Subject: Re: [Bimi] Today's BoF

From: Wei Chuang <[email-masked]>
Date: Mon, 1 Apr 2019 09:44:03 -0700

*From: *Dave Crocker <[email-masked]>
*Date: *Sun, Mar 31, 2019 at 5:00 PM
*To: *Wei Chuang, John C Klensin
*Cc: * <[email-masked]>

On 3/31/2019 4:48 PM, Wei Chuang wrote:
> > The BIMI proposal depends on different, domain based authentication
> > technologies that have been already deployed at scale.
>
> The message-based domain-validation components are not the issue.
>
> The use of certificate authorities is.  At scale they are problematic,
> in spite of the tendency to claim that their use for TLS says they aren't.
>

We're very much open to looking at alternatives that lets a 3rd party
verifier attest to their verification.  However I would point out that the
X.509 CA system is mature where processes are well specced and known flaws
have a number of remediations.  Alternatives may end up repeating much of
the same issues.

> And their use for linkage between domain name and logo is, since there's
> no history at scale.
>
> And any effort to use 'validated' logos at scale has no history, where
> the challenges in doing that have been well- and often-cited.
>

Agreed these are significant risks.  What's done to mitigate this is to map
this on to the existing registered trademark system, and leverage those
precedents.

-Wei

> d/
>
> --
> Dave Crocker
> Brandenburg InternetWorking
> bbiw.net
>

---

From: Dave Crocker <[email-masked]>
Date: Tue, 2 Apr 2019 08:09:38 -0700

On 4/1/2019 9:44 AM, Wei Chuang wrote:
> Agreed these are significant risks.  What's done to mitigate this is to 
> map this on to the existing registered trademark system, and leverage 
> those precedents.

Wei,

I'll cite the anecdote I keep telling, about an interaction on a 
pre-ICANN committee, where the WIPO representative -- an attorney, of 
course(*) -- said that there were discussions underway for resolving 
international issues regarding trademark.  This would have made Internet 
domain name disputes much, much simpler.

Then he acknowledged that the discussions had been underway for 100 
years, with no immediate resolution in sight.  That was 20 years ago and 
I haven't heard that they have yet produced a solution.

So forgive me, but I believe that "the existing registered trademark 
system" does not handle the kind of problem created by Bimi.  Not even 
close.  To the extent that you believe it will -- and will do it at 
scale -- there needs to be very careful documentation of how that will 
work at a systems level.

More broadly, and while it's a non-trivial amount of work, I'm finding 
myself forced to suggest that Bimi advocates produce a life-cycle 
scenario document, that shows all aspects of administration and use of 
Bimi, including problem handling, from first actions to last.

This will permit people to evaluate Bimi holistically.

d/

(*) It's probably worth offering some contrast about his participation: 
He was also the person on the committee that proposed the model for 
dispute resolution (UDRP) that ICANN adopted and still uses.

---

From: Richard Clayton <[email-masked]>
Date: Tue, 2 Apr 2019 16:59:51 +0100

In message <[email-masked]>, Dave
Crocker <[email-masked]> writes

>Bimi, including problem handling, from first actions to last.

I am very interested to learn what legal guarantees a "BIMI certificate"
might come with and hence what "comfort" it might provide to someone
whose email app was making use of BIMI to determine what marks should be
displayed within their app.

In the UK (your jurisdiction will vary, but not so much) inappropriate
display of trademarks is a civil infringement called "passing off".

There is extra protection for some special marks such as the Red Cross
emblems (fines up to 5K GBP in the UK, up to 6 months jail in the US)
and for marks associated with the Olympics (fine up to the UK statutory
maximum in this case).

So if someone sends an email with a subject header field indicating it
is about "X" to someone in country Y and the sender's trademark
(perfectly good in their home country Z for a particular category of
goods) is displayed but it happens that the text of "X" would suggest
that it is marketing material relevant to goods that a trademark holder
in country Y has registered a trademark for -- then there seems to be
excellent grounds for an action in "passing off"....

... to what extent will the existence of a BIMI certificate enable the
author of the email software to claim that they were only "following
orders" and that they should not be held liable in any way ? Will there
be an insurance policy in place at the certificate issuer ?

Also (remember those fines and possible jail time) will BIMI be dealing
specially with Red Cross and Olympic marks (and probably all sorts of
other marks which have special legal protection in some jurisdictions?)

Also, what expectation do the authors of the BIMI specification have
that email software writers will not be in regular receipt of
injunctions preventing the display of particular marks in particular
countries in relation to particular products ...

... lest people think that this is foolishness and hyperbolic
speculation, it is absolutely key to realise that trademarks differ from
other types of intellectual property in that if you fail to diligently
protect your trademark then the protection it provides can disappear.   

Use your favourite search engine to look up "laches" to find out more
than would ever wish to know about this active protection issue.

Bottom line is that trademarks are associated with a small class of
goods in a small number of countries and an attempt to link these
symbols with emails sent by all of the owners of these trademarks to
people in completely different countries is going to end in tears.  The
doctrine of "laches" means that this is pretty much bound to happen
sooner rather than later.

IANAL, but I read a lot :-)
- -- 
richard                                                   Richard Clayton

Those who would give up essential Liberty, to purchase a little temporary 
Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755

---

From: John C Klensin <[email-masked]>
Date: Tue, 02 Apr 2019 14:26:25 -0400

Wei,

Two observations on separate notes...

--On Sunday, March 31, 2019 16:48 -0700 Wei Chuang
<[email-masked]> wrote:

>...
> My worry, as Dave Crocker's recent message on BIMI highlights,
> is that these domain based authentication methods depend on
> the integrity of DNS, and apparently there's now viable
> attacks on DNS (The Route 53/BGP hijack is another).  Perhaps
> this proposal needs to take into account such DNS attacks now
> rather than later.
>...

There are two other, far more fundamental and closely related,
issues with domain-based authentication that I don't think the
BIMI proposal addresses.  

We've now got somewhat more than 1500 top level domains.  For a
significant fraction of them (I'd guess the vast majority) there
are only two qualifications for obtaining a second-level domain
under that TLD: ability to pay what is usually a fairly nominal
amount and a working email address.   Typical contracts between
a TLD operator and the buyer of an SLD transfer all
responsibility for obedience to, or violation of, trademark laws
to the latter.  There is, in general, no requirement for the TLD
to pay any attention to whether a proposed SLD name would
infringe on a trademark, even an internationally well-known one,
and considerable incentive for them not to do so.

So assume you have a company who holds a registered trademark
and associated domain name as, e.g., BigCo.co.uk.  They have all
of the right certificates and bind a logo to that domain.   Now
let's assume that a party comes along who wants to attack BigCo
and its logo.  Rather than pointing the finger at existing
domains, assume that a TLD names "evil" is allocated and
delegated in the near future and that their business model was a
little ethics-challenged (perhaps not much more than the
average, but that is not an important issue).  So someone comes
along, someone who is clearly not BigCo, and obtains BigCo.evil
(remember, all they need is ability to pay and an email
address).   They have little trouble obtaining certificates in
that name because, as far as the DNS environment is concerned,
they legitimately hold it.   They send mail out from that
address using BigCo's logo, either embedded or via some URL.
So, think the users will notice the logo does not have your seal
of approval and that the domain is in "evil." rather than
"co.uk."?  See the problem?  

Of course, BigCo can attempt to use the courts and/or ICANN
procedures to challenge BigCo.evil on the grounds of
infringement of their registered trademark, but there are two
problems with that.  One is that such challenges take a while
and are typically easily dragged out so that, by the time they
win and BigCo.evil is taken down, significant damage has been
done already and the operators of BigCo.evil are laughing all
the way to the bank.   The other is the second basic problem.

With the possible exception of a relatively small number of
internationally well-known / famous names and marks, registered
trademarks are tied to both geography and field of application.
If BigCo.co.uk sells widgets and BigCo.us makes blankets for
wizzles, there is most likely no trademark violation and both
companies may be completely legitimate (unlike the example
above), have the marks appropriately registered, and are able to
obtain even the highest assurance certificates possible
--different jurisdictions and business locations and different
fields of application.   Even if both selected logos that were
very similar, trademarks wouldn't help much.  

As Dave said, people have been working on these issues for well
over a century with very little discernable progress.    I can't
recommend holding your breathe about the latter problem and,
even if it were solved, that would still leave the nature of the
domain name market.

best,
   john

---

From: "John Levine" <[email-masked]>
Date: 2 Apr 2019 15:54:08 -0400

In article <DD71F5FAA85F312FDB5EF7E4@PSB> you write:
>...  So someone comes
>they legitimately hold it.

Nobody is assuming that you can get a bimi cert (or whatever) merely
with a domain name similar to the target trademark.  I gather that one
of the gorillas accidentally made this mistake in their informal logo
collection system and a motivation for bimi is to keep it from
happening again.

Of course this returns us to the major question of whether it's
possible to invent an effective system to check bimi applications.  I
could invent one that involved a staff of trademark lawyers, but I
don't think anyone outside the S&P 500 would find that usable.

R's,
John

---

From: John C Klensin <[email-masked]>
Date: Tue, 02 Apr 2019 17:02:54 -0400

--On Tuesday, April 2, 2019 15:54 -0400 John Levine
<[email-masked]> wrote:

>> along, someone who is clearly not BigCo, and obtains
>> BigCo.evil (remember, all they need is ability to pay and an
>> email address).   They have little trouble obtaining
>> certificates in that name because, as far as the DNS
>> environment is concerned, they legitimately hold it.
> 
> Nobody is assuming that you can get a bimi cert (or whatever)
> merely with a domain name similar to the target trademark.

Understood.   However, unless just about every MUA in the world
was upgraded to understand the difference between a bimi link
and cert, I can't imagine a typical user being able to tell the
difference between a bimi-blessed logo (or whatever) and the
same logo presented via some other mechanism.  

If I correctly understood last week's discussion, bimi is
dependent on mechanisms, including DKIM/SPF/DMARC that are,
unless I'm missing something, dependent in turn on some
assumptions about binding of the identity of a domain name
holder with the domain name.   My point was one cannot push
those assumptions very hard without running into questions of
registrar integrity and what it means to own (or hold) a domain
name.   

And, before you tell me that, statistically, everyone is using
web interfaces and MUAs don't count and/or that statistically
everyone is using one of those gorilla systems so it is
reasonable to ignore the deployment issues for the tiny minority
of people who are left, I suggest that a corollary to those
conclusions is that a code of common practices among said
gorillas and an advertising campaign to try to convince people
that they would much safer if they didn't communicate with, or
accept mail from, anyone who was not using a gorilla system.  Of
course that approach would have interesting antitrust
implications, but that, statistically, has not be a problem yet,
so why worry?  :-(

>  I
> gather that one of the gorillas accidentally made this mistake
> in their informal logo collection system and a motivation for
> bimi is to keep it from happening again.

If one conbines that sentence with the "Nobody is assuming..."
one above, then a motivation for bimi is to cure (or prevent)
stupidity.  Perhaps it will work this time, but the track record
of other efforts to apply such cures has not been good.

> possible to invent an effective system to check bimi
> applications.  I could invent one that involved a staff of
> trademark lawyers, but I don't think anyone outside the S&P
> 500 would find that usable.

Indeed.

best,
   john

---

From: Wei Chuang <[email-masked]>
Date: Wed, 3 Apr 2019 05:54:40 -0700

*From: *Dave Crocker <[email-masked]>
*Date: *Tue, Apr 2, 2019 at 8:09 AM
*To: *Wei Chuang
*Cc: * <[email-masked]>

> Bimi, including problem handling, from first actions to last.

There's some documentation of those considerations for VMC in its security
perspective draft.  Section 2.5 in particular has thoughts about registered
trademarks and jurisdiction consideration, and 2.7 suggests when not to
display a logo:
https://tools.ietf.org/html/draft-chuang-ietf-bimi-security-perspectives-00#section-2.5
You can see validation details from the perspective of the CA/MVA in the
VMC Guidelines document in Section 3:
https://docs.google.com/document/d/10IzxkdrveDazBAvTvOUa9uCIDBwMkdmluwHEcbja42w/edit?usp=sharing

But I agree we should do more to spell out a life cycle flow perhaps as an
extension to the perspectives draft.

-Wei

---

From: Wei Chuang <[email-masked]>
Date: Wed, 3 Apr 2019 06:36:29 -0700

*From: *John C Klensin <[email-masked]>
*Date: *Tue, Apr 2, 2019 at 11:26 AM
*To: *Wei Chuang
*Cc: * <[email-masked]>

Wei,
> Two observations on separate notes...
(Regarding the first, I didn't want to repeat what John L. had already said)

>   The other is the second basic problem.
>

> very similar, trademarks wouldn't help much.

Agreed that the VMC proposal which maps onto the existing trademark
framework including its warts.  So yes agreed that this system will allow
for similar marks owned by different companies in different jurisdictions,
or across different lines of business.  Presumably its one that users live
with and presumably navigate in a reasonable fashion.  Consequently there's
a set of recommendations in the VMC security perspective draft section 2.5
and 2.7 particularly about the display and non-display of logos:
https://tools.ietf.org/html/draft-chuang-ietf-bimi-security-perspectives-00#section-2.5

> recommend holding your breathe about the latter problem

+1

-Wei

> and,

---

From: Wei Chuang <[email-masked]>
Date: Wed, 3 Apr 2019 07:02:07 -0700

*From: *John C Klensin <[email-masked]>
*Date: *Tue, Apr 2, 2019 at 2:03 PM
*To: *John Levine
*Cc: * <[email-masked]>

> same logo presented via some other mechanism.

Those are really good points.  The main solution will be that the MUA has
to help the user navigate through the UI (and done carefully).

> registrar integrity and what it means to own (or hold) a domain

Yes BIMI very much depends on the integrity of the DNS system, both at the
registrar level and the protocol.  The latter might be defended by DNSSEC.
If that's not to your liking and attacks like Route 53 are more common
place, we could use only DKIM/DMARC and require that the DKIM public key
align with the certificate's public key.  Regarding the former, agreed
that's issue.  If attacks like what Dave disclosed (DNSpionage), then we'll
need to depend less on DNS or at least detect the attack.  Again the just
mentioned DKIM/DMARC restriction can help.  This all said if we have
serious worries about DNS being authoritative, then a bigger issue is
outside of BIMI i.e. the domain based authentication system that's very
much deployed and used extensively by receivers.

-Wei

> bimi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/bimi
>

---

From: Richard Clayton <[email-masked]>
Date: Wed, 3 Apr 2019 17:43:10 +0100

In message <[email-masked]
il.com>, Wei Chuang <weihaw=[email-masked]> writes

>or across different lines of business.  

this uniqueness only within specific areas of commerce is a key aspect
of the trademark system

>Presumably its one that users live
>with and presumably navigate in a reasonable fashion.  

yes ... purchasers can generally tell that this box contains widgets and
that box (containing green floosits) is not from the same company
despite the trademark being the same. So the "overloading" of the marks
works moderately well in the real world (and when moderation is absent
keeps lawyers in work)

however emails inherently look the same as each other ...

>Consequently there's

2.5 says that jurisdiction should be done at the granularity of a nation
state but the example in 1.1.2.1 draws attention to difficulties arising
at at the state level ...

... and US trademarks do indeed operate at the state level:

https://www.uspto.gov/trademarks-getting-started/process-overview/state-
trademark-information-links

this does not seem very consistent ... and as you fix this, please
provide the semantics by which code can compare GPS coordinates with
"US" or "VA,US" or "UK" or "RO" or even "EU".

I suspect that political correctness means that residents of certain
parts of the Middle East will not get any BIMI provided logos at all!

- -- 
richard                                                   Richard Clayton

---

From: Wei Chuang <[email-masked]>
Date: Wed, 3 Apr 2019 10:02:18 -0700

*From: *Richard Clayton <[email-masked]>
*Date: *Tue, Apr 2, 2019 at 9:04 AM
*To: * <[email-masked]>

-----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1

(IANAL) To be sure this topic is complex.  We have ideas to your point
above but that's still in progress, and we hope to have more to share
soon.  Your framing this around "laches" is new to us, and helpful feedback.

-Wei

> .... to what extent will the existence of a BIMI certificate enable the
> .... lest people think that this is foolishness and hyperbolic
> -----BEGIN PGP SIGNATURE-----
> Version: PGPsdk version 1.7.1
>
> iQA/AwUBXKOG9zu8z1Kouez7EQLGoQCgu4hDmg+oWGU3GOPYEWGOuyPvxyQAoIdr
> o9yCrNZIBGtilafLnB32Puji
> =Gc1G
> -----END PGP SIGNATURE-----
>
> --
> bimi mailing list
> [email-masked]

---

From: Dave Crocker <[email-masked]>
Date: Wed, 3 Apr 2019 10:12:56 -0700

Wei,

Something like Bimi is easy to make work at small scale.  And it doesn't 
need a standards effort.

So the question for any Internet-scale standards effort is:  What are 
the critical issues that need to be solved?

For Bimi, I believe the challenge of making logo use 'validated' at 
scale is the primary, critical issue.(*)  This was noted at the start of 
the Bimi effort, two years ago.  That there is still no resolution is 
not surprising, but it adds to the concern about there pursuing Bimi 
components now, with the hope that this major scaling barrier will 
somehow get resolved 'soon'.

Any effort to pursue Bimi-related standards needs to happen /after/ this 
long-standing legal, technical, and operational challenge has a viable 
proposal for solution.

d/

(*) There are, of course, other concerns, such as the frankly tenuous 
premise that Bimi will drive authentication adoption by bulk senders on 
the also-thin possibility of more recipient logo-impressions.  But as 
technical barriers go, logo 'validation' is easily dominant.

---

From: "John Levine" <[email-masked]>
Date: 3 Apr 2019 13:53:42 -0400

In article <[email-masked]> you write:
>scale is the primary, critical issue.(*)

It seems to me there's two fairly separate issues here.

One is creating a system that will validate domain -> logo mappings.

The other is at least a plan for how the liability will flow.  Unlike
DMARC, where the failure mode is spam or phish leaking through that
would have leaked without DMARC, with BIMI the failure is one
company's trademark shown next to another company's mail or next to a
phish, where without BIMI there'd have been no logo at all.  As noted
in previous messages, trademark law makes it likely that legal threats
will ensue.

R's,
John

---

From: Dave Crocker <[email-masked]>
Date: Wed, 3 Apr 2019 11:18:44 -0700

On 4/3/2019 10:53 AM, John Levine wrote:
> The other is at least a plan for how the liability will flow.

at least 3.

In between your two:  A usage model that makes sense.  That is, details 
for an operational model that will provide meaningful use of logos, in 
the face of the basic international AND cross-industry complexities 
that keep being cited here.

d/

---

From: Wei Chuang <[email-masked]>
Date: Thu, 4 Apr 2019 07:22:04 -0700

> > 500 would find that usable.

Agreed that VMC will have a significant coverage limitation since its uses
registered trademarks that enables 3rd party verification.  Its one that
we're trying to figure out how to expand and we're very much asking for
your help and for your ideas to expand that coverage.  VMC and its 3rd
party verification system is just one approach, and is a starting point for
BIMI because we think is feasible to do in the near term, but we agree its
not a complete solution.

I should point out and has been alluded to in the above thread, that BIMI
also allows naked logos (meaning non-third party verifed) to be identified
by hash and fetched.  This depends even more heavily on reputation systems
to use safely but it may allow much more of the use cases identified in the
overview draft 5.3-5.11.
https://tools.ietf.org/html/draft-bkl-bimi-overview-00
The theory for its usage is very much like the favicon approach on the web,
and yes this approach will run headlong into all the issues you pointed
out.  The choice of its usage is up to the receiver that is interested in
that flexibility and okay with the risk.

Along the notion of exanding coverage, I just also wanted to point out 3rd
pary verification can work so long as what it tests is objective.  It might
not have to involve marks.  For example I would imagine a sender might be
associated with a place or person, and a photos of that places or person
could be reasonably verified.   Anyways we are looking for ideas to expand
coverage.

-Wei