An easier way to get your logo in the inbox: Google's latest BIMI changes • Hacker News Board

Re: An easier way to get your logo in the inbox: Google's latest BIMI changes

#21

Post by ajonit » Mon, Sep 30, 2024, 5:40 PM UTC

ocdtrekkie wrote: post #18

ajonit wrote: post #17

Earlier quoted context omitted.

Now that certificates are free, of course, all phishing sites use Let's Encrypt. Evaluating a website's legitimacy using SSL should not have been initiated by browser vendors. The messaging was wrong for the non-tech folks. They do not have anything to do with the site is fake/fraud/malicious. It was just the data-in-transit is safe or not.

That's not my point: My point is that it became a real world tendency because it was pretty accurate: The malicious websites weren't paying for certificates. If even some legitimate businesses balk at the cost of a VMC, your average scammer isn't going to drop that kind of money to get one either, especially since that cost is per-attempt and the approval is somewhat manual and likely involves humans seeing that it i…

Of course I understood your larger point on barriers to entry for a malicious actor.

If a thing like BIMI is not widespread, would it even help an average non-tech Joe who won’t even understand the reason behind that checkmark on a logo?

Re: An easier way to get your logo in the inbox: Google's latest BIMI changes

#22

Post by ocdtrekkie » Mon, Sep 30, 2024, 5:51 PM UTC

ajonit wrote: post #21

ocdtrekkie wrote: post #18

Earlier quoted context omitted.

That's not my point: My point is that it became a real world tendency because it was pretty accurate: The malicious websites weren't paying for certificates. If even some legitimate businesses balk at the cost of a VMC, your average scammer isn't going to drop that kind of money to get one either, especially since that cost is per-attempt and the approval is somewhat manual and likely involves humans seeing that it i…

Of course I understood your larger point on barriers to entry for a malicious actor. If a thing like BIMI is not widespread, would it even help an average non-tech Joe who won’t even understand the reason behind that checkmark on a logo?

It certainly can. Most people interact with the same organizations time and time again, so any visual indicator something is different can be useful. If you're used to seeing a bank logo on every email from your bank... and then you get an email without that logo... it's just one more visual indicator something is off, and it's more obvious than say... looking at the full email address behind the display name.

BIMI (and EV certs) should not be considered "for all organizations", but probably something worthwhile for organizations that transact in a lot of money and a lot of personal data.

Re: An easier way to get your logo in the inbox: Google's latest BIMI changes

#23

Post by ajonit » Mon, Sep 30, 2024, 6:05 PM UTC

ocdtrekkie wrote: post #22

ajonit wrote: post #21

Earlier quoted context omitted.

Of course I understood your larger point on barriers to entry for a malicious actor. If a thing like BIMI is not widespread, would it even help an average non-tech Joe who won’t even understand the reason behind that checkmark on a logo?

It certainly can. Most people interact with the same organizations time and time again, so any visual indicator something is different can be useful. If you're used to seeing a bank logo on every email from your bank... and then you get an email without that logo... it's just one more visual indicator something is off, and it's more obvious than say... looking at the full email address behind the display name. BIMI (…

Now consider getting same visual indicators for ALL legit emails not just big companies. Which case would have a bigger recall value?

For a malicious actor spoofing a combo of SPF + DKIM + DMARC + BIMI won’t be a trivial job.

Re: An easier way to get your logo in the inbox: Google's latest BIMI changes

#24

Post by ocdtrekkie » Mon, Sep 30, 2024, 7:20 PM UTC

ajonit wrote: post #23

ocdtrekkie wrote: post #22

Earlier quoted context omitted.

It certainly can. Most people interact with the same organizations time and time again, so any visual indicator something is different can be useful. If you're used to seeing a bank logo on every email from your bank... and then you get an email without that logo... it's just one more visual indicator something is off, and it's more obvious than say... looking at the full email address behind the display name. BIMI (…

Now consider getting same visual indicators for ALL legit emails not just big companies. Which case would have a bigger recall value? For a malicious actor spoofing a combo of SPF + DKIM + DMARC + BIMI won’t be a trivial job.

I would argue that would make it worse. I don't think any given site or user needs a personal verified email icon. A big part of the goal here is to highlight legitimate trust. Real people don't need a cryptographic proof, what they want to see is "This is really from the official company Microsoft which you've heard of" and something M1cros0ft registered in a tax haven can't technically request to participate in.

This is what I feel us tech people have missed about what the old school lock icon used to at least sort of (inaccurately) express when HTTPS was rare and what EV intended to express (although the qualification criteria needs work there).

Not everyone should be eligible for an EV cert, not everyone should be eligible for BIMI/VMC. Some sort of scale and legitimacy and manual approval (think the old school Verified checkmark before Elon bought Twitter) that not everyone qualifies for.

Re: An easier way to get your logo in the inbox: Google's latest BIMI changes

#25

Post by Balasai » Thu, Oct 03, 2024, 11:26 PM UTC

throwaway2016a wrote: post #20

Perhaps I'm missing it but where do you actually buy and/or generate a CMC? I can't find any information on it. Personally VCM is far too expensive for me at this time which is the only reason I haven't gotten one. But I certainly realize that putting a cost barrier to entry makes it less accessible to bad actors.

CMC is on but same price as VMC this is totally unfair https://www.digicert.com/tls-ssl/verified-mark-certificates#...