4 ms·

Gmail is adding a blue checkmark to better verify senders

34 points by thm 3y ago

mtmail 3y ago
For the checkmark (BIMI) a company need to get certified. That costs about 1500 USD/year (https://store.entrust.com/default/vmc.html https://store.entrust.com/default/vmc.html). Startup founders, if you listen to this: create a cheaper alternative.
- JeremyBanks 3y ago
  [dead]
- kyawzazaw 3y ago
  For an commercial entity that cares enough to have that blue mark, $1500/yr is barely a drop in a ‘tank’, not even bucket
  - iudqnolq 3y ago
    There's also a nasty adverse selection problem. Your initial customers will be naive tiny companies and scammers. (Let's not even get into the viability of business models based on convincing Google, Microsoft, and Thunderbird to implement a feature so that you can sell it)
jmclnx 3y ago
gmail should allow us to easily use gnupg in our own email client, checkmark, who cares :) I use to be able to access gmail via mitt, but the forced a change that was too much for me so I bailed.
deleted 3y ago
[deleted]
LeonM 3y ago
See also: https://news.ycombinator.com/item?id=35804599 https://news.ycombinator.com/item?id=35804599 I'll post my comment from the other thread here as wel: For BIMI to work, you need a Verified Mark Certificate (VMC). This is a x.509 certificate, but with additional extensions enabled. Most notably the 'pe-logotype' (OID 1.3.6.1.5.5.7.1.12) extension, which embeds an SVG file of your 'mark' (most likely your logo) into the certificate. The VMC proofs that your domain (the part after the '@' in the sender email address) is in fact the legal owner of the mark (the logo) that you are using. Otherwise any sender could use the logo of a bank. A VMC is like an EV certificate on steroids, because there are a lot of things the CA must verify before issuing the certificate. The CA must verify that you own the 'mark' (the logo), and in order to do that the mark must be registered at your local trademark office. The CA must then contact your local trademark office to verify you own the mark, and contact your company (by phone) to verify you actually ordered the VMC. Needless to say: VMCs are not cheap (currently ~800 USD). Also needless to say: you can't get a VMC at Let's Encrypt or other free CAs. Once you obtained a VMC you must host this VMC and the mark (as SVG) on a dedicated HTTP server, supporting TLS. I say dedicated, because most customer (browser) facing web services simply won't do. You must ensure that the files are served without cookie banners, CAPTCHAs, redirects, etc. The served mark (SVG) must be binary equivalent to the mark in the VMC, or else it will be rejected. This means hosting your BIMI assets using Windows machines may actually prevent it from working, as it may rewrite the line endings. VMCs are certificates, so they will expire. You must renew your VMC annually. If you forget, you may harm your brand reputation. Finally, BIMI mandates that you have DMARC enabled with 100% quarantine, or reject policy enabled. Which, on itself, can be quite a long process to adopt for large organizations. My company has helped dozens of organizations with obtaining a VMC, we also host the BIMI assets for them. We see it is quite a big hurdle to adopt BIMI for most customers. It is definitely not as straight forward as becoming verified on Twitter et al.
- pnpnp 3y ago
  Why are they so expensive? This feels like the early days of SSL certificates. We already have some measures like MTA-STS, SPF, and DMARC that should ensure you can’t impersonate a domain.
  - LeonM 3y ago
    Because the CA needs to do a lot of checks that cannot be automated (mostly over the phone). And they also need to maintain business relationships with every single trademark office to verify your mark (logo). Honestly I am amazed that they can even do this for the price they ask. It will have cost the CA a lot to get this certified, and judging from the number of BIMI VMCs we see in the wild, I'd doubt that they are making money.
    - pnpnp 3y ago
      This seems like the original argument for SSL, which ended up hurting smaller providers. You should already be able to verify that the mail is from the registered domain and provide a checkmark with freely available tools.
      - Symbiote 3y ago
        The verification is that the mark is a registered trade mark of the company owning the domain.
        rixthefox 3y ago
        That’s all well and good but it seems really unnecessary to paywall it behind what is really an overpriced SSL certificate. IMHO certificate authorities are a technology looking for validation in their necessity and truthfully the whole business model around CAs is bunk. I can use DNSSEC to provide a verified chain of trust all the way up to the root (.) signed zone. Regardless of “who signed it” anything I put into the DNS zone should be trusted to have been added there by someone who has control of the domain and access to the private key that can sign the zone. This whole song and dance of “pay us thousands of dollars each year for us to verify that you’re allowed to use your own trademarked images” is already a solved problem in the copyright system. See someone using your copyrighted images where they aren’t permitted to? You can sue the violating domain owners for copyright infringement. No “trusted third party” CA handwaving required. Trust me, even the most ambitious of scammers aren’t going to risk that copyright infringement suit when it can potentially result in domain seizure just to spoof BofA’s BIMI image. I understand people like having this third party system that someone else has done all the work verifying Ts are crossed and Is are dotted but the current system in place (third party CAs) are hardly trustworthy themselves and there are numerous examples of CAs that have “gone rogue” and provided certificates for sites that they should not that you can find out on the web if you go looking which is why I’m a strong advocate for pushing DNSSEC in the first place. The domain itself becomes its own source of truth. If I tell you X subdomain should have Y certificate signed by Z authority and that information is securely verified through DNSSEC I can trust that it came from someone with access to the signing key inside that domain.
blitzar 3y ago
If I do all this ... will they stop sending my mail to peoples spam?
- thedougd 3y ago
  Maybe. Working DMARC is a requirement for BIMI.
  - LeonM 3y ago
    Anyone can implement DMARC, even spammers. DMARC does not reduce spam in any meaningful way, but it does prevent impersonation.
    - thedougd 3y ago
      No, it won't help your inbound spam. Spammers can't sign your domain. It will, however, help his legitimate sent emails get through to trusted parties or as his domain reputation improves.
thedougd 3y ago
Microsoft is still a holdout against BIMI and does not enforce the DMARC reject option.
nr2x 3y ago
Pretty sure that particular UX element is no longer useful.

34 points by thm 3y ago

For the checkmark (BIMI) a company need to get certified. That costs about 1500 USD/year (https://store.entrust.com/default/vmc.html https://store.entrust.com/default/vmc.html). Startup founders, if you listen to this: create a cheaper alternative.

JeremyBanks 3y ago
[dead]
kyawzazaw 3y ago
For an commercial entity that cares enough to have that blue mark, $1500/yr is barely a drop in a ‘tank’, not even bucket
- iudqnolq 3y ago
  There's also a nasty adverse selection problem. Your initial customers will be naive tiny companies and scammers. (Let's not even get into the viability of business models based on convincing Google, Microsoft, and Thunderbird to implement a feature so that you can sell it)

jmclnx 3y ago

gmail should allow us to easily use gnupg in our own email client, checkmark, who cares :) I use to be able to access gmail via mitt, but the forced a change that was too much for me so I bailed.

deleted 3y ago

[deleted]

LeonM 3y ago

See also: https://news.ycombinator.com/item?id=35804599 https://news.ycombinator.com/item?id=35804599 I'll post my comment from the other thread here as wel: For BIMI to work, you need a Verified Mark Certificate (VMC). This is a x.509 certificate, but with additional extensions enabled. Most notably the 'pe-logotype' (OID 1.3.6.1.5.5.7.1.12) extension, which embeds an SVG file of your 'mark' (most likely your logo) into the certificate. The VMC proofs that your domain (the part after the '@' in the sender email address) is in fact the legal owner of the mark (the logo) that you are using. Otherwise any sender could use the logo of a bank. A VMC is like an EV certificate on steroids, because there are a lot of things the CA must verify before issuing the certificate. The CA must verify that you own the 'mark' (the logo), and in order to do that the mark must be registered at your local trademark office. The CA must then contact your local trademark office to verify you own the mark, and contact your company (by phone) to verify you actually ordered the VMC. Needless to say: VMCs are not cheap (currently ~800 USD). Also needless to say: you can't get a VMC at Let's Encrypt or other free CAs. Once you obtained a VMC you must host this VMC and the mark (as SVG) on a dedicated HTTP server, supporting TLS. I say dedicated, because most customer (browser) facing web services simply won't do. You must ensure that the files are served without cookie banners, CAPTCHAs, redirects, etc. The served mark (SVG) must be binary equivalent to the mark in the VMC, or else it will be rejected. This means hosting your BIMI assets using Windows machines may actually prevent it from working, as it may rewrite the line endings. VMCs are certificates, so they will expire. You must renew your VMC annually. If you forget, you may harm your brand reputation. Finally, BIMI mandates that you have DMARC enabled with 100% quarantine, or reject policy enabled. Which, on itself, can be quite a long process to adopt for large organizations. My company has helped dozens of organizations with obtaining a VMC, we also host the BIMI assets for them. We see it is quite a big hurdle to adopt BIMI for most customers. It is definitely not as straight forward as becoming verified on Twitter et al.

pnpnp 3y ago
Why are they so expensive? This feels like the early days of SSL certificates. We already have some measures like MTA-STS, SPF, and DMARC that should ensure you can’t impersonate a domain.
- LeonM 3y ago
  Because the CA needs to do a lot of checks that cannot be automated (mostly over the phone). And they also need to maintain business relationships with every single trademark office to verify your mark (logo). Honestly I am amazed that they can even do this for the price they ask. It will have cost the CA a lot to get this certified, and judging from the number of BIMI VMCs we see in the wild, I'd doubt that they are making money.
  - pnpnp 3y ago
    This seems like the original argument for SSL, which ended up hurting smaller providers. You should already be able to verify that the mail is from the registered domain and provide a checkmark with freely available tools.
    - Symbiote 3y ago
      The verification is that the mark is a registered trade mark of the company owning the domain.
      - rixthefox 3y ago
        That’s all well and good but it seems really unnecessary to paywall it behind what is really an overpriced SSL certificate. IMHO certificate authorities are a technology looking for validation in their necessity and truthfully the whole business model around CAs is bunk. I can use DNSSEC to provide a verified chain of trust all the way up to the root (.) signed zone. Regardless of “who signed it” anything I put into the DNS zone should be trusted to have been added there by someone who has control of the domain and access to the private key that can sign the zone. This whole song and dance of “pay us thousands of dollars each year for us to verify that you’re allowed to use your own trademarked images” is already a solved problem in the copyright system. See someone using your copyrighted images where they aren’t permitted to? You can sue the violating domain owners for copyright infringement. No “trusted third party” CA handwaving required. Trust me, even the most ambitious of scammers aren’t going to risk that copyright infringement suit when it can potentially result in domain seizure just to spoof BofA’s BIMI image. I understand people like having this third party system that someone else has done all the work verifying Ts are crossed and Is are dotted but the current system in place (third party CAs) are hardly trustworthy themselves and there are numerous examples of CAs that have “gone rogue” and provided certificates for sites that they should not that you can find out on the web if you go looking which is why I’m a strong advocate for pushing DNSSEC in the first place. The domain itself becomes its own source of truth. If I tell you X subdomain should have Y certificate signed by Z authority and that information is securely verified through DNSSEC I can trust that it came from someone with access to the signing key inside that domain.

blitzar 3y ago

If I do all this ... will they stop sending my mail to peoples spam?

thedougd 3y ago
Maybe. Working DMARC is a requirement for BIMI.
- LeonM 3y ago
  Anyone can implement DMARC, even spammers. DMARC does not reduce spam in any meaningful way, but it does prevent impersonation.
  - thedougd 3y ago
    No, it won't help your inbound spam. Spammers can't sign your domain. It will, however, help his legitimate sent emails get through to trusted parties or as his domain reputation improves.

thedougd 3y ago

Microsoft is still a holdout against BIMI and does not enforce the DMARC reject option.

nr2x 3y ago

Pretty sure that particular UX element is no longer useful.