG8= X-Received: by 2002:a24:1d0:: with SMTP id 199mr370040itk.41.1554135835344; Mon, 01 Apr 2019 09:23:55 -0700 (PDT) MIME-Version: 1.0 References: <6e99b975-73d8-9f57-450f-bfa1c2227a31@dcrocker.net> <5cd60888-b690-2cde-2156-5ed145394a01@bbiw.net> In-Reply-To: <5cd60888-b690-2cde-2156-5ed145394a01@bbiw.net> From: Wei Chuang Date: Mon, 1 Apr 2019 09:23:40 -0700 Message-ID: To: Dave Crocker Cc: bimi@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="00000000000070040f05857a7296" Archived-At: Subject: Re: [Bimi] Problematic cert activities X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Apr 2019 16:24:03 -0000 --00000000000070040f05857a7296 Content-Type: multipart/alternative; boundary="000000000000668ec405857a7266" --000000000000668ec405857a7266 Content-Type: text/plain; charset="UTF-8" *From: *Dave Crocker *Date: *Sun, Mar 31, 2019 at 4:33 PM *To: *Wei Chuang On 3/31/2019 4:18 PM, Wei Chuang wrote: > > With regards to VMC, in theory there's a face-to-face validation step to > > could mitigate this though that is only done on the initial request. > > I'll have to check if subsequent certificate requests are vulnerable or > > if other measures protect against this type of attack. > > > In an unrelated, and relatively random conversation today, I had a bit > of insight that is no doubt obvious to serious security folk but hadn't > occurred to me: We have the concept of 2FA, with two independent > channels that provide validation of the requestor. But we ought to add > the idea of two-factor confirmation. So rather than just sending an > email to confirm that the owner of the cited email address agrees with > whatever the transaction is, do a second, separation confirmation -- eg, > via the phone number. > FWIW Bill mentions registrar lock which provides a call back process 2FA mechanism though unfortunately at extra cost. Some CA issued certificates have a similar call back/secondary verification mechanism. The current CABF Web EV guidelines 11.10 calls for the CA to verify that the certifcate request was authorized. That verification may use phone, fax, or postal but also may involve email which in this scenario is problematic. As currently specced, VMC is an extension of web EV, and is supposed to use this secondary verification process. -Wei > > The set of attack behaviors described by Bill are such that I doubt this > would have made a difference -- there were more basic holes being > exploited -- but I suspect there is value to be had with it. > > The broader point is that we seem not to take a holistic approach to > protection of infrastructure services... > > > > PS Sorry for the delay in getting back to this as I was in transit. > > Delay? There was a delay? ... > > > d/ > > -- > Dave Crocker > Brandenburg InternetWorking > bbiw.net > --000000000000668ec405857a7266 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
From: Dave Crocker <= span dir=3D"ltr"><dcrocker@bbiw.net= >
Date: Sun, Mar 31, 2019 at 4:33 PM
<= strong>To: Wei Chuang

On 3/31/2019 4:18 PM, Wei Chuang wrote:
> With regards to VMC, in theory there's a face-to-face validation s= tep to
> could mitigate this though that is only done on the initial request. <= br> > I'll have to check if subsequent certificate requests are vulnerab= le or
> if other measures protect against this type of attack.


In an unrelated, and relatively random conversation today, I had a bit
of insight that is no doubt obvious to serious security folk but hadn't=
occurred to me:=C2=A0 We have the concept of 2FA, with two independent
channels that provide validation of the requestor. But we ought to add
the idea of two-factor confirmation.=C2=A0 So rather than just sending an <= br> email to confirm that the owner of the cited email address agrees with
whatever the transaction is, do a second, separation confirmation -- eg, via the phone number.

FWIW Bill mention= s registrar lock which provides a call back process 2FA mechanism though un= fortunately at extra cost.=C2=A0=C2=A0

Some CA iss= ued certificates have a similar call back/secondary verification mechanism.= =C2=A0 The current CABF Web EV guidelines 11.10 calls for the CA to verify = that the certifcate request was authorized.=C2=A0 That verification may use= phone, fax, or postal but also may involve email which in this scenario is= problematic.=C2=A0 As currently specced, VMC is an extension of web EV, an= d is supposed to use this secondary verification process.

-Wei
=C2=A0

The set of attack behaviors described by Bill are such that I doubt this would have made a difference -- there were more basic holes being
exploited -- but I suspect there is value to be had with it.

The broader point is that we seem not to take a holistic approach to
protection of infrastructure services...


> PS Sorry for the delay in getting back to this as I was in transit.
Delay?=C2=A0 There was a delay? ...


d/

--
Dave Crocker
Brandenburg InternetWorking
bbiw.net
--000000000000668ec405857a7266-- --00000000000070040f05857a7296 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMWMqzbpn2SydMzpfaMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE4MTExNTE4NDMwM1oXDTE5MDUx NDE4NDMwM1owIjEgMB4GCSqGSIb3DQEJAQwRd2VpaGF3QGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQDOGIfi32h8dhJEeUGHfN1nAVrJsY4ph3nisYgnB2pOA4hcNkX4 xnnbD7PDr6G2S6LqYfXegzUkLT7FoOGtptBAixwpSxBUvEWQdrlbYdYuoNK7/DBASrlp4J7UocGX ZS5dkWL0IolToc52mCmOxhTqDjbD9MG3+AvyyQPK0RVgNY5n7BZBdNZDHTeswReAtjQ4t+b1IStQ 7Y59jxTOfDPpAT2Y0ON44Lx2hBLyQ8wXYCmHHbWCyGT3xZH0p8p+cGgkKvDjaxBX3ilopH8hx4zm 5HVh6wDOBHhAnRYVU1bqmjohWNuLhz/Za6lWGiylhPD+2yFLQfvHn6OBE0a/048NAgMBAAGjggFu MIIBajAcBgNVHREEFTATgRF3ZWloYXdAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFJUPLExeOaBiYyZVRuorZTtplIumMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQBuvV1bxPXhqWWCHYz7 40fvnmDIUsNiLecW3PCDQxdpPMc3V/6T31qSKYvuFigtj2MpXMCkLqbHupVN3b14UvnqNx3jnu7b Yp+rMcjjO70W3ufBqqz/QQzSykR9ATo+Zqs09dhJtTl02ApUqYipoInGx8wu0ChTI84NwR5UUo7H GSOet+Eluj5Yjq0YdM2qzfapP/XbfO7t533yiK5Cs//IlaQagdizrM/b1DTYjJ/28b3uPMS3l6a8 BoWm7kiV6GCY7zBNF9D6Gkf6U4dZgx6SwQjQoG3mSBV1zzIs0cZYoVvq/8y+5jC9CdH1ran/ahb6 1ZtMG4auBaKMRzEe3TimMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMWMqzbpn2 SydMzpfaMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCBhodSdHsRu6cM1oq+to+Dl /5LOPu19I3Mu2bLnDEEKITAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA0MDExNjIzNTZaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEACELBpxlZfuM54JSCb6LStGAECjHG4Mk914NOQza6 9NGGTBAnk4BEObJoM5PbDXMGbK+pyvdKbDvVzmineVkjsdQQh0EHDEc8Co0oauWInL/CeDofWBXA 8XzckoVeLPTXlsnvFrthB8MsyxzUOrQL+/tAokNG04vZOQMyQLuQ+znv7GWYnRn1fcnxptADttT5 IV6Jbo5l2jDfvFNHlcv839DyNPslrR6BQUK1TFCccRMB8VPikWjKPd/uy/EFOUEFR+S6q9YeQcE5 Bb7475fptBG2eJumwtcMLpqnFsgewV108MB7jS/nFf5TqTGep0TAhfhrUysJXgV8ZTPx1hlAZg== --00000000000070040f05857a7296-- From nobody Mon Apr 1 09:44:26 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4367112042F for ; Mon, 1 Apr 2019 09:44:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vqg7p-mCjzfM for ; Mon, 1 Apr 2019 09:44:21 -0700 (PDT) Received: from mail-vs1-xe2a.google.com (mail-vs1-xe2a.google.com [IPv6:2607:f8b0:4864:20::e2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CFF33120421 for ; Mon, 1 Apr 2019 09:44:20 -0700 (PDT) Received: by mail-vs1-xe2a.google.com with SMTP id t78so5942916vsc.1 for ; Mon, 01 Apr 2019 09:44:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=tlG2VWzjfb3Q5pzbVAu7c5xXIXsCx6cIOxLxFwOAMdM=; b=e8OzbNYH/OuekBaINN3ur2vks1GypTDMT9u9F0Nl1Zv2475uAOg2Df8VTn9Ef4iuPR O6mL9T2FwlyyzzYpIN3Sik5m9ArhD2J7YoTsse42qlqp+RidyDVbcrvpWUmxCdidmTSc LliWQRxYS1tMKcJoWIKK1lFINGj375vfOb4adbpbzzCQebCwg6jXHrAJ+p9873oP/FKG n5D39gdjFaFHyfjcB5XlQr1CXonhL925Znqv/AUKyYbTzbfNua2+UKJ2x1cs8NYwyL7/ UDUElGB54OmQhjSKdbKNTa5UGEuG8CwvsDSMnomCLkbrVLmk9gy1oExKTaoqH4daGtNY fVTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=tlG2VWzjfb3Q5pzbVAu7c5xXIXsCx6cIOxLxFwOAMdM=; b=Q3c7IBmTqV0rWBqBCWwPhjKMdgfnRdmDsQsnX2iO56OwlUZZ8o0vGg9ujbZw7M1w9/ LhwSFovm1W18YFnigroqdxbx0j40sGf9TPnapmkx4ZKmvObE3ZGX/6oTE5iGRTBazEVB xt85D3o3/Ju1ZA7mqfyGGAfGyHxu/L3du091TLkI18a0mHvwMlvRIQ5Ub6u4KOKgI8TP Q40bKD6Ab+B6zVjhvrELbSA5AnUCgUtPWFvoudAUXRq1T8C82xX6jqCPAa3IEUhNiB3J qn4L3DoefEawB8tfMYz0doDj2cpeXo0VxxZsHQOtp7ZrynzOSe6MC5rJZCi3x8VXOkhZ bB5A== X-Gm-Message-State: APjAAAWv0kdN/UjSWoYzMaCIMAufkeFnXdSySKrJhs0pWehJQUIaP07j zPilZUlpVA/7Z5Xi8vREe3w7sOuVKEEA7L/pshLXmg== X-Google-Smtp-Source: APXvYqzyrfVEzbQF2lWecn8jL12bSfWTtIjyTlWyK9fiT+NyCYuB/vj/5aPY6iBve/Vb2r3axmr/XwXTQVbMs84a3Wo= X-Received: by 2002:a67:8010:: with SMTP id b16mr22291009vsd.189.1554137059055; Mon, 01 Apr 2019 09:44:19 -0700 (PDT) MIME-Version: 1.0 References: <309EBD4AD64BE436663E721D@PSB> In-Reply-To: From: Wei Chuang Date: Mon, 1 Apr 2019 09:44:03 -0700 Message-ID: To: Dave Crocker Cc: John C Klensin , bimi@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000646a6c05857abb72" Archived-At: Subject: Re: [Bimi] Today's BoF X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Apr 2019 16:44:25 -0000 --000000000000646a6c05857abb72 Content-Type: multipart/alternative; boundary="00000000000056df0105857abb81" --00000000000056df0105857abb81 Content-Type: text/plain; charset="UTF-8" *From: *Dave Crocker *Date: *Sun, Mar 31, 2019 at 5:00 PM *To: *Wei Chuang, John C Klensin *Cc: * On 3/31/2019 4:48 PM, Wei Chuang wrote: > > The BIMI proposal depends on different, domain based authentication > > technologies that have been already deployed at scale. > > The message-based domain-validation components are not the issue. > > The use of certificate authorities is. At scale they are problematic, > in spite of the tendency to claim that their use for TLS says they aren't. > We're very much open to looking at alternatives that lets a 3rd party verifier attest to their verification. However I would point out that the X.509 CA system is mature where processes are well specced and known flaws have a number of remediations. Alternatives may end up repeating much of the same issues. > And their use for linkage between domain name and logo is, since there's > no history at scale. > > And any effort to use 'validated' logos at scale has no history, where > the challenges in doing that have been well- and often-cited. > Agreed these are significant risks. What's done to mitigate this is to map this on to the existing registered trademark system, and leverage those precedents. -Wei > d/ > > -- > Dave Crocker > Brandenburg InternetWorking > bbiw.net > --00000000000056df0105857abb81 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
From: Dave Crocker <= span dir=3D"ltr"><dhc@dcrocker.net>
Date: Sun, Mar 31, 2019 at 5:00 PM
To: Wei Chuang, John C Klensin
Cc: <<= a href=3D"mailto:bimi@ietf.org">bimi@ietf.org>

On 3/31/2019 4:48 PM, Wei Chuang = wrote:
> The BIMI proposal depends on different, domain based authentication > technologies that have been already deployed at scale.

The message-based domain-validation components are not the issue.

The use of certificate authorities is.=C2=A0 At scale they are problematic,=
in spite of the tendency to claim that their use for TLS says they aren'= ;t.

We're very much open to looking= at alternatives that lets a 3rd party verifier attest to their verificatio= n.=C2=A0 However I would point out that the X.509 CA system is mature where= processes are well specced and known flaws have a number of remediations.= =C2=A0 Alternatives may end up repeating much of the same issues.=C2=A0=C2= =A0
=C2=A0
And their use for linkage between domain name and logo is, since there'= s
no history at scale.

And any effort to use 'validated' logos at scale has no history, wh= ere
the challenges in doing that have been well- and often-cited.

Agreed these are significant risks.=C2=A0 What's= done to mitigate this is to map this on to the existing registered tradema= rk system, and leverage those precedents.=C2=A0=C2=A0
=C2=A0
-Wei


d/

--
Dave Crocker
Brandenburg InternetWorking
bbiw.net
--00000000000056df0105857abb81-- --000000000000646a6c05857abb72 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMWMqzbpn2SydMzpfaMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE4MTExNTE4NDMwM1oXDTE5MDUx NDE4NDMwM1owIjEgMB4GCSqGSIb3DQEJAQwRd2VpaGF3QGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQDOGIfi32h8dhJEeUGHfN1nAVrJsY4ph3nisYgnB2pOA4hcNkX4 xnnbD7PDr6G2S6LqYfXegzUkLT7FoOGtptBAixwpSxBUvEWQdrlbYdYuoNK7/DBASrlp4J7UocGX ZS5dkWL0IolToc52mCmOxhTqDjbD9MG3+AvyyQPK0RVgNY5n7BZBdNZDHTeswReAtjQ4t+b1IStQ 7Y59jxTOfDPpAT2Y0ON44Lx2hBLyQ8wXYCmHHbWCyGT3xZH0p8p+cGgkKvDjaxBX3ilopH8hx4zm 5HVh6wDOBHhAnRYVU1bqmjohWNuLhz/Za6lWGiylhPD+2yFLQfvHn6OBE0a/048NAgMBAAGjggFu MIIBajAcBgNVHREEFTATgRF3ZWloYXdAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFJUPLExeOaBiYyZVRuorZTtplIumMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQBuvV1bxPXhqWWCHYz7 40fvnmDIUsNiLecW3PCDQxdpPMc3V/6T31qSKYvuFigtj2MpXMCkLqbHupVN3b14UvnqNx3jnu7b Yp+rMcjjO70W3ufBqqz/QQzSykR9ATo+Zqs09dhJtTl02ApUqYipoInGx8wu0ChTI84NwR5UUo7H GSOet+Eluj5Yjq0YdM2qzfapP/XbfO7t533yiK5Cs//IlaQagdizrM/b1DTYjJ/28b3uPMS3l6a8 BoWm7kiV6GCY7zBNF9D6Gkf6U4dZgx6SwQjQoG3mSBV1zzIs0cZYoVvq/8y+5jC9CdH1ran/ahb6 1ZtMG4auBaKMRzEe3TimMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMWMqzbpn2 SydMzpfaMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCDYWzQDVNp4Seb45bvNCa/m Q5lW7pOddb3CWDyCCsS0bjAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA0MDExNjQ0MTlaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAT3dmwnmzAHeIhcIj2kT/HHcn4lJqbF/hWK0mt1+R OTIDyMPY2pMZ24400WpSX8ywLsaHQCYIARCK4SuXmUJeMMll/EiuT8V6oFUMlJxcDxT5pJZYF9IR A+2auQaHQB08sCnPKM14Z1WwiEnHhIHEOoboh2ZSe6XgOM/kicx5OFGcuIBm4+rOuCRxbVQUaMLv JuMgp8qFhkSiE2ZK9j7I+58QMGoMyMTNN5TPyf2PL97Pn5vqEM2RBgwriUEJeaXYZjgRLNK1wSNe LYgWycG0RPPc/aA52BKEn9M4rN+JuS0KIYywlulDY7Z1pZkcLOT8KWKPLB06tO6rwQ/tISRIWg== --000000000000646a6c05857abb72-- From nobody Tue Apr 2 08:09:52 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 42B8B12012B for ; Tue, 2 Apr 2019 08:09:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jTWJAJiX9p4i for ; Tue, 2 Apr 2019 08:09:49 -0700 (PDT) Received: from simon.songbird.com (simon.songbird.com [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5AEF712016C for ; Tue, 2 Apr 2019 08:09:49 -0700 (PDT) Received: from [192.168.1.85] (108-226-162-63.lightspeed.sntcca.sbcglobal.net [108.226.162.63]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1.1) with ESMTP id x32FBSOu027171 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Tue, 2 Apr 2019 08:11:28 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1554217889; bh=LW2Y1Sb8fAdSWQAi6kkS1k33uD992ef19FeD4g5tYfY=; h=Subject:To:Cc:References:From:Reply-To:Date:In-Reply-To:From; b=WTVmqIHIp/usqOJPeaiSLGJnhmE07P7BzzJoTlakMDrAoBgrT7tSwXL6pxx1hdx2H KSLuDPzOsSm+wkNNw2FoPv0ZXNZV6ijOBdlWVBcL56Wnb45/Se0t83Jqha2FQu6Sf6 0BA7Gv15rWotzZsYvz4b4+DUeOMvil1lYpgMNHz4= To: Wei Chuang Cc: bimi@ietf.org References: <309EBD4AD64BE436663E721D@PSB> From: Dave Crocker Reply-To: dcrocker@bbiw.net Organization: Brandenburg InternetWorking Message-ID: <094f20b3-1c4f-b5e7-76f8-d683a4b3d991@dcrocker.net> Date: Tue, 2 Apr 2019 08:09:38 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Bimi] Today's BoF X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Apr 2019 15:09:51 -0000 On 4/1/2019 9:44 AM, Wei Chuang wrote: > And any effort to use 'validated' logos at scale has no history, where > the challenges in doing that have been well- and often-cited. > > > Agreed these are significant risks.  What's done to mitigate this is to > map this on to the existing registered trademark system, and leverage > those precedents. Wei, I'll cite the anecdote I keep telling, about an interaction on a pre-ICANN committee, where the WIPO representative -- an attorney, of course(*) -- said that there were discussions underway for resolving international issues regarding trademark. This would have made Internet domain name disputes much, much simpler. Then he acknowledged that the discussions had been underway for 100 years, with no immediate resolution in sight. That was 20 years ago and I haven't heard that they have yet produced a solution. So forgive me, but I believe that "the existing registered trademark system" does not handle the kind of problem created by Bimi. Not even close. To the extent that you believe it will -- and will do it at scale -- there needs to be very careful documentation of how that will work at a systems level. More broadly, and while it's a non-trivial amount of work, I'm finding myself forced to suggest that Bimi advocates produce a life-cycle scenario document, that shows all aspects of administration and use of Bimi, including problem handling, from first actions to last. This will permit people to evaluate Bimi holistically. d/ (*) It's probably worth offering some contrast about his participation: He was also the person on the committee that proposed the model for dispute resolution (UDRP) that ICANN adopted and still uses. -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Tue Apr 2 09:03:21 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B13F120181 for ; Tue, 2 Apr 2019 09:03:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rUOdCBVRXMP8 for ; Tue, 2 Apr 2019 09:03:15 -0700 (PDT) Received: from mail.highwayman.com (happyday.demon.co.uk [80.177.121.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D8AA12081F for ; Tue, 2 Apr 2019 09:01:17 -0700 (PDT) Received: from localhost ([127.0.0.1]:15019 helo=happyday.al.cl.cam.ac.uk) by mail.highwayman.com with esmtp (Exim 4.91) (envelope-from ) id 1hBLqa-0008ow-5Q for bimi@ietf.org; Tue, 02 Apr 2019 16:01:12 +0000 Message-ID: <7v+NdwF3b4ocFAeC@highwayman.com> Date: Tue, 2 Apr 2019 16:59:51 +0100 To: bimi@ietf.org From: Richard Clayton References: <309EBD4AD64BE436663E721D@PSB> <094f20b3-1c4f-b5e7-76f8-d683a4b3d991@dcrocker.net> In-Reply-To: <094f20b3-1c4f-b5e7-76f8-d683a4b3d991@dcrocker.net> MIME-Version: 1.0 X-Mailer: Turnpike Integrated Version 5.03 M Archived-At: Subject: [Bimi] Laches (was: Today's BoF) X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Apr 2019 16:03:19 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In message <094f20b3-1c4f-b5e7-76f8-d683a4b3d991@dcrocker.net>, Dave Crocker writes >So forgive me, but I believe that "the existing registered trademark >system" does not handle the kind of problem created by Bimi. Not even >close. To the extent that you believe it will -- and will do it at >scale -- there needs to be very careful documentation of how that will >work at a systems level. > >More broadly, and while it's a non-trivial amount of work, I'm finding >myself forced to suggest that Bimi advocates produce a life-cycle >scenario document, that shows all aspects of administration and use of >Bimi, including problem handling, from first actions to last. I am very interested to learn what legal guarantees a "BIMI certificate" might come with and hence what "comfort" it might provide to someone whose email app was making use of BIMI to determine what marks should be displayed within their app. In the UK (your jurisdiction will vary, but not so much) inappropriate display of trademarks is a civil infringement called "passing off". There is extra protection for some special marks such as the Red Cross emblems (fines up to 5K GBP in the UK, up to 6 months jail in the US) and for marks associated with the Olympics (fine up to the UK statutory maximum in this case). So if someone sends an email with a subject header field indicating it is about "X" to someone in country Y and the sender's trademark (perfectly good in their home country Z for a particular category of goods) is displayed but it happens that the text of "X" would suggest that it is marketing material relevant to goods that a trademark holder in country Y has registered a trademark for -- then there seems to be excellent grounds for an action in "passing off".... ... to what extent will the existence of a BIMI certificate enable the author of the email software to claim that they were only "following orders" and that they should not be held liable in any way ? Will there be an insurance policy in place at the certificate issuer ? Also (remember those fines and possible jail time) will BIMI be dealing specially with Red Cross and Olympic marks (and probably all sorts of other marks which have special legal protection in some jurisdictions?) Also, what expectation do the authors of the BIMI specification have that email software writers will not be in regular receipt of injunctions preventing the display of particular marks in particular countries in relation to particular products ... ... lest people think that this is foolishness and hyperbolic speculation, it is absolutely key to realise that trademarks differ from other types of intellectual property in that if you fail to diligently protect your trademark then the protection it provides can disappear. Use your favourite search engine to look up "laches" to find out more than would ever wish to know about this active protection issue. Bottom line is that trademarks are associated with a small class of goods in a small number of countries and an attempt to link these symbols with emails sent by all of the owners of these trademarks to people in completely different countries is going to end in tears. The doctrine of "laches" means that this is pretty much bound to happen sooner rather than later. IANAL, but I read a lot :-) - -- richard Richard Clayton Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755 -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.7.1 iQA/AwUBXKOG9zu8z1Kouez7EQLGoQCgu4hDmg+oWGU3GOPYEWGOuyPvxyQAoIdr o9yCrNZIBGtilafLnB32Puji =Gc1G -----END PGP SIGNATURE----- From nobody Tue Apr 2 11:26:43 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FA08120178 for ; Tue, 2 Apr 2019 11:26:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NOxM2T9az3J8 for ; Tue, 2 Apr 2019 11:26:39 -0700 (PDT) Received: from bsa2.jck.com (ns.jck.com [70.88.254.51]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7DEE120167 for ; Tue, 2 Apr 2019 11:26:39 -0700 (PDT) Received: from [198.252.137.10] (helo=PSB) by bsa2.jck.com with esmtp (Exim 4.82 (FreeBSD)) (envelope-from ) id 1hBO7J-0005FJ-UC; Tue, 02 Apr 2019 14:26:37 -0400 Date: Tue, 02 Apr 2019 14:26:25 -0400 From: John C Klensin To: Wei Chuang cc: bimi@ietf.org Message-ID: In-Reply-To: References: <309EBD4AD64BE436663E721D@PSB> X-Mailer: Mulberry/4.0.8 (Win32) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Content-Disposition: inline X-SA-Exim-Connect-IP: 198.252.137.10 X-SA-Exim-Mail-From: john-ietf@jck.com X-SA-Exim-Scanned: No (on bsa2.jck.com); SAEximRunCond expanded to false Archived-At: Subject: Re: [Bimi] Today's BoF X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Apr 2019 18:26:42 -0000 Wei, Two observations on separate notes... --On Sunday, March 31, 2019 16:48 -0700 Wei Chuang wrote: >... > My worry, as Dave Crocker's recent message on BIMI highlights, > is that these domain based authentication methods depend on > the integrity of DNS, and apparently there's now viable > attacks on DNS (The Route 53/BGP hijack is another). Perhaps > this proposal needs to take into account such DNS attacks now > rather than later. >... There are two other, far more fundamental and closely related, issues with domain-based authentication that I don't think the BIMI proposal addresses. We've now got somewhat more than 1500 top level domains. For a significant fraction of them (I'd guess the vast majority) there are only two qualifications for obtaining a second-level domain under that TLD: ability to pay what is usually a fairly nominal amount and a working email address. Typical contracts between a TLD operator and the buyer of an SLD transfer all responsibility for obedience to, or violation of, trademark laws to the latter. There is, in general, no requirement for the TLD to pay any attention to whether a proposed SLD name would infringe on a trademark, even an internationally well-known one, and considerable incentive for them not to do so. So assume you have a company who holds a registered trademark and associated domain name as, e.g., BigCo.co.uk. They have all of the right certificates and bind a logo to that domain. Now let's assume that a party comes along who wants to attack BigCo and its logo. Rather than pointing the finger at existing domains, assume that a TLD names "evil" is allocated and delegated in the near future and that their business model was a little ethics-challenged (perhaps not much more than the average, but that is not an important issue). So someone comes along, someone who is clearly not BigCo, and obtains BigCo.evil (remember, all they need is ability to pay and an email address). They have little trouble obtaining certificates in that name because, as far as the DNS environment is concerned, they legitimately hold it. They send mail out from that address using BigCo's logo, either embedded or via some URL. So, think the users will notice the logo does not have your seal of approval and that the domain is in "evil." rather than "co.uk."? See the problem? Of course, BigCo can attempt to use the courts and/or ICANN procedures to challenge BigCo.evil on the grounds of infringement of their registered trademark, but there are two problems with that. One is that such challenges take a while and are typically easily dragged out so that, by the time they win and BigCo.evil is taken down, significant damage has been done already and the operators of BigCo.evil are laughing all the way to the bank. The other is the second basic problem. With the possible exception of a relatively small number of internationally well-known / famous names and marks, registered trademarks are tied to both geography and field of application. If BigCo.co.uk sells widgets and BigCo.us makes blankets for wizzles, there is most likely no trademark violation and both companies may be completely legitimate (unlike the example above), have the marks appropriately registered, and are able to obtain even the highest assurance certificates possible --different jurisdictions and business locations and different fields of application. Even if both selected logos that were very similar, trademarks wouldn't help much. As Dave said, people have been working on these issues for well over a century with very little discernable progress. I can't recommend holding your breathe about the latter problem and, even if it were solved, that would still leave the nature of the domain name market. best, john From nobody Tue Apr 2 12:54:16 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 73A0512006A for ; Tue, 2 Apr 2019 12:54:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=UMh/VTDR; dkim=pass (1536-bit key) header.d=taugh.com header.b=efn17ejm Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vqP3MS2QE89U for ; Tue, 2 Apr 2019 12:54:12 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 61D2312025A for ; Tue, 2 Apr 2019 12:54:12 -0700 (PDT) Received: (qmail 60717 invoked from network); 2 Apr 2019 19:54:10 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=ed29.5ca3bde2.k1904; bh=wF/YhdDYXQvYl+nIkDjTlDdfpGsFtkmh8VFAfjNGeRw=; b=UMh/VTDRSkoeCtdvArIu/uH53ZwxJ7I5/K3sQoivcdE5veyGSi61okRevrSHSboAjgxUkDLnEvcpNF6DuZCB5N4l8p0SyW91Yb/V5lswzuY0+G0IqHnJzjL/FcBnA74U+lK05z9kMB7eahTsdPjVyhmRsFIzDBklQfMgXMldxF17aha0eBBzyRm6IQQeMGhCMthOMu1VjoQ3E3btFoZOivQPveLrOMdNyFUKFQ1Zye1Xo35E8Tb9YkOunyzCJSEX DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=ed29.5ca3bde2.k1904; bh=wF/YhdDYXQvYl+nIkDjTlDdfpGsFtkmh8VFAfjNGeRw=; b=efn17ejm7zvmdseHCzF+vm/SEpIswAxeKvKGfgscX2aPgOmm1WkOxpMlMMAitimByDLA4fldQdi8eC874IQY/S2X6eWNToHsYcWzvOh0S43QopSWqLEv7cnIc5qXQZ7WbueXjzC7iCxZSRZPt8jxBRZq62VryaHT6PPWirOLh18xIphAD6CbphOmdDE4sNf3QJ7Ua7ST0ajhqlXxffHJLanCAHTi8vzlFF2EIc5nOEvo8yShNKtNF0pWSxiQln7E Received: from ary.qy ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTP via TCP6; 02 Apr 2019 19:54:09 -0000 Received: by ary.qy (Postfix, from userid 501) id 7C6FA201144B7C; Tue, 2 Apr 2019 15:54:08 -0400 (EDT) Date: 2 Apr 2019 15:54:08 -0400 Message-Id: <20190402195409.7C6FA201144B7C@ary.qy> From: "John Levine" To: bimi@ietf.org Cc: john-ietf@jck.com In-Reply-To: Organization: Taughannock Networks X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 8bit Archived-At: Subject: Re: [Bimi] Today's BoF X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Apr 2019 19:54:15 -0000 In article you write: >... So someone comes >along, someone who is clearly not BigCo, and obtains BigCo.evil >(remember, all they need is ability to pay and an email >address). They have little trouble obtaining certificates in >that name because, as far as the DNS environment is concerned, >they legitimately hold it. Nobody is assuming that you can get a bimi cert (or whatever) merely with a domain name similar to the target trademark. I gather that one of the gorillas accidentally made this mistake in their informal logo collection system and a motivation for bimi is to keep it from happening again. Of course this returns us to the major question of whether it's possible to invent an effective system to check bimi applications. I could invent one that involved a staff of trademark lawyers, but I don't think anyone outside the S&P 500 would find that usable. R's, John From nobody Tue Apr 2 14:03:12 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7132A1201D5 for ; Tue, 2 Apr 2019 14:03:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9WL4SRNN6P9U for ; Tue, 2 Apr 2019 14:03:08 -0700 (PDT) Received: from bsa2.jck.com (bsa2.jck.com [70.88.254.51]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4F6D7120077 for ; Tue, 2 Apr 2019 14:03:08 -0700 (PDT) Received: from [198.252.137.10] (helo=PSB) by bsa2.jck.com with esmtp (Exim 4.82 (FreeBSD)) (envelope-from ) id 1hBQYk-0005RH-Fl; Tue, 02 Apr 2019 17:03:06 -0400 Date: Tue, 02 Apr 2019 17:02:54 -0400 From: John C Klensin To: John Levine cc: bimi@ietf.org Message-ID: <6D3D29C7AE7A951D108A697E@PSB> In-Reply-To: <20190402195409.7C6FA201144B7C@ary.qy> References: <20190402195409.7C6FA201144B7C@ary.qy> X-Mailer: Mulberry/4.0.8 (Win32) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Content-Disposition: inline X-SA-Exim-Connect-IP: 198.252.137.10 X-SA-Exim-Mail-From: john-ietf@jck.com X-SA-Exim-Scanned: No (on bsa2.jck.com); SAEximRunCond expanded to false Archived-At: Subject: Re: [Bimi] Today's BoF X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Apr 2019 21:03:11 -0000 --On Tuesday, April 2, 2019 15:54 -0400 John Levine wrote: > In article you write: >> ... So someone comes >> along, someone who is clearly not BigCo, and obtains >> BigCo.evil (remember, all they need is ability to pay and an >> email address). They have little trouble obtaining >> certificates in that name because, as far as the DNS >> environment is concerned, they legitimately hold it. > > Nobody is assuming that you can get a bimi cert (or whatever) > merely with a domain name similar to the target trademark. Understood. However, unless just about every MUA in the world was upgraded to understand the difference between a bimi link and cert, I can't imagine a typical user being able to tell the difference between a bimi-blessed logo (or whatever) and the same logo presented via some other mechanism. If I correctly understood last week's discussion, bimi is dependent on mechanisms, including DKIM/SPF/DMARC that are, unless I'm missing something, dependent in turn on some assumptions about binding of the identity of a domain name holder with the domain name. My point was one cannot push those assumptions very hard without running into questions of registrar integrity and what it means to own (or hold) a domain name. And, before you tell me that, statistically, everyone is using web interfaces and MUAs don't count and/or that statistically everyone is using one of those gorilla systems so it is reasonable to ignore the deployment issues for the tiny minority of people who are left, I suggest that a corollary to those conclusions is that a code of common practices among said gorillas and an advertising campaign to try to convince people that they would much safer if they didn't communicate with, or accept mail from, anyone who was not using a gorilla system. Of course that approach would have interesting antitrust implications, but that, statistically, has not be a problem yet, so why worry? :-( > I > gather that one of the gorillas accidentally made this mistake > in their informal logo collection system and a motivation for > bimi is to keep it from happening again. If one conbines that sentence with the "Nobody is assuming..." one above, then a motivation for bimi is to cure (or prevent) stupidity. Perhaps it will work this time, but the track record of other efforts to apply such cures has not been good. > Of course this returns us to the major question of whether it's > possible to invent an effective system to check bimi > applications. I could invent one that involved a staff of > trademark lawyers, but I don't think anyone outside the S&P > 500 would find that usable. Indeed. best, john From nobody Wed Apr 3 05:55:06 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFF92120327 for ; Wed, 3 Apr 2019 05:55:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wRcUSLhB6tXz for ; Wed, 3 Apr 2019 05:55:00 -0700 (PDT) Received: from mail-ua1-x92f.google.com (mail-ua1-x92f.google.com [IPv6:2607:f8b0:4864:20::92f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E2B5E1201DB for ; Wed, 3 Apr 2019 05:54:59 -0700 (PDT) Received: by mail-ua1-x92f.google.com with SMTP id l22so1702292uao.8 for ; Wed, 03 Apr 2019 05:54:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=qtzRmPRNffrjtdJ3p/veh5SgNa4Fk8edqs2NB+W16p8=; b=rFz9wkNoJCipZdWhNHDtVSiqlhezMLXw0viIP/4IBBR7hrcH6skuLEJ/awvZtSHHZJ gtJ+BTKHRHWYeMNSnG5VEYVNapNWqwv9xbaOiumarFsI+Kv/h7t/txgw5YLOWfQi+hrh 9H69iRgaUS1AqkPF6876WFPMS/PB6rw8xwLPJAJBADkgD4OGlhMXZSz+stVOuwAim/kY Xw2zAV1x1nI1MSQoTAJNifJR6UqMidRKD9Hsg1duh4KXhDb6egr22J2Hr5y0hCH4YySW AzBRrPUCCo7ljAC9wn+nb1Scnez3xRw/5vBBo+n9vSSq1c7dNbUqeoAC5R+QRAkKe7M2 czmw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=qtzRmPRNffrjtdJ3p/veh5SgNa4Fk8edqs2NB+W16p8=; b=rEq1JUvZBpjCCLWgTV2KYJscyB91APFKgVv4VSVWYSRgOIVaoWpJ0tLAjPcqFvdThA ggeFvd6ZLlM01e5n9VXPJqInLEBHmEpoET9Scw5UZNvQbvlUw2vxQ2KwwugZok4ot/1H Jj2xRs5+gT+h0RygIfo2sla+PuI70z0OgIYPjcJNslxghh+mvMYhzTPsySMeOO8JM6+X BUfDodFfQ407JPSfDyzQM9TPQLeL47evh90Y0/1ZnK4t82VjBJ65rO7o6h0f04neVHj0 AUXjM3QlydeTajjCGFd4cI4h9lMjxvtK7HTWmsTrsq4xJVrrP7mJnH+FzZ3bL9v7ok8B M2Xw== X-Gm-Message-State: APjAAAVdALZFUf/b7YrpjWJd7MNEmp8nj1y0GSdn/ZGBWeAEudOB9Cz9 01BGhtP9W1toesdhVMEix+lfrq+lvzSkyZoet0QvRBBi5BIDoA== X-Google-Smtp-Source: APXvYqxlyiSIpYlZNss4Q43FvHYSoeY/ycK+v/Lg2pVSRaQ147Q6k0NMwQTfBHD9T6xZvplMEU64S8P0nSL+wamAK6M= X-Received: by 2002:a9f:3fce:: with SMTP id m14mr43997165uaj.96.1554296098088; Wed, 03 Apr 2019 05:54:58 -0700 (PDT) MIME-Version: 1.0 References: <309EBD4AD64BE436663E721D@PSB> <094f20b3-1c4f-b5e7-76f8-d683a4b3d991@dcrocker.net> In-Reply-To: <094f20b3-1c4f-b5e7-76f8-d683a4b3d991@dcrocker.net> From: Wei Chuang Date: Wed, 3 Apr 2019 05:54:40 -0700 Message-ID: To: Dave Crocker Cc: bimi@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000dbd00105859fc2f7" Archived-At: Subject: Re: [Bimi] Today's BoF X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Apr 2019 12:55:04 -0000 --000000000000dbd00105859fc2f7 Content-Type: multipart/alternative; boundary="000000000000cdf1ea05859fc2e9" --000000000000cdf1ea05859fc2e9 Content-Type: text/plain; charset="UTF-8" *From: *Dave Crocker *Date: *Tue, Apr 2, 2019 at 8:09 AM *To: *Wei Chuang *Cc: * On 4/1/2019 9:44 AM, Wei Chuang wrote: > > And any effort to use 'validated' logos at scale has no history, > where > > the challenges in doing that have been well- and often-cited. > > > > > > Agreed these are significant risks. What's done to mitigate this is to > > map this on to the existing registered trademark system, and leverage > > those precedents. > > > Wei, > > I'll cite the anecdote I keep telling, about an interaction on a > pre-ICANN committee, where the WIPO representative -- an attorney, of > course(*) -- said that there were discussions underway for resolving > international issues regarding trademark. This would have made Internet > domain name disputes much, much simpler. > > Then he acknowledged that the discussions had been underway for 100 > years, with no immediate resolution in sight. That was 20 years ago and > I haven't heard that they have yet produced a solution. > > So forgive me, but I believe that "the existing registered trademark > system" does not handle the kind of problem created by Bimi. Not even > close. To the extent that you believe it will -- and will do it at > scale -- there needs to be very careful documentation of how that will > work at a systems level. > > More broadly, and while it's a non-trivial amount of work, I'm finding > myself forced to suggest that Bimi advocates produce a life-cycle > scenario document, that shows all aspects of administration and use of > Bimi, including problem handling, from first actions to last. > There's some documentation of those considerations for VMC in its security perspective draft. Section 2.5 in particular has thoughts about registered trademarks and jurisdiction consideration, and 2.7 suggests when not to display a logo: https://tools.ietf.org/html/draft-chuang-ietf-bimi-security-perspectives-00#section-2.5 You can see validation details from the perspective of the CA/MVA in the VMC Guidelines document in Section 3: https://docs.google.com/document/d/10IzxkdrveDazBAvTvOUa9uCIDBwMkdmluwHEcbja42w/edit?usp=sharing But I agree we should do more to spell out a life cycle flow perhaps as an extension to the perspectives draft. -Wei > > This will permit people to evaluate Bimi holistically. > > > d/ > > > (*) It's probably worth offering some contrast about his participation: > He was also the person on the committee that proposed the model for > dispute resolution (UDRP) that ICANN adopted and still uses. > > -- > Dave Crocker > Brandenburg InternetWorking > bbiw.net > --000000000000cdf1ea05859fc2e9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


From: Dave Crocker <d= hc@dcrocker.net>
Date: Tue, Apr 2, 2019 a= t 8:09 AM
To: Wei Chuang
Cc: <<= a href=3D"mailto:bimi@ietf.org">bimi@ietf.org>

On 4/1/2019 9:44 AM, Wei Chuang w= rote:
>=C2=A0 =C2=A0 =C2=A0And any effort to use 'validated' logos at = scale has no history, where
>=C2=A0 =C2=A0 =C2=A0the challenges in doing that have been well- and of= ten-cited.
>
>
> Agreed these are significant risks.=C2=A0 What's done to mitigate = this is to
> map this on to the existing registered trademark system, and leverage =
> those precedents.


Wei,

I'll cite the anecdote I keep telling, about an interaction on a
pre-ICANN committee, where the WIPO representative -- an attorney, of
course(*) -- said that there were discussions underway for resolving
international issues regarding trademark.=C2=A0 This would have made Intern= et
domain name disputes much, much simpler.

Then he acknowledged that the discussions had been underway for 100
years, with no immediate resolution in sight.=C2=A0 That was 20 years ago a= nd
I haven't heard that they have yet produced a solution.

So forgive me, but I believe that "the existing registered trademark <= br> system" does not handle the kind of problem created by Bimi.=C2=A0 Not= even
close.=C2=A0 To the extent that you believe it will -- and will do it at scale -- there needs to be very careful documentation of how that will
work at a systems level.

More broadly, and while it's a non-trivial amount of work, I'm find= ing
myself forced to suggest that Bimi advocates produce a life-cycle
scenario document, that shows all aspects of administration and use of
Bimi, including problem handling, from first actions to last.

There's some documentation of those consideratio= ns for VMC in its security perspective draft.=C2=A0 Section 2.5 in particul= ar has thoughts about registered trademarks and jurisdiction consideration,= and 2.7 suggests when not to display a logo:
You can see validation details from the pe= rspective of the CA/MVA in the VMC Guidelines document in Section 3:
<= div>https://docs.google.com/document/d/= 10IzxkdrveDazBAvTvOUa9uCIDBwMkdmluwHEcbja42w/edit?usp=3Dsharing

But I agree we should do more to spell out a life cycle f= low perhaps as an extension to the perspectives draft.=C2=A0

=
-Wei
=C2=A0

This will permit people to evaluate Bimi holistically.


d/


(*) It's probably worth offering some contrast about his participation:=
He was also the person on the committee that proposed the model for
dispute resolution (UDRP) that ICANN adopted and still uses.

--
Dave Crocker
Brandenburg InternetWorking
bbiw.net
--000000000000cdf1ea05859fc2e9-- --000000000000dbd00105859fc2f7 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMWMqzbpn2SydMzpfaMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE4MTExNTE4NDMwM1oXDTE5MDUx NDE4NDMwM1owIjEgMB4GCSqGSIb3DQEJAQwRd2VpaGF3QGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQDOGIfi32h8dhJEeUGHfN1nAVrJsY4ph3nisYgnB2pOA4hcNkX4 xnnbD7PDr6G2S6LqYfXegzUkLT7FoOGtptBAixwpSxBUvEWQdrlbYdYuoNK7/DBASrlp4J7UocGX ZS5dkWL0IolToc52mCmOxhTqDjbD9MG3+AvyyQPK0RVgNY5n7BZBdNZDHTeswReAtjQ4t+b1IStQ 7Y59jxTOfDPpAT2Y0ON44Lx2hBLyQ8wXYCmHHbWCyGT3xZH0p8p+cGgkKvDjaxBX3ilopH8hx4zm 5HVh6wDOBHhAnRYVU1bqmjohWNuLhz/Za6lWGiylhPD+2yFLQfvHn6OBE0a/048NAgMBAAGjggFu MIIBajAcBgNVHREEFTATgRF3ZWloYXdAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFJUPLExeOaBiYyZVRuorZTtplIumMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQBuvV1bxPXhqWWCHYz7 40fvnmDIUsNiLecW3PCDQxdpPMc3V/6T31qSKYvuFigtj2MpXMCkLqbHupVN3b14UvnqNx3jnu7b Yp+rMcjjO70W3ufBqqz/QQzSykR9ATo+Zqs09dhJtTl02ApUqYipoInGx8wu0ChTI84NwR5UUo7H GSOet+Eluj5Yjq0YdM2qzfapP/XbfO7t533yiK5Cs//IlaQagdizrM/b1DTYjJ/28b3uPMS3l6a8 BoWm7kiV6GCY7zBNF9D6Gkf6U4dZgx6SwQjQoG3mSBV1zzIs0cZYoVvq/8y+5jC9CdH1ran/ahb6 1ZtMG4auBaKMRzEe3TimMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMWMqzbpn2 SydMzpfaMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCCmu9zNdQQJziBAvImsWhd3 D3Uawmm9TBn+HpDIdgNEGjAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA0MDMxMjU0NTlaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAYSzw+BF76vLwYLMMo6Wh1Zx64bdnjNLhPFJz337Z tGjl1RmBhrih7knp5DrKVSMUsRITLVdF/MmRxwb4Z9mQxPDXf07f5b1jUPDCXmesGzG8yk1gV4Uc KnTtiyOpB9I5ixR2g7s9PY1cazrXCYjMIBZFGRUjE3XaMzQe0y+zSKNIu/27sraPpa0DQyjpIyKU mkoVhdYV/Ok4v5UFVg+vVuTG/W5DuWHxdSJkQEwqKEqFefnOf7sXDYOjt+gNPDbagW7Ygjvdpcr1 2rxeVBieoedDjNzAjhmWzdox+S57hKCRnBoFJ2V8wcU78YeEUQH+t2bSsKPrCUaolvAge4zZlg== --000000000000dbd00105859fc2f7-- From nobody Wed Apr 3 06:36:52 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1EA8D12013C for ; Wed, 3 Apr 2019 06:36:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.6 X-Spam-Level: X-Spam-Status: No, score=-15.6 tagged_above=-999 required=5 tests=[DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mi-8fQrF_tyq for ; Wed, 3 Apr 2019 06:36:48 -0700 (PDT) Received: from mail-vs1-xe36.google.com (mail-vs1-xe36.google.com [IPv6:2607:f8b0:4864:20::e36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B8B851200FE for ; Wed, 3 Apr 2019 06:36:47 -0700 (PDT) Received: by mail-vs1-xe36.google.com with SMTP id n4so9986516vsm.3 for ; Wed, 03 Apr 2019 06:36:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=8HWG5oF9tVbHX6wtnQssB8CpAN7k5dMt9U8mLq1nX+I=; b=RfXVXbVYnec+TgMd084unlI0Ac4q/Ix0Eco1Qe9IQnKfueJuxKU4n5GzAuE2/2+zHN lnzcabUyv7siUujxuN2YvZCIoH7ND49GFtP2RUBYY1lbkmhz8nRCUZWKWh/9LsXL5Zt3 5p7zpCJS3Tv+/BECvkxSXWGvNquUOzwHfeifB/xvMLdZycrHO5X4GpMkUrUepzu2pVpr /pLr6QJk8x+fSw/nyQ6v3ohCzDnMW03UnCieZE6LSktaAwf56vE2Er+cmVI1UQHdcW1D 59fC4ntPrDOizzHiRz6qsK6CkXIeo9nh1eOmPuNspqK47Zy+8mUSh4CcA5CYuOQQ4vKF QF8g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=8HWG5oF9tVbHX6wtnQssB8CpAN7k5dMt9U8mLq1nX+I=; b=LyV4cQH8/Zo5B5wrMhvp9Z455phset3ZvYaIdHp4oPX0BJ4MUZPIjvOvl7kLtvbbfD v1/7WCtWfddetEwpVldxQdhyRU3wV+RrW7ZONaS42jfpnCTshfD8XOSMEVGctpYP/S0s AT1wdKfxEwb8mVQ1ZM7vaCudPDt5m/77vUqX4dF22MR6U/QSfY7LKlB9m3C9gSI9DVRo ckHC+U7zqCTHe1RULQ6VVs/+sQe9IGnfPJB7aHyF04LL64FQi/URyPb0nKGfOa80+VUH IEiRuYeAHQuDsT0sKZX4nHLWU2m/xkA7fPTMW04oQyz7Kzq4jek9LYbn0TWE0mwXucE5 trKg== X-Gm-Message-State: APjAAAUIYtI1X00dnPuhLwMVnuj3IQt2bNQN3EMbPskJ9bqXhGRhsnI1 VDHMV/5ngMfddCVwOHvOBaE1WyJbJhHv6zI//8Cph2ql46um6Q== X-Google-Smtp-Source: APXvYqzjamlTjioMuWIcS1/AocZrKLL1VRaPpNliD/JZyxbQQbDhJ6IU2ZcDrGZWeu0oYbSCYh04y/H53wYGLutvJ1o= X-Received: by 2002:a67:8dc5:: with SMTP id p188mr205180vsd.52.1554298606114; Wed, 03 Apr 2019 06:36:46 -0700 (PDT) MIME-Version: 1.0 References: <309EBD4AD64BE436663E721D@PSB> In-Reply-To: From: Wei Chuang Date: Wed, 3 Apr 2019 06:36:29 -0700 Message-ID: To: John C Klensin Cc: bimi@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000005740280585a058a8" Archived-At: Subject: Re: [Bimi] Today's BoF X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Apr 2019 13:36:50 -0000 --0000000000005740280585a058a8 Content-Type: multipart/alternative; boundary="0000000000004b583b0585a058cf" --0000000000004b583b0585a058cf Content-Type: text/plain; charset="UTF-8" *From: *John C Klensin *Date: *Tue, Apr 2, 2019 at 11:26 AM *To: *Wei Chuang *Cc: * Wei, > > Two observations on separate notes... > > (Regarding the first, I didn't want to repeat what John L. had already said) > The other is the second basic problem. > > With the possible exception of a relatively small number of > internationally well-known / famous names and marks, registered > trademarks are tied to both geography and field of application. > If BigCo.co.uk sells widgets and BigCo.us makes blankets for > wizzles, there is most likely no trademark violation and both > companies may be completely legitimate (unlike the example > above), have the marks appropriately registered, and are able to > obtain even the highest assurance certificates possible > --different jurisdictions and business locations and different > fields of application. Even if both selected logos that were > very similar, trademarks wouldn't help much. > Agreed that the VMC proposal which maps onto the existing trademark framework including its warts. So yes agreed that this system will allow for similar marks owned by different companies in different jurisdictions, or across different lines of business. Presumably its one that users live with and presumably navigate in a reasonable fashion. Consequently there's a set of recommendations in the VMC security perspective draft section 2.5 and 2.7 particularly about the display and non-display of logos: https://tools.ietf.org/html/draft-chuang-ietf-bimi-security-perspectives-00#section-2.5 As Dave said, people have been working on these issues for well > over a century with very little discernable progress. I can't > recommend holding your breathe about the latter problem +1 -Wei > and, > even if it were solved, that would still leave the nature of the > domain name market. > best, > john > > > > > --0000000000004b583b0585a058cf Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
From: John C Klensin= <john-ietf@jck.c= om>
Date: Tue, Apr 2, 2019 at 11:26 AMTo: Wei Chuang
Cc: <bimi@ietf.org>

Wei,

Two observations on separate notes...


(Regarding the first, I didn't want to repeat what John L. had alrea= dy said)
=C2=A0
=C2=A0 The other is the second basic problem.

With the possible exception of a relatively small number of
internationally well-known / famous names and marks, registered
trademarks are tied to both geography and field of application.
If BigC= o.co.uk sells widgets and BigCo.us makes blankets for
wizzles, there is most likely no trademark violation and both
companies may be completely legitimate (unlike the example
above), have the marks appropriately registered, and are able to
obtain even the highest assurance certificates possible
--different jurisdictions and business locations and different
fields of application.=C2=A0 =C2=A0Even if both selected logos that were very similar, trademarks wouldn't help much.=C2=A0

Agreed that the VMC proposal which maps onto the existing = trademark framework including its warts.=C2=A0 So yes agreed that this syst= em will allow for similar marks owned by different companies in different j= urisdictions, or across different lines of business.=C2=A0 Presumably its o= ne that users live with and presumably navigate in a reasonable fashion.=C2= =A0 Consequently there's a set of recommendations in the VMC security p= erspective draft section 2.5 and 2.7 particularly about the display and non= -display of logos:
https://tools.ietf.or= g/html/draft-chuang-ietf-bimi-security-perspectives-00#section-2.5
<= /div>

As Dave said, people have been working on these issues for well
over a century with very little discernable progress.=C2=A0 =C2=A0 I can= 9;t
recommend holding your breathe about the latter problem
<= br>
+1

-Wei
=C2=A0
and,
even if it were solved, that would still leave the nature of the
domain name market.=C2=A0

best,
=C2=A0 =C2=A0john




--0000000000004b583b0585a058cf-- --0000000000005740280585a058a8 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMWMqzbpn2SydMzpfaMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE4MTExNTE4NDMwM1oXDTE5MDUx NDE4NDMwM1owIjEgMB4GCSqGSIb3DQEJAQwRd2VpaGF3QGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQDOGIfi32h8dhJEeUGHfN1nAVrJsY4ph3nisYgnB2pOA4hcNkX4 xnnbD7PDr6G2S6LqYfXegzUkLT7FoOGtptBAixwpSxBUvEWQdrlbYdYuoNK7/DBASrlp4J7UocGX ZS5dkWL0IolToc52mCmOxhTqDjbD9MG3+AvyyQPK0RVgNY5n7BZBdNZDHTeswReAtjQ4t+b1IStQ 7Y59jxTOfDPpAT2Y0ON44Lx2hBLyQ8wXYCmHHbWCyGT3xZH0p8p+cGgkKvDjaxBX3ilopH8hx4zm 5HVh6wDOBHhAnRYVU1bqmjohWNuLhz/Za6lWGiylhPD+2yFLQfvHn6OBE0a/048NAgMBAAGjggFu MIIBajAcBgNVHREEFTATgRF3ZWloYXdAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFJUPLExeOaBiYyZVRuorZTtplIumMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQBuvV1bxPXhqWWCHYz7 40fvnmDIUsNiLecW3PCDQxdpPMc3V/6T31qSKYvuFigtj2MpXMCkLqbHupVN3b14UvnqNx3jnu7b Yp+rMcjjO70W3ufBqqz/QQzSykR9ATo+Zqs09dhJtTl02ApUqYipoInGx8wu0ChTI84NwR5UUo7H GSOet+Eluj5Yjq0YdM2qzfapP/XbfO7t533yiK5Cs//IlaQagdizrM/b1DTYjJ/28b3uPMS3l6a8 BoWm7kiV6GCY7zBNF9D6Gkf6U4dZgx6SwQjQoG3mSBV1zzIs0cZYoVvq/8y+5jC9CdH1ran/ahb6 1ZtMG4auBaKMRzEe3TimMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMWMqzbpn2 SydMzpfaMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCAPh0mcHKhzR74y8Rmeu0Dr IyLgm/8PNTPzpIP8ASX2OjAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA0MDMxMzM2NDZaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAF3XqWqqylx2CiLDhzM7rNSAZL6h7qxRVpXMXN13c UrN4aEmNszoCPVEF9tVTI+vdkEogHC3+LM4lcBJ3OxP0gGfmSMRsC0U+HZmd9VJ5Zj+xE49F7Hip 1Y1h0rPnXZhMPg/vZV5WQmggGAHKi3rCiColAy17SfD2MI0gFqetc9XeyGDNB6XlRlfY1Paspa8L BBPsVCyQPytYtl+Mtg6r2n3D7FeHIR42i0UoFQmqJSZbZisEgvNp0js6ejsAusKfQX+Wlb+8fLoU e1kQsO/lt6GN66LbK9qBaDsK2rirGh/s8ZjtPR+8Z6QXYi2aYt3LoIgjt9BX+efjsP5BLHS0jQ== --0000000000005740280585a058a8-- From nobody Wed Apr 3 07:02:30 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38E291200D6 for ; Wed, 3 Apr 2019 07:02:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.6 X-Spam-Level: X-Spam-Status: No, score=-15.6 tagged_above=-999 required=5 tests=[DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SrpUnZFK-6Yh for ; Wed, 3 Apr 2019 07:02:25 -0700 (PDT) Received: from mail-vs1-xe2e.google.com (mail-vs1-xe2e.google.com [IPv6:2607:f8b0:4864:20::e2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AED051200A2 for ; Wed, 3 Apr 2019 07:02:24 -0700 (PDT) Received: by mail-vs1-xe2e.google.com with SMTP id g127so10030175vsd.6 for ; Wed, 03 Apr 2019 07:02:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=6F/9P7VlXLI+NFnAKVMBXTjkrxyS/KA3eFL9ea3+LE0=; b=iLYeGUMSHjsH/H686I18Thut09xJysVJ86lX4yh4KXHtnrIXSEStQldC83/FbmyS92 WVG99ioFW3db4a5acKfh12bMyBMxL/JP3oVOgvDzkN3lCiufmVo3HqYwu3X5DkA/fm24 NJsNs9NkO4oZO0QKVBsqSkSVh8Trma/UfnLke6Tqcu1IkpYmbP0e4YxAZRD9NoVY1hUP vE6iYTgKi5kjc/zVVlNE1672jK1G2sPGKvo2EI96QIIzsIYpwpOzA1AOoRRpday6Waxw B9W4j8k1nVhybcxmoG8CWBPiCID99yjlKKZ4khewmBSEY/DphRKeENyTe44Zi0k8Qk3x wx3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=6F/9P7VlXLI+NFnAKVMBXTjkrxyS/KA3eFL9ea3+LE0=; b=O5Jz/ToskdQDSoTIqHSwFFzBBmS7omV6+cAXkBmYazWsqXWjf9AY31pcJOrVBC0PO5 m97Ay9Ft/vhvhAv6p9TJEuLu4uvp7xGA/pk88FqL1uFEB/h8O52au4g0ZDcFwP/g21Bl 86dFpc8ShGlBLU7U5+SOuh8gUv8fugyH+ROyOATr1+DqStmDvQTG9xTELE+g9EKKuEyP 4kZDqG6hwkhYGh9tlb6d1831YHj/rCTvV7iEYpPk9wjH0elgJYanU1ckkBTFJVwD7w0/ A/SwTr9xxChjKU9lZe6205/gOP89AcB38f3QlQeqlx14uYgcfB14JIDpCbotoOsYVgdr d1dA== X-Gm-Message-State: APjAAAW32nf1Ao2oYhI9c9H7WDzczjS6G11mrTS0FJruHnjl9ycZ+w0b LZNFZ4E73O4B7zAYoCtWshxcvJzsi9UaVCWsJAw/9A== X-Google-Smtp-Source: APXvYqyPKKaqSyu+OuEDV8stU0QukYod1tB6mIE65JnSMCDO05RxuH5N7G2U/+le8/V9adtPaTMSan0J6odHoCxCBQc= X-Received: by 2002:a67:e30a:: with SMTP id j10mr267029vsf.103.1554300143020; Wed, 03 Apr 2019 07:02:23 -0700 (PDT) MIME-Version: 1.0 References: <20190402195409.7C6FA201144B7C@ary.qy> <6D3D29C7AE7A951D108A697E@PSB> In-Reply-To: <6D3D29C7AE7A951D108A697E@PSB> From: Wei Chuang Date: Wed, 3 Apr 2019 07:02:07 -0700 Message-ID: To: John C Klensin Cc: John Levine , bimi@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000f37bfd0585a0b3e5" Archived-At: Subject: Re: [Bimi] Today's BoF X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Apr 2019 14:02:29 -0000 --000000000000f37bfd0585a0b3e5 Content-Type: multipart/alternative; boundary="000000000000e6bbe90585a0b3f9" --000000000000e6bbe90585a0b3f9 Content-Type: text/plain; charset="UTF-8" *From: *John C Klensin *Date: *Tue, Apr 2, 2019 at 2:03 PM *To: *John Levine *Cc: * > > --On Tuesday, April 2, 2019 15:54 -0400 John Levine > wrote: > > > In article you write: > >> ... So someone comes > >> along, someone who is clearly not BigCo, and obtains > >> BigCo.evil (remember, all they need is ability to pay and an > >> email address). They have little trouble obtaining > >> certificates in that name because, as far as the DNS > >> environment is concerned, they legitimately hold it. > > > > Nobody is assuming that you can get a bimi cert (or whatever) > > merely with a domain name similar to the target trademark. > > Understood. However, unless just about every MUA in the world > was upgraded to understand the difference between a bimi link > and cert, I can't imagine a typical user being able to tell the > difference between a bimi-blessed logo (or whatever) and the > same logo presented via some other mechanism. > Those are really good points. The main solution will be that the MUA has to help the user navigate through the UI (and done carefully). > If I correctly understood last week's discussion, bimi is > dependent on mechanisms, including DKIM/SPF/DMARC that are, > unless I'm missing something, dependent in turn on some > assumptions about binding of the identity of a domain name > holder with the domain name. My point was one cannot push > those assumptions very hard without running into questions of > registrar integrity and what it means to own (or hold) a domain > name. > Yes BIMI very much depends on the integrity of the DNS system, both at the registrar level and the protocol. The latter might be defended by DNSSEC. If that's not to your liking and attacks like Route 53 are more common place, we could use only DKIM/DMARC and require that the DKIM public key align with the certificate's public key. Regarding the former, agreed that's issue. If attacks like what Dave disclosed (DNSpionage), then we'll need to depend less on DNS or at least detect the attack. Again the just mentioned DKIM/DMARC restriction can help. This all said if we have serious worries about DNS being authoritative, then a bigger issue is outside of BIMI i.e. the domain based authentication system that's very much deployed and used extensively by receivers. -Wei > And, before you tell me that, statistically, everyone is using > web interfaces and MUAs don't count and/or that statistically > everyone is using one of those gorilla systems so it is > reasonable to ignore the deployment issues for the tiny minority > of people who are left, I suggest that a corollary to those > conclusions is that a code of common practices among said > gorillas and an advertising campaign to try to convince people > that they would much safer if they didn't communicate with, or > accept mail from, anyone who was not using a gorilla system. Of > course that approach would have interesting antitrust > implications, but that, statistically, has not be a problem yet, > so why worry? :-( > > > I > > gather that one of the gorillas accidentally made this mistake > > in their informal logo collection system and a motivation for > > bimi is to keep it from happening again. > > If one conbines that sentence with the "Nobody is assuming..." > one above, then a motivation for bimi is to cure (or prevent) > stupidity. Perhaps it will work this time, but the track record > of other efforts to apply such cures has not been good. > > > Of course this returns us to the major question of whether it's > > possible to invent an effective system to check bimi > > applications. I could invent one that involved a staff of > > trademark lawyers, but I don't think anyone outside the S&P > > 500 would find that usable. > > Indeed. > > best, > john > > -- > bimi mailing list > bimi@ietf.org > https://www.ietf.org/mailman/listinfo/bimi > --000000000000e6bbe90585a0b3f9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
From: John C Klensin= <john-ietf@jck.c= om>
Date: Tue, Apr 2, 2019 at 2:03 PM
= To: John Levine
Cc: <bimi@ietf.org>



--On Tuesday, April 2, 2019 15:54 -0400 John Levine
<johnl@taugh.com> wrote:

> In article <DD71F5FAA85F312FDB5EF7E4@PSB> you write:
>> ...=C2=A0 So someone comes
>> along, someone who is clearly not BigCo, and obtains
>> BigCo.evil (remember, all they need is ability to pay and an
>> email address).=C2=A0 =C2=A0They have little trouble obtaining
>> certificates in that name because, as far as the DNS
>> environment is concerned, they legitimately hold it.
>
> Nobody is assuming that you can get a bimi cert (or whatever)
> merely with a domain name similar to the target trademark.

Understood.=C2=A0 =C2=A0However, unless just about every MUA in the world was upgraded to understand the difference between a bimi link
and cert, I can't imagine a typical user being able to tell the
difference between a bimi-blessed logo (or whatever) and the
same logo presented via some other mechanism.=C2=A0
If I correctly understood last week's discussion, bimi is
dependent on mechanisms, including DKIM/SPF/DMARC that are,
unless I'm missing something, dependent in turn on some
assumptions about binding of the identity of a domain name
holder with the domain name.=C2=A0 =C2=A0My point was one cannot push
those assumptions very hard without running into questions of
registrar integrity and what it means to own (or hold) a domain
name.=C2=A0 =C2=A0

Yes BIMI very much d= epends on the integrity of the DNS system, both at the registrar level and = the protocol.=C2=A0 The latter might be defended by DNSSEC.=C2=A0 If that&#= 39;s not to your liking and attacks like Route 53 are more common place, we= could use only DKIM/DMARC and require that the DKIM public key align with = the certificate's public key.=C2=A0 Regarding the former, agreed that&#= 39;s issue.=C2=A0 If attacks like what Dave disclosed (DNSpionage), then we= 'll need to depend less on DNS or at least detect the attack.=C2=A0 Aga= in the just mentioned DKIM/DMARC restriction can help.=C2=A0 This all said = if we have serious worries about DNS being authoritative, then a bigger iss= ue is outside of BIMI i.e. the domain based authentication system that'= s very much deployed and used extensively by receivers.=C2=A0=C2=A0

And, before you tell me that, statistically, everyone is using
web interfaces and MUAs don't count and/or that statistically
everyone is using one of those gorilla systems so it is
reasonable to ignore the deployment issues for the tiny minority
of people who are left, I suggest that a corollary to those
conclusions is that a code of common practices among said
gorillas and an advertising campaign to try to convince people
that they would much safer if they didn't communicate with, or
accept mail from, anyone who was not using a gorilla system.=C2=A0 Of
course that approach would have interesting antitrust
implications, but that, statistically, has not be a problem yet,
so why worry?=C2=A0 :-(

>=C2=A0 I
> gather that one of the gorillas accidentally made this mistake
> in their informal logo collection system and a motivation for
> bimi is to keep it from happening again.

If one conbines that sentence with the "Nobody is assuming..." one above, then a motivation for bimi is to cure (or prevent)
stupidity.=C2=A0 Perhaps it will work this time, but the track record
of other efforts to apply such cures has not been good.

> Of course this returns us to the major question of whether it's > possible to invent an effective system to check bimi
> applications.=C2=A0 I could invent one that involved a staff of
> trademark lawyers, but I don't think anyone outside the S&P > 500 would find that usable.

Indeed.

best,
=C2=A0 =C2=A0john

--
bimi mailing list
bimi@ietf.org
https://www.ietf.org/mailman/listinfo/bimi
--000000000000e6bbe90585a0b3f9-- --000000000000f37bfd0585a0b3e5 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMWMqzbpn2SydMzpfaMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE4MTExNTE4NDMwM1oXDTE5MDUx NDE4NDMwM1owIjEgMB4GCSqGSIb3DQEJAQwRd2VpaGF3QGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQDOGIfi32h8dhJEeUGHfN1nAVrJsY4ph3nisYgnB2pOA4hcNkX4 xnnbD7PDr6G2S6LqYfXegzUkLT7FoOGtptBAixwpSxBUvEWQdrlbYdYuoNK7/DBASrlp4J7UocGX ZS5dkWL0IolToc52mCmOxhTqDjbD9MG3+AvyyQPK0RVgNY5n7BZBdNZDHTeswReAtjQ4t+b1IStQ 7Y59jxTOfDPpAT2Y0ON44Lx2hBLyQ8wXYCmHHbWCyGT3xZH0p8p+cGgkKvDjaxBX3ilopH8hx4zm 5HVh6wDOBHhAnRYVU1bqmjohWNuLhz/Za6lWGiylhPD+2yFLQfvHn6OBE0a/048NAgMBAAGjggFu MIIBajAcBgNVHREEFTATgRF3ZWloYXdAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFJUPLExeOaBiYyZVRuorZTtplIumMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQBuvV1bxPXhqWWCHYz7 40fvnmDIUsNiLecW3PCDQxdpPMc3V/6T31qSKYvuFigtj2MpXMCkLqbHupVN3b14UvnqNx3jnu7b Yp+rMcjjO70W3ufBqqz/QQzSykR9ATo+Zqs09dhJtTl02ApUqYipoInGx8wu0ChTI84NwR5UUo7H GSOet+Eluj5Yjq0YdM2qzfapP/XbfO7t533yiK5Cs//IlaQagdizrM/b1DTYjJ/28b3uPMS3l6a8 BoWm7kiV6GCY7zBNF9D6Gkf6U4dZgx6SwQjQoG3mSBV1zzIs0cZYoVvq/8y+5jC9CdH1ran/ahb6 1ZtMG4auBaKMRzEe3TimMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMWMqzbpn2 SydMzpfaMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCDy3XG3Gs4UVa6fmC+fTysc f5Idai6jdxA71bg9ED4y8TAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA0MDMxNDAyMjNaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEArJU1fBTtmR5Swd7PDpGNwgDDtktP4qsX7xsQTI2K jKwRUQB2N/SAz+gsl8JC7sruJI8ZnosTg8ed1G4V8sI5oIBLmk5lWjk/kyoiBIr8DWTczRUA0eH9 ntho0Safgq/6uVd6gfZQG7sh1VAPHn5rFhhOdmkNIYUwOO2FQrEafhA1a3Sbs3uoWRucQXjXK+17 etpmWVkxoZ7QBuPVjQBwVdYf3eTZFNt79EGkcg0HQfAUnF7OqyfcqPWZclbQQ+dW0Q9ZLyvQYIMG XMAmpChh7OIhX8W0FwsFTyY3ywnuD5c5vGWczyUp6xywKkKf9WeJ0LVKFys0xvOQA5Ge80buAA== --000000000000f37bfd0585a0b3e5-- From nobody Wed Apr 3 09:44:34 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D2BF61200B6 for ; Wed, 3 Apr 2019 09:44:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sVD8ztG7LwOt for ; Wed, 3 Apr 2019 09:44:30 -0700 (PDT) Received: from mail.highwayman.com (happyday.demon.co.uk [80.177.121.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D936120094 for ; Wed, 3 Apr 2019 09:44:30 -0700 (PDT) Received: from localhost ([127.0.0.1]:46755 helo=happyday.al.cl.cam.ac.uk) by mail.highwayman.com with esmtp (Exim 4.91) (envelope-from ) id 1hBj00-00027a-6S for bimi@ietf.org; Wed, 03 Apr 2019 16:44:28 +0000 Message-ID: Date: Wed, 3 Apr 2019 17:43:10 +0100 To: bimi@ietf.org From: Richard Clayton References: <309EBD4AD64BE436663E721D@PSB> In-Reply-To: MIME-Version: 1.0 X-Mailer: Turnpike Integrated Version 5.03 M Archived-At: Subject: Re: [Bimi] Today's BoF X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Apr 2019 16:44:33 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In message , Wei Chuang writes >Agreed that the VMC proposal which maps onto the existing trademark >framework including its warts. So yes agreed that this system will allow >for similar marks owned by different companies in different jurisdictions, >or across different lines of business. this uniqueness only within specific areas of commerce is a key aspect of the trademark system >Presumably its one that users live >with and presumably navigate in a reasonable fashion. yes ... purchasers can generally tell that this box contains widgets and that box (containing green floosits) is not from the same company despite the trademark being the same. So the "overloading" of the marks works moderately well in the real world (and when moderation is absent keeps lawyers in work) however emails inherently look the same as each other ... >Consequently there's >a set of recommendations in the VMC security perspective draft section 2.5 >and 2.7 particularly about the display and non-display of logos: >https://tools.ietf.org/html/draft-chuang-ietf-bimi-security-perspectives- >00#section-2.5 2.5 says that jurisdiction should be done at the granularity of a nation state but the example in 1.1.2.1 draws attention to difficulties arising at at the state level ... ... and US trademarks do indeed operate at the state level: https://www.uspto.gov/trademarks-getting-started/process-overview/state- trademark-information-links this does not seem very consistent ... and as you fix this, please provide the semantics by which code can compare GPS coordinates with "US" or "VA,US" or "UK" or "RO" or even "EU". I suspect that political correctness means that residents of certain parts of the Middle East will not get any BIMI provided logos at all! - -- richard Richard Clayton Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755 -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.7.1 iQA/AwUBXKTinju8z1Kouez7EQKBUQCgr9stCmgS6JOnvKZ7K5LgrJwHoqcAnj1S FCeVP0aQJ3Ua0QL/PqahqTkM =HUa/ -----END PGP SIGNATURE----- From nobody Wed Apr 3 10:02:40 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE0CC12011E for ; Wed, 3 Apr 2019 10:02:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DlAWMLl5HiXL for ; Wed, 3 Apr 2019 10:02:36 -0700 (PDT) Received: from mail-ua1-x92f.google.com (mail-ua1-x92f.google.com [IPv6:2607:f8b0:4864:20::92f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C60A2120124 for ; Wed, 3 Apr 2019 10:02:35 -0700 (PDT) Received: by mail-ua1-x92f.google.com with SMTP id l22so2006633uao.8 for ; Wed, 03 Apr 2019 10:02:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=EoK892dL/FOtPSZWqwiA9K9TblUlFUC8CD34Pqk5cvk=; b=ndrG0PvRmjJ4zDQjNx4Gt7ysDTWYL1aNDBbruejlQ12DWcrPfOR2bpLB7gkAOkJcre aGZO+RdT818KjU9G/tfCif8rkL+VG1RtrToykP3OCXQSwzvHbv8M0tAehRo0x/fzwGMV kTD57Ck1/S7z99D+Zc3BP1bn5f3m3jlWCmCtVipNQR/S3zFGgrbAfs1H/yQVog3J7aWa xThws80OwKeFt+zJocgVFsm+6lpTBqUj/oANeEE9OVWu8dF6rIDPCpU9wXgmLxVCDsfO XtHwAH0oVHRK2EXwmFVYPthwVrzIafolq4mNJ2dvwppBNdVa7BQuW/0pUUjEJ6IXR07K KDQw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=EoK892dL/FOtPSZWqwiA9K9TblUlFUC8CD34Pqk5cvk=; b=kIHcmhZHddjg0LyKjpKNDMPOSCquO+6XVSn50MSWdqgShjyjOWBwj+dsbgpGAtGyw1 fzrq1afN6+f8aoIEh5xTpJbrGo+UhKMj2JwY0Uq5xyJ8u87+R3CAcuQ37oKHXosdDEZE wYcNfwRpTisXZJtFeU/Lu50rEC5TLfimmaspZiwyuLbm8Lc6+SgW1+wSZal//+Y30f9p 5SMztzb93PFG+mV6gjO2JbGRRzYD+LGrRZB0yyQ48PwYOMRDdSEpU6loHqhFpnfEEPHZ +XrutPte85GnYzDUWd+KKunzXo3RS6+LbAD6mSzboD5VzdyiqktIxnanrdrA9xCFYywU kcbA== X-Gm-Message-State: APjAAAXOm3mqxhNev9eb6N+D/2TunG6AaVQUaASjfnRclO5zWv9q9dec 32ikcTkIsdkKM6LgvRJrV1+ZCQH/dKF95Zp7xU87ZdxHZqU= X-Google-Smtp-Source: APXvYqy19RbpTeH+DyQbj9IiU2mzWmYUE4UvTlEYlgZR1p2p7GJAQJrMi30NbP0UOoM0l8HkH0R82jsrYj7MwNFk2Ws= X-Received: by 2002:ab0:20c1:: with SMTP id z1mr808359ual.109.1554310954095; Wed, 03 Apr 2019 10:02:34 -0700 (PDT) MIME-Version: 1.0 References: <309EBD4AD64BE436663E721D@PSB> <094f20b3-1c4f-b5e7-76f8-d683a4b3d991@dcrocker.net> <7v+NdwF3b4ocFAeC@highwayman.com> In-Reply-To: <7v+NdwF3b4ocFAeC@highwayman.com> From: Wei Chuang Date: Wed, 3 Apr 2019 10:02:18 -0700 Message-ID: To: Richard Clayton Cc: bimi@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000005850880585a3385c" Archived-At: Subject: Re: [Bimi] Laches (was: Today's BoF) X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Apr 2019 17:02:39 -0000 --0000000000005850880585a3385c Content-Type: multipart/alternative; boundary="0000000000004ac21a0585a338dd" --0000000000004ac21a0585a338dd Content-Type: text/plain; charset="UTF-8" *From: *Richard Clayton *Date: *Tue, Apr 2, 2019 at 9:04 AM *To: * -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > In message <094f20b3-1c4f-b5e7-76f8-d683a4b3d991@dcrocker.net>, Dave > Crocker writes > > >So forgive me, but I believe that "the existing registered trademark > >system" does not handle the kind of problem created by Bimi. Not even > >close. To the extent that you believe it will -- and will do it at > >scale -- there needs to be very careful documentation of how that will > >work at a systems level. > > > >More broadly, and while it's a non-trivial amount of work, I'm finding > >myself forced to suggest that Bimi advocates produce a life-cycle > >scenario document, that shows all aspects of administration and use of > >Bimi, including problem handling, from first actions to last. > > I am very interested to learn what legal guarantees a "BIMI certificate" > might come with and hence what "comfort" it might provide to someone > whose email app was making use of BIMI to determine what marks should be > displayed within their app. > (IANAL) To be sure this topic is complex. We have ideas to your point above but that's still in progress, and we hope to have more to share soon. Your framing this around "laches" is new to us, and helpful feedback. -Wei > > In the UK (your jurisdiction will vary, but not so much) inappropriate > display of trademarks is a civil infringement called "passing off". > > There is extra protection for some special marks such as the Red Cross > emblems (fines up to 5K GBP in the UK, up to 6 months jail in the US) > and for marks associated with the Olympics (fine up to the UK statutory > maximum in this case). > > So if someone sends an email with a subject header field indicating it > is about "X" to someone in country Y and the sender's trademark > (perfectly good in their home country Z for a particular category of > goods) is displayed but it happens that the text of "X" would suggest > that it is marketing material relevant to goods that a trademark holder > in country Y has registered a trademark for -- then there seems to be > excellent grounds for an action in "passing off".... > > .... to what extent will the existence of a BIMI certificate enable the > author of the email software to claim that they were only "following > orders" and that they should not be held liable in any way ? Will there > be an insurance policy in place at the certificate issuer ? > > Also (remember those fines and possible jail time) will BIMI be dealing > specially with Red Cross and Olympic marks (and probably all sorts of > other marks which have special legal protection in some jurisdictions?) > > Also, what expectation do the authors of the BIMI specification have > that email software writers will not be in regular receipt of > injunctions preventing the display of particular marks in particular > countries in relation to particular products ... > > .... lest people think that this is foolishness and hyperbolic > speculation, it is absolutely key to realise that trademarks differ from > other types of intellectual property in that if you fail to diligently > protect your trademark then the protection it provides can disappear. > > Use your favourite search engine to look up "laches" to find out more > than would ever wish to know about this active protection issue. > > Bottom line is that trademarks are associated with a small class of > goods in a small number of countries and an attempt to link these > symbols with emails sent by all of the owners of these trademarks to > people in completely different countries is going to end in tears. The > doctrine of "laches" means that this is pretty much bound to happen > sooner rather than later. > > IANAL, but I read a lot :-) > - -- > richard Richard Clayton > > Those who would give up essential Liberty, to purchase a little temporary > Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755 > > -----BEGIN PGP SIGNATURE----- > Version: PGPsdk version 1.7.1 > > iQA/AwUBXKOG9zu8z1Kouez7EQLGoQCgu4hDmg+oWGU3GOPYEWGOuyPvxyQAoIdr > o9yCrNZIBGtilafLnB32Puji > =Gc1G > -----END PGP SIGNATURE----- > > -- > bimi mailing list > bimi@ietf.org > https://www.ietf.org/mailman/listinfo/bimi > --0000000000004ac21a0585a338dd Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
From: Richard Clayto= n <richard@h= ighwayman.com>
Date: Tue, Apr 2, 2019 at = 9:04 AM
To: <bimi@= ietf.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In message <094f20b3-1c4f-b5e7-76f8-d683a4b3d991@dcrocker.ne= t>, Dave
Crocker <dhc@dcroc= ker.net> writes

>So forgive me, but I believe that "the existing registered tradema= rk
>system" does not handle the kind of problem created by Bimi.=C2=A0= Not even
>close.=C2=A0 To the extent that you believe it will -- and will do it a= t
>scale -- there needs to be very careful documentation of how that will =
>work at a systems level.
>
>More broadly, and while it's a non-trivial amount of work, I'm = finding
>myself forced to suggest that Bimi advocates produce a life-cycle
>scenario document, that shows all aspects of administration and use of =
>Bimi, including problem handling, from first actions to last.

I am very interested to learn what legal guarantees a "BIMI certificat= e"
might come with and hence what "comfort" it might provide to some= one
whose email app was making use of BIMI to determine what marks should be displayed within their app.

(IANAL) To = be sure this topic is complex.=C2=A0 We have ideas to your point above but = that's still in progress, and we hope to have more to share soon.=C2=A0= Your framing this around "laches" is new to us, and helpful feed= back.

-Wei
=C2=A0

In the UK (your jurisdiction will vary, but not so much) inappropriate
display of trademarks is a civil infringement called "passing off"= ;.

There is extra protection for some special marks such as the Red Cross
emblems (fines up to 5K GBP in the UK, up to 6 months jail in the US)
and for marks associated with the Olympics (fine up to the UK statutory
maximum in this case).

So if someone sends an email with a subject header field indicating it
is about "X" to someone in country Y and the sender's tradema= rk
(perfectly good in their home country Z for a particular category of
goods) is displayed but it happens that the text of "X" would sug= gest
that it is marketing material relevant to goods that a trademark holder
in country Y has registered a trademark for -- then there seems to be
excellent grounds for an action in "passing off"....

.... to what extent will the existence of a BIMI certificate enable the
author of the email software to claim that they were only "following orders" and that they should not be held liable in any way ? Will ther= e
be an insurance policy in place at the certificate issuer ?

Also (remember those fines and possible jail time) will BIMI be dealing
specially with Red Cross and Olympic marks (and probably all sorts of
other marks which have special legal protection in some jurisdictions?)

Also, what expectation do the authors of the BIMI specification have
that email software writers will not be in regular receipt of
injunctions preventing the display of particular marks in particular
countries in relation to particular products ...

.... lest people think that this is foolishness and hyperbolic
speculation, it is absolutely key to realise that trademarks differ from other types of intellectual property in that if you fail to diligently
protect your trademark then the protection it provides can disappear.=C2=A0= =C2=A0

Use your favourite search engine to look up "laches" to find out = more
than would ever wish to know about this active protection issue.

Bottom line is that trademarks are associated with a small class of
goods in a small number of countries and an attempt to link these
symbols with emails sent by all of the owners of these trademarks to
people in completely different countries is going to end in tears.=C2=A0 Th= e
doctrine of "laches" means that this is pretty much bound to happ= en
sooner rather than later.

IANAL, but I read a lot :-)
- --
richard=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Richard Clayton

Those who would give up essential Liberty, to purchase a little temporary <= br> Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755
-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1

iQA/AwUBXKOG9zu8z1Kouez7EQLGoQCgu4hDmg+oWGU3GOPYEWGOuyPvxyQAoIdr
o9yCrNZIBGtilafLnB32Puji
=3DGc1G
-----END PGP SIGNATURE-----

--
bimi mailing list
bimi@ietf.org
https://www.ietf.org/mailman/listinfo/bimi
--0000000000004ac21a0585a338dd-- --0000000000005850880585a3385c Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMWMqzbpn2SydMzpfaMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE4MTExNTE4NDMwM1oXDTE5MDUx NDE4NDMwM1owIjEgMB4GCSqGSIb3DQEJAQwRd2VpaGF3QGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQDOGIfi32h8dhJEeUGHfN1nAVrJsY4ph3nisYgnB2pOA4hcNkX4 xnnbD7PDr6G2S6LqYfXegzUkLT7FoOGtptBAixwpSxBUvEWQdrlbYdYuoNK7/DBASrlp4J7UocGX ZS5dkWL0IolToc52mCmOxhTqDjbD9MG3+AvyyQPK0RVgNY5n7BZBdNZDHTeswReAtjQ4t+b1IStQ 7Y59jxTOfDPpAT2Y0ON44Lx2hBLyQ8wXYCmHHbWCyGT3xZH0p8p+cGgkKvDjaxBX3ilopH8hx4zm 5HVh6wDOBHhAnRYVU1bqmjohWNuLhz/Za6lWGiylhPD+2yFLQfvHn6OBE0a/048NAgMBAAGjggFu MIIBajAcBgNVHREEFTATgRF3ZWloYXdAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFJUPLExeOaBiYyZVRuorZTtplIumMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQBuvV1bxPXhqWWCHYz7 40fvnmDIUsNiLecW3PCDQxdpPMc3V/6T31qSKYvuFigtj2MpXMCkLqbHupVN3b14UvnqNx3jnu7b Yp+rMcjjO70W3ufBqqz/QQzSykR9ATo+Zqs09dhJtTl02ApUqYipoInGx8wu0ChTI84NwR5UUo7H GSOet+Eluj5Yjq0YdM2qzfapP/XbfO7t533yiK5Cs//IlaQagdizrM/b1DTYjJ/28b3uPMS3l6a8 BoWm7kiV6GCY7zBNF9D6Gkf6U4dZgx6SwQjQoG3mSBV1zzIs0cZYoVvq/8y+5jC9CdH1ran/ahb6 1ZtMG4auBaKMRzEe3TimMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMWMqzbpn2 SydMzpfaMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCD64w9LS+ki8r8hlVtERyun CLj8kEZfAJmZQnd/A2XIGzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA0MDMxNzAyMzVaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAlSQyaXkl6sKw9neKQsMiuoeyW9SCkmX6TYHXrh6E lkc1+Exk8K8J0VkKTbh2QaNPSrzg+ues+0P7QceFZPQCbvi1DoCs2NAOEGCfvdMG9xOPpR7zVrAl JJunpCRIp/VGfPZYgpNBst90cJ0YaeyLUSDbmFEDEjTfMjvi9gOE4oet1ELkuAM50hBQSQz9RcBB +cXrRON/nsn3heGm7XkrqNk3HgsWJKX+Pe0D/hMiL+iDEfTy/yGNle2gNg+4CZxEMrqWS+6BoxjP 4d5ojxLb0zwP0/Bx0HqzN7DLxVrLAgQqHcSwwTA6Nd4J1rYLl6gwVt163hRwMh0MH2zBbF6olA== --0000000000005850880585a3385c-- From nobody Wed Apr 3 10:13:11 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61A51120135 for ; Wed, 3 Apr 2019 10:13:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.4 X-Spam-Level: X-Spam-Status: No, score=-2.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ed6YSo0XsoRX for ; Wed, 3 Apr 2019 10:13:08 -0700 (PDT) Received: from simon.songbird.com (simon.songbird.com [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 77053120128 for ; Wed, 3 Apr 2019 10:13:08 -0700 (PDT) Received: from [192.168.1.85] (108-226-162-63.lightspeed.sntcca.sbcglobal.net [108.226.162.63]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1.1) with ESMTP id x33HElTp027836 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Wed, 3 Apr 2019 10:14:48 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1554311688; bh=RJMahs/7HpIffw+WZGqvQ0LIR02bgUEt8SprZjhPpfI=; h=Subject:To:Cc:References:From:Reply-To:Date:In-Reply-To:From; b=ZuVYDyo/X/mV1a5L+5IR7i913SNuQG0nFq83P+eUoNrlIHiQpGY45saP0IQFhBVTh mN74ju3teHx5nbZIOWhQuCmmgscebCg/I2bmnujittXcfjJmzwuS+6GS57HFGkk9RU /Ci3nNqQXFSUtYtdwZuUYp6ucq0IYOvrH/zQECv8= To: Wei Chuang , Richard Clayton Cc: bimi@ietf.org References: <309EBD4AD64BE436663E721D@PSB> <094f20b3-1c4f-b5e7-76f8-d683a4b3d991@dcrocker.net> <7v+NdwF3b4ocFAeC@highwayman.com> From: Dave Crocker Reply-To: dcrocker@bbiw.net Organization: Brandenburg InternetWorking Message-ID: <16adbb53-3f6f-f0f6-4e0d-cc77e3abda3f@dcrocker.net> Date: Wed, 3 Apr 2019 10:12:56 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Bimi] Laches X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Apr 2019 17:13:09 -0000 On 4/3/2019 10:02 AM, Wei Chuang wrote: > (IANAL) To be sure this topic is complex.  We have ideas to your point > above but that's still in progress, and we hope to have more to share > soon.  Your framing this around "laches" is new to us, and helpful feedback. Wei, Something like Bimi is easy to make work at small scale. And it doesn't need a standards effort. So the question for any Internet-scale standards effort is: What are the critical issues that need to be solved? For Bimi, I believe the challenge of making logo use 'validated' at scale is the primary, critical issue.(*) This was noted at the start of the Bimi effort, two years ago. That there is still no resolution is not surprising, but it adds to the concern about there pursuing Bimi components now, with the hope that this major scaling barrier will somehow get resolved 'soon'. Any effort to pursue Bimi-related standards needs to happen /after/ this long-standing legal, technical, and operational challenge has a viable proposal for solution. d/ (*) There are, of course, other concerns, such as the frankly tenuous premise that Bimi will drive authentication adoption by bulk senders on the also-thin possibility of more recipient logo-impressions. But as technical barriers go, logo 'validation' is easily dominant. -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Wed Apr 3 10:53:48 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C8577120197 for ; Wed, 3 Apr 2019 10:53:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=ULy8rCFa; dkim=pass (1536-bit key) header.d=taugh.com header.b=uFuEsm/H Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DnAjtfZxvYBc for ; Wed, 3 Apr 2019 10:53:45 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A89A120153 for ; Wed, 3 Apr 2019 10:53:45 -0700 (PDT) Received: (qmail 90489 invoked from network); 3 Apr 2019 17:53:43 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=16176.5ca4f327.k1904; bh=ULECgzyRsD0ypD+P7FV5CUphU7ZsSkABtJSi3IZ6Ews=; b=ULy8rCFa15dHjsQYnEjivLrVexxaBUTOanBnWyTbTIvjcrussBRSvdl03GnuzifkS10x6RUef4bmTNdFgpj9cleO6Avgi6/DkHCziym9pQJpEbW/XSL3CZtnF4CMSE4iG0evsSLP5oCtXkDGTIJ2iNyhRALhZgXIa4Ordv7owbm86OS7VOwjmk/tmxLi/LmM+2KRp0gLPoCvTiUn1ySfcXmWwVItjCJIIeg6FdBBX5OJO9k9o6cnHrQ4XIRjOGvc DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=16176.5ca4f327.k1904; bh=ULECgzyRsD0ypD+P7FV5CUphU7ZsSkABtJSi3IZ6Ews=; b=uFuEsm/HzqaNBisu/jiMNssuXOlY+cHdpu946KXuu2+jPZzxsxEEGB2glILRCkZVjyWG6ajcxEsZ6rYdWQU17bsgr3kQy+OeyMPco/rYYCsIr+UCEIRZLD2MsDykmB24zmjaAsRgICLoJ2Jfonr/0jf6f3GBSRHbPBt4m4PiGkXzvJiNY+10Jztd0ZUq15TUfVWF1DujJ2dXkh2iLU3cd83LFLGoce69g02Y50X1HXaG0GRao5pf9JCuV1gp7Xc2 Received: from ary.qy ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTP via TCP6; 03 Apr 2019 17:53:43 -0000 Received: by ary.qy (Postfix, from userid 501) id D946320115F2E3; Wed, 3 Apr 2019 13:53:42 -0400 (EDT) Date: 3 Apr 2019 13:53:42 -0400 Message-Id: <20190403175342.D946320115F2E3@ary.qy> From: "John Levine" To: bimi@ietf.org Cc: dcrocker@bbiw.net In-Reply-To: <16adbb53-3f6f-f0f6-4e0d-cc77e3abda3f@dcrocker.net> Organization: Taughannock Networks X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 8bit Archived-At: Subject: Re: [Bimi] Laches X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Apr 2019 17:53:47 -0000 In article <16adbb53-3f6f-f0f6-4e0d-cc77e3abda3f@dcrocker.net> you write: >For Bimi, I believe the challenge of making logo use 'validated' at >scale is the primary, critical issue.(*) It seems to me there's two fairly separate issues here. One is creating a system that will validate domain -> logo mappings. The other is at least a plan for how the liability will flow. Unlike DMARC, where the failure mode is spam or phish leaking through that would have leaked without DMARC, with BIMI the failure is one company's trademark shown next to another company's mail or next to a phish, where without BIMI there'd have been no logo at all. As noted in previous messages, trademark law makes it likely that legal threats will ensue. R's, John From nobody Wed Apr 3 11:18:55 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C764120153 for ; Wed, 3 Apr 2019 11:18:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WblcXdncdpJU for ; Wed, 3 Apr 2019 11:18:53 -0700 (PDT) Received: from simon.songbird.com (simon.songbird.com [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5874312010C for ; Wed, 3 Apr 2019 11:18:53 -0700 (PDT) Received: from [192.168.1.85] (108-226-162-63.lightspeed.sntcca.sbcglobal.net [108.226.162.63]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1.1) with ESMTP id x33IKZpv001609 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Wed, 3 Apr 2019 11:20:36 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1554315636; bh=Z40IZXT/DXaV2bQqBmC19mIUTqyEdwWvart5fVxkvxY=; h=Subject:To:References:Reply-To:From:Date:In-Reply-To:From; b=C5OmzHSUXgO3R/eesrA/pOSwCAp9bdpMpR/PKfquthSKNilK3uWKX838vaBa5kNlS +2QovOYDf1rc0L/heU/MbSbBnM4Or56TH3Sfdymy8RU+7mQ8mWLArzwsovA5HD5/o/ 4lxjKo8WrlpjKDnEGiQ0oACrDmL3fnMVRWV3I8IM= To: John Levine , bimi@ietf.org References: <20190403175342.D946320115F2E3@ary.qy> Reply-To: dcrocker@bbiw.net From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <2de302e4-8c23-6879-b2ef-7c485b849d20@dcrocker.net> Date: Wed, 3 Apr 2019 11:18:44 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: <20190403175342.D946320115F2E3@ary.qy> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Bimi] Laches X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Apr 2019 18:18:54 -0000 On 4/3/2019 10:53 AM, John Levine wrote: > It seems to me there's two fairly separate issues here. > > One is creating a system that will validate domain -> logo mappings. > > The other is at least a plan for how the liability will flow. at least 3. In between your two: A usage model that makes sense. That is, details for an operational model that will provide meaningful use of logos, in the face of the basic international AND cross-industry complexities that keep being cited here. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Thu Apr 4 07:22:27 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 58ACC1206B6 for ; Thu, 4 Apr 2019 07:22:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WWdJWHQjsyav for ; Thu, 4 Apr 2019 07:22:24 -0700 (PDT) Received: from mail-vs1-xe31.google.com (mail-vs1-xe31.google.com [IPv6:2607:f8b0:4864:20::e31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4B14F12061B for ; Thu, 4 Apr 2019 07:22:24 -0700 (PDT) Received: by mail-vs1-xe31.google.com with SMTP id s2so1460509vsi.5 for ; Thu, 04 Apr 2019 07:22:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=q2ynEow1rHaHPJKNe4Uqh/wWSw2kd0sNvbkQnotjAwo=; b=E+vwwRVCSq7sOaBaYxYGR5qMDcg6n8oDROnaH1PQARkPZRjKBatQjaVv6s++gWAlJS eXf2wbeo3e86tgBz5mM9yPDBNOn+B34n9OvIuF0qf2p43q5EDltHJ3kDkH8TQn5wu7qX gnbhvPhdsrwKqViSexQli8l0RrPd/6wVo6yP0hZAgDabAxbWl8KQ/xHHNtr/vJ3UK2ab B8/2c30q837K2iVPrgFhBd7cfHAYNGziK1SgkRC6fyPDjqsioVPEimwsWAiO3q9MI9Hz Jkej2KMHXcSvtn631EeLautpQz5I9wE2jVk3LIAR/mJRXqUXRoKE/L2mjxu2R/TsCyba /QnA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=q2ynEow1rHaHPJKNe4Uqh/wWSw2kd0sNvbkQnotjAwo=; b=RZKuyBDgGDeaATpllcKiRXdw2K8B+FjKCGksvQHaxAnXIl+akKP9Z2/JIQ4AZDOdG3 PZusMIbHrxz6d2cwWhXpHy9bwEu2hPEMTzsIyl80cj7N73CiIfUDq1PEl/YDQNeqRZFo Ynkdz5HjUkzep0tsT9Vdv1H0Clpkmej20TCZtmly/BbJ2/OYj+5zDk6af4jbBEo/7pEv R8q8gDQDRA1tuWg8Y2fjBsCxbvkT+eoYh034e7ofWSx3FMwp9LCUHmD39vfMP0EGREmt /dZRa8nWSl8Hf9OGDuNiUgjBw810OUxBHtWNnbFhUaMVV6h96L32KOAvuUN4MCyUjvyG Qraw== X-Gm-Message-State: APjAAAV3HEOgFcMqW4+dR7riwlP0JNxIiICR3UtsY9YpNNImlWpXe3NH QDEUXpwluNDDtTWEZ3eRzAVyhpuH4+z6A4ul92v/5A== X-Google-Smtp-Source: APXvYqyFCfIeuvWAoE4r1s6B9p4ioCveZogU8F1PrexNHbJ1Pp3JwIOhBKGsp1b9UldT3rYqiiyMe/NlGKx4GjvLF9w= X-Received: by 2002:a67:8dc5:: with SMTP id p188mr4167999vsd.52.1554387742772; Thu, 04 Apr 2019 07:22:22 -0700 (PDT) MIME-Version: 1.0 References: <20190402195409.7C6FA201144B7C@ary.qy> <6D3D29C7AE7A951D108A697E@PSB> In-Reply-To: <6D3D29C7AE7A951D108A697E@PSB> From: Wei Chuang Date: Thu, 4 Apr 2019 07:22:04 -0700 Message-ID: To: John C Klensin Cc: John Levine , bimi@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000004b54270585b519d5" Archived-At: Subject: Re: [Bimi] Today's BoF X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Apr 2019 14:22:26 -0000 --0000000000004b54270585b519d5 Content-Type: multipart/alternative; boundary="00000000000040ce700585b519ae" --00000000000040ce700585b519ae Content-Type: text/plain; charset="UTF-8" *From: *John C Klensin *Date: *Tue, Apr 2, 2019 at 2:03 PM *To: *John Levine *Cc: * > > --On Tuesday, April 2, 2019 15:54 -0400 John Levine > wrote: > > > ... > > > I > > gather that one of the gorillas accidentally made this mistake > > in their informal logo collection system and a motivation for > > bimi is to keep it from happening again. > > If one conbines that sentence with the "Nobody is assuming..." > one above, then a motivation for bimi is to cure (or prevent) > stupidity. Perhaps it will work this time, but the track record > of other efforts to apply such cures has not been good. > > > Of course this returns us to the major question of whether it's > > possible to invent an effective system to check bimi > > applications. I could invent one that involved a staff of > > trademark lawyers, but I don't think anyone outside the S&P > > 500 would find that usable. > > Indeed. > Agreed that VMC will have a significant coverage limitation since its uses registered trademarks that enables 3rd party verification. Its one that we're trying to figure out how to expand and we're very much asking for your help and for your ideas to expand that coverage. VMC and its 3rd party verification system is just one approach, and is a starting point for BIMI because we think is feasible to do in the near term, but we agree its not a complete solution. I should point out and has been alluded to in the above thread, that BIMI also allows naked logos (meaning non-third party verifed) to be identified by hash and fetched. This depends even more heavily on reputation systems to use safely but it may allow much more of the use cases identified in the overview draft 5.3-5.11. https://tools.ietf.org/html/draft-bkl-bimi-overview-00 The theory for its usage is very much like the favicon approach on the web, and yes this approach will run headlong into all the issues you pointed out. The choice of its usage is up to the receiver that is interested in that flexibility and okay with the risk. Along the notion of exanding coverage, I just also wanted to point out 3rd pary verification can work so long as what it tests is objective. It might not have to involve marks. For example I would imagine a sender might be associated with a place or person, and a photos of that places or person could be reasonably verified. Anyways we are looking for ideas to expand coverage. -Wei --00000000000040ce700585b519ae Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
From: John C Klensin= <john-ietf@jck.c= om>
Date: Tue, Apr 2, 2019 at 2:03 PM
= To: John Levine
Cc: <bimi@ietf.org>



--On Tuesday, April 2, 2019 15:54 -0400 John Levine
<johnl@taugh.com> wrote:



>=C2=A0 I
> gather that one of the gorillas accidentally made this mistake
> in their informal logo collection system and a motivation for
> bimi is to keep it from happening again.

If one conbines that sentence with the "Nobody is assuming..." one above, then a motivation for bimi is to cure (or prevent)
stupidity.=C2=A0 Perhaps it will work this time, but the track record
of other efforts to apply such cures has not been good.

> Of course this returns us to the major question of whether it's > possible to invent an effective system to check bimi
> applications.=C2=A0 I could invent one that involved a staff of
> trademark lawyers, but I don't think anyone outside the S&P > 500 would find that usable.

Indeed.


https:/= /tools.ietf.org/html/draft-bkl-bimi-overview-00
The theor= y for its usage is very much like the favicon approach on the web, and yes = this approach will run headlong into all the issues you pointed out.=C2=A0 = The choice of its usage is up to the receiver that is interested in that fl= exibility and okay with the risk.

Along the notion= of exanding coverage, I just also wanted to point out 3rd pary verificatio= n can work so long as what it tests is objective.=C2=A0 It might not have t= o involve marks.=C2=A0 For example I would imagine a sender might be associ= ated with a place or person, and a photos of that places or person could be= reasonably verified.=C2=A0 =C2=A0Anyways we are looking for ideas to expan= d coverage.=C2=A0=C2=A0

-Wei
--00000000000040ce700585b519ae-- --0000000000004b54270585b519d5 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMWMqzbpn2SydMzpfaMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE4MTExNTE4NDMwM1oXDTE5MDUx NDE4NDMwM1owIjEgMB4GCSqGSIb3DQEJAQwRd2VpaGF3QGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQDOGIfi32h8dhJEeUGHfN1nAVrJsY4ph3nisYgnB2pOA4hcNkX4 xnnbD7PDr6G2S6LqYfXegzUkLT7FoOGtptBAixwpSxBUvEWQdrlbYdYuoNK7/DBASrlp4J7UocGX ZS5dkWL0IolToc52mCmOxhTqDjbD9MG3+AvyyQPK0RVgNY5n7BZBdNZDHTeswReAtjQ4t+b1IStQ 7Y59jxTOfDPpAT2Y0ON44Lx2hBLyQ8wXYCmHHbWCyGT3xZH0p8p+cGgkKvDjaxBX3ilopH8hx4zm 5HVh6wDOBHhAnRYVU1bqmjohWNuLhz/Za6lWGiylhPD+2yFLQfvHn6OBE0a/048NAgMBAAGjggFu MIIBajAcBgNVHREEFTATgRF3ZWloYXdAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFJUPLExeOaBiYyZVRuorZTtplIumMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQBuvV1bxPXhqWWCHYz7 40fvnmDIUsNiLecW3PCDQxdpPMc3V/6T31qSKYvuFigtj2MpXMCkLqbHupVN3b14UvnqNx3jnu7b Yp+rMcjjO70W3ufBqqz/QQzSykR9ATo+Zqs09dhJtTl02ApUqYipoInGx8wu0ChTI84NwR5UUo7H GSOet+Eluj5Yjq0YdM2qzfapP/XbfO7t533yiK5Cs//IlaQagdizrM/b1DTYjJ/28b3uPMS3l6a8 BoWm7kiV6GCY7zBNF9D6Gkf6U4dZgx6SwQjQoG3mSBV1zzIs0cZYoVvq/8y+5jC9CdH1ran/ahb6 1ZtMG4auBaKMRzEe3TimMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMWMqzbpn2 SydMzpfaMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCAlTLMdHRrrADy02xbBU4NU c1EtJO5ZiqjE/LMZnhQTcTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA0MDQxNDIyMjNaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAUsGKKrmrnid8QIfAve50lFPernPMwtRWXy34SldB 5QSUdrSfClXegNdn4lzpIJ3RpqbyQVAVwf8Yy8EYOvOrnYV4anMrbeEfSf52bBvUjyZFW9FbmNwQ wp76lsyL0e4z+jsClHqLMpglcfMFR8RASmI1UdIRxu7Z/NayLIa5zcH7vnAFIZemGCOtusOf4Lza F/dGpF/JAD4F92nwVVLz4UKvYqK04zh6lpNM6bX2gwWNi6op8a7GBfGz15toOb1Q/qR5aBqrpcQC BoAJsUoIC4b3qjUk9RwR7DCQaS8MW7Hu1sJDgh9G0AaKLBYlrHEobWuPcNJqCppS4FxZ/slbHA== --0000000000004b54270585b519d5-- From nobody Wed Apr 10 09:10:42 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C2FF81200B1 for ; Wed, 10 Apr 2019 09:10:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TR90WOHslty4 for ; Wed, 10 Apr 2019 09:10:39 -0700 (PDT) Received: from simon.songbird.com (simon.songbird.com [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4EB841203B7 for ; Wed, 10 Apr 2019 09:10:39 -0700 (PDT) Received: from [192.168.1.85] (108-226-162-63.lightspeed.sntcca.sbcglobal.net [108.226.162.63]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1.1) with ESMTP id x3AGCPeX019544 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for ; Wed, 10 Apr 2019 09:12:25 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1554912745; bh=3A4zeZk1HUKEU92/27J7KFCwzx9HxmX6vmVqImwI1ho=; h=To:Reply-To:From:Subject:Date:From; b=LyC5JKfXjOPcrS3EGSSGsJqY/z7V25JuKl2XL51e6/CxDPhdnkP/fwVzeKZT2ZLH4 0p9V8DZ+/Ok6SUTAyjECWz/mjg2dhz4KsMgngB9EN+Ovmusko1lmYVMgVsAuVWGquA v7bIxw/YFjw+BGFTgnph712GqxkTvQbOhq/YsxpA= To: "bimi@ietf.org" Reply-To: dcrocker@bbiw.net From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <54c335ec-d4a7-d842-1d72-af5a5ec8df43@dcrocker.net> Date: Wed, 10 Apr 2019 09:10:31 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: [Bimi] Logo/Trademark conflict X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Apr 2019 16:10:41 -0000 Relative to the general topic of international trademarks, conflicts for domain names are pretty simple. And yet this isn't that unusual or even unexpected: ICANN takes the reins again as .amazon talks fail http://domainincite.com/24133-icann-takes-the-reins-again-as-amazon-talks-fail?fbclid=IwAR1klnGGJtlFSdbE_OvNLUCSgD_uuhKGttRaKcsRzF7pwC7nQaN1dn8SAjM When the design of Bimi can deal with resolving this sort of problem, it will be reasonable to consider it more substantially. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Wed Apr 10 09:21:21 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FBDA1203D3 for ; Wed, 10 Apr 2019 09:21:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=valimail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kM30b47ZDqjG for ; Wed, 10 Apr 2019 09:21:02 -0700 (PDT) Received: from mail-wr1-x433.google.com (mail-wr1-x433.google.com [IPv6:2a00:1450:4864:20::433]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7EA0F1203CE for ; Wed, 10 Apr 2019 09:21:02 -0700 (PDT) Received: by mail-wr1-x433.google.com with SMTP id t17so3640224wrw.13 for ; Wed, 10 Apr 2019 09:21:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=valimail.com; s=google2048; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=IR3fZHt4XZb9ObDVtNGInxEQldmd4Q1DiuUnqB4k7D8=; b=RlVfTybQ9qZiHH7v8hyWBe6qvy94Y2I8CHc/4j/XpWnIi2lrcC0bsyIi/ZE+/WwPS8 tvI+EydIPTApxHSPQMlzIPO/mWIn8X7Y5ad2pTxQHpm/dm+RZ2OxLjgApCxGj12f6WD+ dpy9Qi/ReGCE0UvRwYNDNEibAhjmK9b93NeB2tyIjJr6SYU6nW1b1MgRktcqkHwwL0W3 v1lJQwDDpj0gjI3fgbZUvhlLEGISXhtO7sp+4IxB55MB7Oy1pPAXdep9Xf1ms9nEsGRR wm5BehfxypbEPZ+vcanHI7jgmaZkvCNznnRCS7bNm6BKn72wz2wzBPIo9Uuv9Ya8KhOs FbKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=IR3fZHt4XZb9ObDVtNGInxEQldmd4Q1DiuUnqB4k7D8=; b=kx+DAh4nfw53MLDQhR00amN0ft+Ipf+JcdeIA4E6huZTmRmagKuMkM+IKa3D9FsSer RjVfEYKZhy0I3bskTS6oTWFgHlj11W+m+YUUR9LCUGoDBPlk5+gs3iAfp27I8lNnsuId J81IH3K6hAfE8mp2K1iG8EnBp9kK5Dr0a08tJqqC6R0fKshERah1JK+Hn/TSIQW97hwp pMxzSEdy3Fif7cYMmDZzySy7Do7ZkuuwmTivy6VRJVJhVeRNiZbA+otRd0LFoOdElu+X zPkv1pH+s6aACIY+Tfm5AcNfZy4AD12xG6nU/Pw2zxRDrxelz+QG1NncLSlQ3/QjCRuw 3BFw== X-Gm-Message-State: APjAAAWFwm+kOYWw+WTfWFWBkUtMfSTHws8bexOc1TapTq/nTu1ZJquZ hCQhja1/ds8BEwJcT6YUmGBW6mfbboH0J9jDSmYuTpHAtZ0= X-Google-Smtp-Source: APXvYqyfXkjXo8vQ2PRXeOOT419+9AtDCzkEkp/JjPxEolerWFIYErTbDXZAIKYDSyhC1TrHAi494WZdZFx0l7yTyQY= X-Received: by 2002:a5d:6646:: with SMTP id f6mr5753391wrw.68.1554913260732; Wed, 10 Apr 2019 09:21:00 -0700 (PDT) MIME-Version: 1.0 References: <54c335ec-d4a7-d842-1d72-af5a5ec8df43@dcrocker.net> In-Reply-To: <54c335ec-d4a7-d842-1d72-af5a5ec8df43@dcrocker.net> From: Seth Blank Date: Wed, 10 Apr 2019 18:20:49 +0200 Message-ID: To: "bimi@ietf.org" Content-Type: multipart/alternative; boundary="000000000000901fe005862f7495" Archived-At: Subject: Re: [Bimi] Logo/Trademark conflict X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Apr 2019 16:21:08 -0000 --000000000000901fe005862f7495 Content-Type: text/plain; charset="UTF-8" On Wed, Apr 10, 2019 at 6:10 PM Dave Crocker wrote: > When the design of Bimi can deal with resolving this sort of problem, it > will be reasonable to consider it more substantially. > You could say the same thing about DNS or gTLD registrations. Legal conflicts like this are outside the scope of what an interoperability spec can reasonably address. No? Seth --000000000000901fe005862f7495 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Apr 10, 2019 at 6:10 PM Dave Croc= ker <dhc@dcrocker.net> wrote:=
When the design of Bimi can deal with resolving this sort of pr= oblem, it
will be reasonable to consider it more substantially.

You could say the same thing about DNS or gTLD registr= ations. Legal conflicts like this are outside the scope of what an interope= rability spec can reasonably address. No?

Seth
--000000000000901fe005862f7495-- From nobody Wed Apr 10 09:26:30 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4924A1203BA for ; Wed, 10 Apr 2019 09:26:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P1uTrwlEdDxh for ; Wed, 10 Apr 2019 09:26:27 -0700 (PDT) Received: from simon.songbird.com (simon.songbird.com [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F6B51200B1 for ; Wed, 10 Apr 2019 09:26:27 -0700 (PDT) Received: from [192.168.1.85] (108-226-162-63.lightspeed.sntcca.sbcglobal.net [108.226.162.63]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1.1) with ESMTP id x3AGSDTP020938 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for ; Wed, 10 Apr 2019 09:28:13 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1554913693; bh=dYP4BQeBK9bqORNsNF4A5I/22gB2Xvt+on5UG+AnfSE=; h=Subject:To:References:Reply-To:From:Date:In-Reply-To:From; b=Tq+MWSVtwcwA5+JnS9pXbbJw8CmORYeyBewqyEgiQ1+oU60eHu4ONCtWw2+7yitrC Q7M3h5NvgCmbQicv8VaN1cAL3d0VOaZrIaV9Quy92fHzKFvyyeVWR4uHfDBIqZyDd5 LWI+lFghnFX8Cx9KUCUqKzIY+yEI6m4x2zVXQOMw= To: bimi@ietf.org References: <54c335ec-d4a7-d842-1d72-af5a5ec8df43@dcrocker.net> Reply-To: dcrocker@bbiw.net From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <5f5663ae-149b-59f8-efd7-42864f6643d9@dcrocker.net> Date: Wed, 10 Apr 2019 09:26:19 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Bimi] Logo/Trademark conflict X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Apr 2019 16:26:28 -0000 On 4/10/2019 9:20 AM, Seth Blank wrote: > On Wed, Apr 10, 2019 at 6:10 PM Dave Crocker > wrote: > > When the design of Bimi can deal with resolving this sort of > problem, it > will be reasonable to consider it more substantially. > > > You could say the same thing about DNS or gTLD registrations. Legal > conflicts like this are outside the scope of what an interoperability > spec can reasonably address. No? If there is no viable operational framework for a technical standard, then producing the standard is a study in -- at best -- futility or -- more likely -- a rich array of deception and significant damage. This barrier to Bimi's working at scale has been noted constantly since the first Bimi talks. Nothing about that barrier has changed. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Wed Apr 10 09:31:16 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BAA581203BB for ; Wed, 10 Apr 2019 09:31:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.989 X-Spam-Level: X-Spam-Status: No, score=-1.989 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=valimail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Qw-9DCzt4BR3 for ; Wed, 10 Apr 2019 09:31:11 -0700 (PDT) Received: from mail-wm1-x336.google.com (mail-wm1-x336.google.com [IPv6:2a00:1450:4864:20::336]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 740D91203D8 for ; Wed, 10 Apr 2019 09:31:09 -0700 (PDT) Received: by mail-wm1-x336.google.com with SMTP id q16so3322368wmj.3 for ; Wed, 10 Apr 2019 09:31:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=valimail.com; s=google2048; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=uKWwqbvW40Yi5Tu/hC/Mz//plyTI1NzGr696dYPKgZA=; b=f6hlNcWozLQCjTprVXqHz8v0rF0+dikLk4LrODSP9Jov+KH4wHhbmEtqoc9SnJUERw jSP+3nFueYSKGqdSanRpOpdkMVTZ9LMLMU9ZL6w/ca0hPjboQUBGZ+o2mHcwIC27SnnM uckfoVe1vEWNDXoGZQMjFiOG/1ZY2ICj5E6v/GqMXDj8/KvwXZLu5CN9eMQbB2aubBsL Yoa58ckJb2/tzmsNWRls4H2nsjv02ma/qKURiHXBdRZNcTQfonMRHJWhFVJ4ey1dXZ3F qzfITIBD4xePaXlPPf0L6be8jo6Tn1/LhrDc5fgRQWAqYkjO2ty4s6WhbKxjY+zOCE1Y x8iA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=uKWwqbvW40Yi5Tu/hC/Mz//plyTI1NzGr696dYPKgZA=; b=ZvkohY0vPhh1Je7/t+D9dC7sRwOAGdQLAucex6ILhO5UPQgkWGj32qi0zTLWF26Fj+ 3eCo3q0nixoR7VEJY54u+EwZvCDcC8pRPy5pXKoysqpRvYdy2j0UjM2L+tjxwcb5i6KV u7rP5NcvcQwOyKuEE7O7TsUT0xzxsshe46cvWhceuWfEuxLK0qxW3Eteip5opXRm3qLV qQBEbwyIbxiJl9bQjB20B3xW+fbO+Cod6/IzvmI74GDewvXE0Vl46p9GkJ+emeL8AOFS 7JHLGpq8XtG10YthHSEeR+qzaulDTBoEPpC162IurLopon6olZhVCsUnh/3sVLSPhUQN V81g== X-Gm-Message-State: APjAAAV9v0222huurcDtnTlViARNpOxC2J/BPdLuQKn7r/khKkg6HhHX gBzkArnZQuTKqLINm1xhv58cZQbUvkhMeFerGxZQmgZMJ8c= X-Google-Smtp-Source: APXvYqzS/V3kl4KwZ2RhwoQppW62Qo4romI6B25UCuTY1dt860yv17WV0pkylieyoKsWA2zEJzuxWiuOEOuLUHqPv7o= X-Received: by 2002:a1c:9ec7:: with SMTP id h190mr3604181wme.105.1554913867828; Wed, 10 Apr 2019 09:31:07 -0700 (PDT) MIME-Version: 1.0 References: <54c335ec-d4a7-d842-1d72-af5a5ec8df43@dcrocker.net> <5f5663ae-149b-59f8-efd7-42864f6643d9@dcrocker.net> In-Reply-To: <5f5663ae-149b-59f8-efd7-42864f6643d9@dcrocker.net> From: Seth Blank Date: Wed, 10 Apr 2019 18:30:56 +0200 Message-ID: To: Dave Crocker Cc: bimi@ietf.org Content-Type: multipart/alternative; boundary="000000000000bfb30005862f981b" Archived-At: Subject: Re: [Bimi] Logo/Trademark conflict X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Apr 2019 16:31:15 -0000 --000000000000bfb30005862f981b Content-Type: text/plain; charset="UTF-8" On Wed, Apr 10, 2019 at 6:26 PM Dave Crocker wrote: > This barrier to Bimi's working at scale has been noted constantly since > the first Bimi talks. Nothing about that barrier has changed. > We went through these issues in detail at the BoF and discussed our starting point for addressing them, which we agree doesn't cover use cases at scale. Your example from this thread is similar to the Stripe of Delaware vs Stripe of Kentucky attack we discussed, but without any intent to deceive. What is your suggestion for addressing these issues? -- Seth Blank | Director, Industry Initiatives e: seth@valimail.com |* p: *415-273-8818 This email and all data transmitted with it contains confidential and/or proprietary information intended solely for the use of individual(s) authorized to receive it. If you are not an intended and authorized recipient you are hereby notified any use, disclosure, copying or distribution of the information included in this transmission is prohibited and may be unlawful. Please immediately notify the sender by replying to this email and then delete it from your system. --000000000000bfb30005862f981b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Apr 10, 2019 at 6:26 PM Dave Croc= ker <dhc@dcrocker.net> wrote:=
This barrier to Bimi's working at scale has been noted cons= tantly since
the first Bimi talks.=C2=A0 Nothing about that barrier has changed.

We went through these issues in detail at= the BoF and discussed our starting point for addressing them, which we agr= ee doesn't cover use cases at scale. Your example from this thread is s= imilar to the Stripe of Delaware vs Stripe of Kentucky attack we discussed,= but without any intent to deceive. What is your suggestion for addressing = these issues?

--

Seth Blank | Director, Industry Initiatives

e: seth@valimail.com | p: 415-273-8818


<= img src=3D"https://lh3.googleusercontent.com/Fs0IGUDYKDnLamPnOtinsZthjYzXZL= lIec2y0x-YjA_Y1gkfjPpKWhfIv_f0Z371y40HXG8TsYMrdAzkobZtxcDSUJlLWLKez83JE-dNJ= tTKJaBKWZvlv7YpGSTcztXfxovSzddf" style=3D"border: none; width: 23px; height= : 23px;">

This email and all data transmitted with it contains confidenti= al and/or proprietary information intended solely for the use of individual= (s) authorized to receive it.=C2=A0=C2= =A0If you are not an intended and autho= rized recipient you are hereby notified any use, disclosure, copying or dis= tribution of the information included in this transmission is prohibited an= d may be unlawful.=C2=A0=C2=A0Please immediately notify the sender by replying= to this email and then delete it from your system.

--000000000000bfb30005862f981b-- From nobody Wed Apr 10 12:00:38 2019 Return-Path: X-Original-To: bimi@ietfa.amsl.com Delivered-To: bimi@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5ACC412041E for ; Wed, 10 Apr 2019 12:00:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5Tu2vl-F6pkz for ; Wed, 10 Apr 2019 12:00:27 -0700 (PDT) Received: from simon.songbird.com (simon.songbird.com [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 087611205FF for ; Wed, 10 Apr 2019 12:00:27 -0700 (PDT) Received: from [192.168.1.85] (108-226-162-63.lightspeed.sntcca.sbcglobal.net [108.226.162.63]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1.1) with ESMTP id x3AJ2Cla002213 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Wed, 10 Apr 2019 12:02:12 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1554922932; bh=mn3x+exf2TxhEv91MC1CbSg+vjsI0zn5L0NapbpzRXw=; h=Subject:To:Cc:References:Reply-To:From:Date:In-Reply-To:From; b=l1VYtcYx1dw+wr2F9m+EwRCEOxSu59EXz6LV9e0z96KzIdn+w/Romtl7iIr+9s2P8 KR6isvIH48PVN1kvOm6zw2ZL9NAwGCVIHPpc3A5BuduvpBuHsc4CzIymy8iW+cHdG3 3dSw/0uqKtO2ivYQOBVvzCSplNw4+ajrjANWw2HA= To: Seth Blank Cc: bimi@ietf.org References: <54c335ec-d4a7-d842-1d72-af5a5ec8df43@dcrocker.net> <5f5663ae-149b-59f8-efd7-42864f6643d9@dcrocker.net> Reply-To: dcrocker@bbiw.net From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <5b941325-70fe-efbf-2357-3c2f8b668f01@dcrocker.net> Date: Wed, 10 Apr 2019 12:00:17 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Bimi] Logo/Trademark conflict X-BeenThere: bimi@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Brand Indicators for Message Identification List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Apr 2019 19:00:36 -0000 On 4/10/2019 9:30 AM, Seth Blank wrote: > We went through these issues in detail at the BoF and discussed our > starting point for addressing them, which we agree doesn't cover use > cases at scale. IMO, unless and until there are use cases for this working at scale, the effort won't work at scale. It might not work then, either, but this at least is a foundational requirement for serious discussions. > What is your suggestion for addressing these issues? Besides advising that there be serious discussions that start with a robust characterization of the problem space for working at scale, I've no idea how to 'solve' this. Given at least 120 years of discussion in this space, it's unlikely anyone else does, either. Problems with such discouraging histories sometimes do get solved. But never by ignoring the challenges they post. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net