This is an excellent writeup, and great example of responsible disclosure done right. However, I can't get over the clickbait title. This seems like a real che

This is an excellent writeup, and great example of responsible disclosure done right. However, I can't get over the clickbait title. This seems like a real cheap shot at BIMI, and DMARC for that matter. BIMI never pretended to be a 'security' protocol of any kind. It's a branding opportunity to incentivize DMARC adoption. That's what is literally explained on the front page of the BIMI workgroup website [0]. I won't go into the discussion whether the price of a VMC is justifiable or not, but saying 'BIMI can't safe you' as if BIMI ever promised it would is just ridiculous in my opinion. DMARC on the other hand is more of a policy protocol than an additional layer of security. Yes, it does strengthen the underlying protocols (SPF & DKIM) a little bit by adding the alignment requirement, which more-or-less patches the worst flaws of both protocols, but it doesn't magically make email secure. Saying 'DMARC won't safe you', as if DMARC was somehow ever capable of fixing 0-days in the underlying protocols is, again in my opinion, ridiculous. I get that the company is proud of the discovery of this security flaw, and that such a publication is a great opportunity them to get your name out. But I just can't shake off the thought of the engineers having to witness some guy from PR slapping a cringy clickbait title on their otherwise excellent work. [0] https://bimigroup.org/ https://bimigroup.org/