5 ms·

FWIW, there's also BIMI[1], an industry standard that attempts to increase the wide adoption of email authentication with brand-specific indicators[2] next to p

FWIW, there's also BIMI[1], an industry standard that attempts to increase the wide adoption of email authentication with brand-specific indicators[2] next to properly authenticated messages & requires senders to publish these SPF, DKIM, and DMARC records. [1] https://tools.ietf.org/id/draft-blank-ietf-bimi-00.html https://tools.ietf.org/id/draft-blank-ietf-bimi-00.html [2] https://news.ycombinator.com/item?id=28160019 https://news.ycombinator.com/item?id=28160019

aj3 5y ago
That’s a very controversial standard as it can be abused for tracking and does not really protect end users from spoofing.
- teddyh 5y ago
  Controversial and technically dubious. The whole premise of the BIMI standard hinges on the adoption of X.509 certificate authorities which will issue certificates (called “VMC”) for a graphical logotype. However, the laws regarding trademarks are restricted in many scopes; legal juristictions and business area (trademark “class”), to name a couple. No VMC issuer could really do anything sensible with similar trademarks which are registered by multiple entities in different juristictions and/or different business areas. The best-case scenario is that huge players like FAANG, CNN, etc. get VMC certificates and the rest of us get nothing. Which is, I guess, why the big players are toying with the idea and are, slowly, tentatively, pushing for it.
  - Thoughtful 5y ago
    and financially scandalous
    - jiggawatts 5y ago
      Thousands and thousands of dollars for a BIMI certificate is just ludicrous. Certificates are certificates are certificates. They're 1KB files full of random numbers. What you use them for shouldn't alter their price... which ought to be zero. The facts that a handful of near-monopolistic CAs have managed to control protocols, set standards, and generally funnel money into their coffers that need not have been spent at all is one of the worst examples of naked capitalistic greed I have ever seen. Rent seeking, pure and simple.
      - teddyh 5y ago
        From what I can see, it is the very same CAs who used to peddle normal certificates (and are currently mostly failing to sell EV certificates) who are now desperately trying to save their business by pivoting to convince businesses that VMC certificates are the new big thing.
      - LeonM 5y ago
        Your view is very, very naive. > Thousands and thousands of dollars for a BIMI certificate is just ludicrous. VMCs are between 800 and 1500 USD > Certificates are certificates are certificates. The x509 certificate is, but the process to verify your ownership of the supplied 'mark' (your logo) is not. The VMC issuing procedure is very involved, it requires the CA to confirm with your local trademark office that your company owns the trademark. For VMC the CA is also required to verify (by phone) that the person who requested the VMC does indeed work for the company, they are also required to verify that the person who requested to certificate is allowed by the organization to do so. The CAs are actually doing work here, there are real costs. FWIW: Digicert currently sells VMC for a discounted price of 800USD, which they claim is not even economically viable. Without the discount expect VMCs to be ~1500USD.
        teddyh 5y ago
        People have already paid for an actual trademark. Why should they pay again, to a private company? Your argument is essentially identical to the arguments usually made to explain why EV certificates are expensive, and nobody is buying those.
        zyx321 5y ago
        Verifying that an SVG image is 100%identical (with zero room for interpretation) to a picture in a public database (available online free of charge)? And then clicking 'renew' once per year? How could you possibly charge less than a thousand dollars for that...
        LeonM 5y ago
        No public database with all trademarks exists. And even if it does: who is going to maintain that public database? And how would you be able to trust said database? How will you proof that you really are the legal owner of the logo in that database? Again, the 'renew' click is not why this is expensive. It's just a cryptographic function that signs a bunch of data, Lets Encrypt has long proven that certificates can be created free-of-charge. However, having a human verifying that everything checks out is the expensive part. Having that human work in an environment, following procedures that passes public audits is expensive. None of the trademark offices is going to do your trademark validations for free. No-one is going to staff a call-centre for free. You are right about the technical part of creating a certificate being trivially easy, but I believe you truly underestimate the costs of running a CA that is capable of delivering VMCs. Maybe that some company can do it for less than the current prices, I don't know. Competition will show that eventually. But if you truly think that you can do it for less than the current CAs, then start a CA yourself and start competing.
LeonM 5y ago
At Mailhardener we built a BIMI validator tool [0], we also work with the AuthIndicators Working Group (the authors of the BIMI standard) to refine the standard. Please be aware that the BIMI standard is far from finished. There are some serious documentation ambiguities that pose a risk to how well BIMI might function, and how email providers will adopt the technology. Obviously, the CAs are now pushing hard for BIMI, since VMCs are a new source of recurring business for them. In my personal opinion I think that BIMI is pushed to early, which could leave brands attempting to adopt BIMI disappointed. Obtaining a VMC is quite involved (and expensive) for small businesses, and the potential benefits are (currently) quite small, as not many email service providers support BIMI. Don't get me wrong though, I think BIMI has a great goal of pushing the DMARC adoption rate (remember, you must implement strict DMARC for BIMI to work). I just don't see BIMI offering any reliable brand exposure for the coming years. Only time will tell I guess. [0] https://www.mailhardener.com/tools/bimi-validator https://www.mailhardener.com/tools/bimi-validator
raxxorrax 5y ago
The IETF contains some really questionable propositions lately, not sure what to make of this, but it doesn't seem to solve a problem. What does this provide in contrast to DKIM? Perhaps there are logistical problems with DKIM, but I wouldn't know. I wonder why it isn't more widely spread in the first place. The receiver can determine the requirement, which is the best solution imho. For Google it seems to be more of a marketing issue than security. Furthermore provider could track domain requests. That isn't just suspicious, this is almost malicious. There is a reason mail clients don't display pictures outright. I hope my mail client will never support this.
wila 5y ago
BIMI is really cool. I played with it, setup the appropriate DNS records, created an SVG logo and ... well that's about where it stopped as registering a trademark is a bit of a step too far for getting all of this to work. It does pass the checks though [1], but does not really work because of the missing certificate which you can for example get at DigiCert [2] once your trademark has been approved.. The domains I configured it for are: antwise.com and vimalin.com so you can see at [1] how it looks like when it is supposed to work. [1] https://bimigroup.org/bimi-generator/ https://bimigroup.org/bimi-generator/ [2] https://www.digicert.com/tls-ssl/verified-mark-certificates https://www.digicert.com/tls-ssl/verified-mark-certificates

aj3 5y ago

That’s a very controversial standard as it can be abused for tracking and does not really protect end users from spoofing.

teddyh 5y ago
Controversial and technically dubious. The whole premise of the BIMI standard hinges on the adoption of X.509 certificate authorities which will issue certificates (called “VMC”) for a graphical logotype. However, the laws regarding trademarks are restricted in many scopes; legal juristictions and business area (trademark “class”), to name a couple. No VMC issuer could really do anything sensible with similar trademarks which are registered by multiple entities in different juristictions and/or different business areas. The best-case scenario is that huge players like FAANG, CNN, etc. get VMC certificates and the rest of us get nothing. Which is, I guess, why the big players are toying with the idea and are, slowly, tentatively, pushing for it.
- Thoughtful 5y ago
  and financially scandalous
  - jiggawatts 5y ago
    Thousands and thousands of dollars for a BIMI certificate is just ludicrous. Certificates are certificates are certificates. They're 1KB files full of random numbers. What you use them for shouldn't alter their price... which ought to be zero. The facts that a handful of near-monopolistic CAs have managed to control protocols, set standards, and generally funnel money into their coffers that need not have been spent at all is one of the worst examples of naked capitalistic greed I have ever seen. Rent seeking, pure and simple.
    - teddyh 5y ago
      From what I can see, it is the very same CAs who used to peddle normal certificates (and are currently mostly failing to sell EV certificates) who are now desperately trying to save their business by pivoting to convince businesses that VMC certificates are the new big thing.
    - LeonM 5y ago
      Your view is very, very naive. > Thousands and thousands of dollars for a BIMI certificate is just ludicrous. VMCs are between 800 and 1500 USD > Certificates are certificates are certificates. The x509 certificate is, but the process to verify your ownership of the supplied 'mark' (your logo) is not. The VMC issuing procedure is very involved, it requires the CA to confirm with your local trademark office that your company owns the trademark. For VMC the CA is also required to verify (by phone) that the person who requested the VMC does indeed work for the company, they are also required to verify that the person who requested to certificate is allowed by the organization to do so. The CAs are actually doing work here, there are real costs. FWIW: Digicert currently sells VMC for a discounted price of 800USD, which they claim is not even economically viable. Without the discount expect VMCs to be ~1500USD.
      - teddyh 5y ago
        People have already paid for an actual trademark. Why should they pay again, to a private company? Your argument is essentially identical to the arguments usually made to explain why EV certificates are expensive, and nobody is buying those.
      - zyx321 5y ago
        Verifying that an SVG image is 100%identical (with zero room for interpretation) to a picture in a public database (available online free of charge)? And then clicking 'renew' once per year? How could you possibly charge less than a thousand dollars for that...
        LeonM 5y ago
        No public database with all trademarks exists. And even if it does: who is going to maintain that public database? And how would you be able to trust said database? How will you proof that you really are the legal owner of the logo in that database? Again, the 'renew' click is not why this is expensive. It's just a cryptographic function that signs a bunch of data, Lets Encrypt has long proven that certificates can be created free-of-charge. However, having a human verifying that everything checks out is the expensive part. Having that human work in an environment, following procedures that passes public audits is expensive. None of the trademark offices is going to do your trademark validations for free. No-one is going to staff a call-centre for free. You are right about the technical part of creating a certificate being trivially easy, but I believe you truly underestimate the costs of running a CA that is capable of delivering VMCs. Maybe that some company can do it for less than the current prices, I don't know. Competition will show that eventually. But if you truly think that you can do it for less than the current CAs, then start a CA yourself and start competing.

LeonM 5y ago

At Mailhardener we built a BIMI validator tool [0], we also work with the AuthIndicators Working Group (the authors of the BIMI standard) to refine the standard. Please be aware that the BIMI standard is far from finished. There are some serious documentation ambiguities that pose a risk to how well BIMI might function, and how email providers will adopt the technology. Obviously, the CAs are now pushing hard for BIMI, since VMCs are a new source of recurring business for them. In my personal opinion I think that BIMI is pushed to early, which could leave brands attempting to adopt BIMI disappointed. Obtaining a VMC is quite involved (and expensive) for small businesses, and the potential benefits are (currently) quite small, as not many email service providers support BIMI. Don't get me wrong though, I think BIMI has a great goal of pushing the DMARC adoption rate (remember, you must implement strict DMARC for BIMI to work). I just don't see BIMI offering any reliable brand exposure for the coming years. Only time will tell I guess. [0] https://www.mailhardener.com/tools/bimi-validator https://www.mailhardener.com/tools/bimi-validator

raxxorrax 5y ago

The IETF contains some really questionable propositions lately, not sure what to make of this, but it doesn't seem to solve a problem. What does this provide in contrast to DKIM? Perhaps there are logistical problems with DKIM, but I wouldn't know. I wonder why it isn't more widely spread in the first place. The receiver can determine the requirement, which is the best solution imho. For Google it seems to be more of a marketing issue than security. Furthermore provider could track domain requests. That isn't just suspicious, this is almost malicious. There is a reason mail clients don't display pictures outright. I hope my mail client will never support this.

wila 5y ago

BIMI is really cool. I played with it, setup the appropriate DNS records, created an SVG logo and ... well that's about where it stopped as registering a trademark is a bit of a step too far for getting all of this to work. It does pass the checks though [1], but does not really work because of the missing certificate which you can for example get at DigiCert [2] once your trademark has been approved.. The domains I configured it for are: antwise.com and vimalin.com so you can see at [1] how it looks like when it is supposed to work. [1] https://bimigroup.org/bimi-generator/ https://bimigroup.org/bimi-generator/ [2] https://www.digicert.com/tls-ssl/verified-mark-certificates https://www.digicert.com/tls-ssl/verified-mark-certificates