That’s a very controversial standard as it can be abused for tracking and does not really protect end users from spoofing.

Controversial and technically dubious. The whole premise of the BIMI standard hinges on the adoption of X.509 certificate authorities which will issue certificates (called “VMC”) for a graphical logotype. However, the laws regarding trademarks are restricted in many scopes; legal juristictions and business area (trademark “class”), to name a couple. No VMC issuer could really do anything sensible with similar trademarks which are registered by multiple entities in different juristictions and/or different business areas. The best-case scenario is that huge players like FAANG, CNN, etc. get VMC certificates and the rest of us get nothing. Which is, I guess, why the big players are toying with the idea and are, slowly, tentatively, pushing for it.

and financially scandalous

Thousands and thousands of dollars for a BIMI certificate is just ludicrous.

Certificates are certificates are certificates.

They're 1KB files full of random numbers. What you use them for shouldn't alter their price... which ought to be zero.

The facts that a handful of near-monopolistic CAs have managed to control protocols, set standards, and generally funnel money into their coffers that need not have been spent at all is one of the worst examples of naked capitalistic greed I have ever seen.

Rent seeking, pure and simple.

From what I can see, it is the very same CAs who used to peddle normal certificates (and are currently mostly failing to sell EV certificates) who are now desperately trying to save their business by pivoting to convince businesses that VMC certificates are the new big thing.

Your view is very, very naive.

> Thousands and thousands of dollars for a BIMI certificate is just ludicrous.

VMCs are between 800 and 1500 USD

> Certificates are certificates are certificates.

The x509 certificate is, but the process to verify your ownership of the supplied 'mark' (your logo) is not.

The VMC issuing procedure is very involved, it requires the CA to confirm with your local trademark office that your company owns the trademark. For VMC the CA is also required to verify (by phone) that the person who requested the VMC does indeed work for the company, they are also required to verify that the person who requested to certificate is allowed by the organization to do so.

The CAs are actually doing work here, there are real costs.

FWIW: Digicert currently sells VMC for a discounted price of 800USD, which they claim is not even economically viable. Without the discount expect VMCs to be ~1500USD.

People have already paid for an actual trademark. Why should they pay again, to a private company?

Your argument is essentially identical to the arguments usually made to explain why EV certificates are expensive, and nobody is buying those.

Verifying that an SVG image is 100%identical (with zero room for interpretation) to a picture in a public database (available online free of charge)?

And then clicking 'renew' once per year?

How could you possibly charge less than a thousand dollars for that...

No public database with all trademarks exists. And even if it does: who is going to maintain that public database? And how would you be able to trust said database? How will you proof that you really are the legal owner of the logo in that database?

Again, the 'renew' click is not why this is expensive. It's just a cryptographic function that signs a bunch of data, Lets Encrypt has long proven that certificates can be created free-of-charge. However, having a human verifying that everything checks out is the expensive part. Having that human work in an environment, following procedures that passes public audits is expensive. None of the trademark offices is going to do your trademark validations for free. No-one is going to staff a call-centre for free.

You are right about the technical part of creating a certificate being trivially easy, but I believe you truly underestimate the costs of running a CA that is capable of delivering VMCs.

Maybe that some company can do it for less than the current prices, I don't know. Competition will show that eventually. But if you truly think that you can do it for less than the current CAs, then start a CA yourself and start competing.

You need to be registered with the national patent and trademark office in one of six participating countries. These databases are financed and maintained almost entirely by the brand owners. You as a brand owner need to do your own research to make sure that your logo is original, then you pay to be entered into the database, then you need to continuously audit any new entries into these databases to make sure that they don't infringe on your existing trademark.

So you provide the CA with an trademark ID number that they can look up and they verify that you represent the company that owns the trademark. It's like 10 minutes on top of the existing EV process, but it's more than double the price.

> VMCs are between 800 and 1500 USD

Per domain.

One of my customers has dozens of domain names!

No, it is per brand mark (logo).

The domain names are in the AN section of the cert. You can have as many as you want in there (as long as they share the same logo)

At Mailhardener we built a BIMI validator tool [0], we also work with the AuthIndicators Working Group (the authors of the BIMI standard) to refine the standard.

Please be aware that the BIMI standard is far from finished. There are some serious documentation ambiguities that pose a risk to how well BIMI might function, and how email providers will adopt the technology. Obviously, the CAs are now pushing hard for BIMI, since VMCs are a new source of recurring business for them.

In my personal opinion I think that BIMI is pushed to early, which could leave brands attempting to adopt BIMI disappointed. Obtaining a VMC is quite involved (and expensive) for small businesses, and the potential benefits are (currently) quite small, as not many email service providers support BIMI.

Don't get me wrong though, I think BIMI has a great goal of pushing the DMARC adoption rate (remember, you must implement strict DMARC for BIMI to work). I just don't see BIMI offering any reliable brand exposure for the coming years. Only time will tell I guess.

[0] https://www.mailhardener.com/tools/bimi-validator

The IETF contains some really questionable propositions lately, not sure what to make of this, but it doesn't seem to solve a problem.

What does this provide in contrast to DKIM? Perhaps there are logistical problems with DKIM, but I wouldn't know. I wonder why it isn't more widely spread in the first place. The receiver can determine the requirement, which is the best solution imho.

For Google it seems to be more of a marketing issue than security. Furthermore provider could track domain requests. That isn't just suspicious, this is almost malicious. There is a reason mail clients don't display pictures outright.

I hope my mail client will never support this.

BIMI is really cool. I played with it, setup the appropriate DNS records, created an SVG logo and ... well that's about where it stopped as registering a trademark is a bit of a step too far for getting all of this to work.

It does pass the checks though [1], but does not really work because of the missing certificate which you can for example get at DigiCert [2] once your trademark has been approved..

The domains I configured it for are: antwise.com and vimalin.com so you can see at [1] how it looks like when it is supposed to work.

[1] https://bimigroup.org/bimi-generator/

[2] https://www.digicert.com/tls-ssl/verified-mark-certificates