Subject: [Bimi] Updated BIMI drafts

From: "Brotman, Alex" <[email-masked]>
Date: Mon, 11 Oct 2021 18:10:19 +0000

Hello folks,

We uploaded revisions for five documents today.  We'll get the bimigroup.org site updated shortly.

* BIMI [1] - No substantial changes
* SVG P/S [2] - Changes requested for the svg element WRT viewport-fill
* VMC Fetch & Validation [3] - No substantial changes
* BIMI Reporting [4] - Typos and clarity changes
* BIMI Guidance [5] - First iteration of a General Guidance document (replacing the Receiver Guidance).  Ideally containing guidance for parties on all sides.  It is missing the flow diagram that had been requested.  I had created it, and didn't like the outcome.  I want to try to get that created again.

Be great to get feedback as you have time.  Thanks again

1: https://datatracker.ietf.org/doc/draft-brand-indicators-for-message-identification/
2: https://datatracker.ietf.org/doc/draft-svg-tiny-ps-abrotman/
3: https://datatracker.ietf.org/doc/draft-fetch-validation-vmc-wchuang/
4: https://datatracker.ietf.org/doc/draft-adams-bimi-reporting/
5: https://datatracker.ietf.org/doc/draft-brotman-ietf-bimi-guidance/

--
Alex Brotman
Sr. Engineer, Anti-Abuse & Messaging Policy
Comcast

---

From: Dave Crocker <[email-masked]>
Date: Mon, 11 Oct 2021 12:40:05 -0700

On 10/11/2021 11:10 AM, Brotman, Alex wrote:
> 5:https://datatracker.ietf.org/doc/draft-brotman-ietf-bimi-guidance/

 From the Introduction:

> The Brand Indicators for Message Identification (BIMI) specification
>    introduces a method by which Mail User Agent (MUA, e.g., an email
>    client) providers combine DMARC-based message authentication with
>    cryptographic methods to ensure the identity of a sender. 

Alex,

This appears to be stating rather plainly that BIMI is a 'sender' 
authentication mechanism.  That is, it appears to be claiming 
authentication beyond what DMARC, et al, already do.

Unless something has dramatically changed, BIMI does not do that 
(whatever 'sender' means).

Again, unless something has changed dramatically, BIMI's incremental 
mechanism serves to provide 'authorization' for use of a specific 
resource. That's quite different from authentication.

Please clarify.

d/

ps.  Also, this draft has 'ietf' in the file name.  Why?

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: "Brotman, Alex" <[email-masked]>
Date: Tue, 12 Oct 2021 15:06:45 +0000

Dave,

You're right.  That could have been better phrased, though it is meant to refer to the VMC.  I'll create a Trac item for getting that clarified.

And correct the draft name with the next iteration.

Thank you for the feedback.

> -----Original Message-----
> From: Dave Crocker <[email-masked]>
> Sent: Monday, October 11, 2021 3:40 PM
> To: BIMI (IETF) ([email-masked]) <[email-masked]>; Brotman, Alex
> <[email-masked]>
> Subject: [EXTERNAL] Re: [Bimi] Updated BIMI drafts
>
> > 5:https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-b
> > rotman-ietf-bimi-
> guidance/__;!!CQl3mcHX2A!RghGoiU82XsXQqDe7nEs7aR8ZJbI
> > iUp2sz22Jqqk1IRDCpe4OtHirbUN8i0RH6ytRg4l$
>
>  From the Introduction:
>
> authentication mechanism.  That is, it appears to be claiming authentication
> beyond what DMARC, et al, already do.
>
> mechanism serves to provide 'authorization' for use of a specific resource.
> That's quite different from authentication.
>
> Please clarify.
>
> d/
>

---

From: Dave Crocker <[email-masked]>
Date: Tue, 12 Oct 2021 08:11:08 -0700

Alex,

Thanks for the quick follow-up.

As for 'sender', the usual distinction I suggest is between 'author', 
for the content, and something like 'originating provider', for the 
DMARC-related details.  For this latter, the official, concise term is 
'originator', but I doubt many people will automatically understand its 
precise meaning.

d/