Latest / Identity at the Center / #315 - Authenticate 2024 - Data Privacy & Accessibility with Tina Srivastava

Transcript

#315 - Authenticate 2024 - Data Privacy & Accessibility with Tina Srivastava · Identity at the Center

0:00
Who has to do something to fix? Or is it just got to be an
0:02
industry effort? Well, I can tell you for sure
0:06
that we can't just rely on big tech and assume that these
0:10
problems will get solved. We have to keep raising our
0:13
voices. We have to keep having
0:15
innovative startups that look at things differently and raise,
0:19
raise these issues. And we have to keep bringing
0:21
them forward in these conversations like the one we're
0:23
having right now, so that people understand the importance of
0:26
this and, and frankly that the people that are developing being
0:30
these solutions come from that same inclusive, diverse
0:35
background as the people using them.
0:37
So in this battle for privacy and identity, are we losing?
0:42
Is the user losing? Are we winning?
0:44
Is it a tie? Like, where are we at and how do
0:47
we, how do we address this battle?
0:50
Well, on one statistic on breaches, it looks like we're
0:53
losing. It looks like they're ever
0:55
increasing like the data pandemic.
0:58
On the other hand, I think we finally have reached the point
1:02
that there are now technologies that are privacy preserving that
1:06
are actually able to deliver the user experience that we demand
1:10
along with the security and privacy.
1:12
So it doesn't have to be a trade off.
1:14
We can actually win on on all of those fronts.
1:23
This is identity at the center if it has anything to do with
1:28
IAM. This is the go to podcast now
1:33
your hosts Jim McDonald and Jeff Stedman.
1:43
Welcome to the Identity of the Center podcast.
1:44
I'm Jeff, and that's Jim. Hey, Jim.
1:46
Hey, Jeff, how are you? Oh.
1:47
Not so bad yourself. You haven't been cracking up
1:50
either. Before we hit record, you're
1:51
like, are you gonna sit like? That, yeah, Is that, Is that
1:53
your real face? Is that what you want to throw
1:54
on camera? Today, are you OK?
1:57
Are you gonna breathe the whole show?
1:58
Look, I had somebody come up to me yesterday, it was very nice
2:01
that commented on the quality of our audio on our video.
2:05
And that's my job here is to make everyone look and sound as
2:08
good as possible. And I try to be perfect, full of
2:11
my guy. Well, you can't help it.
2:13
I'm going to say what I'm going to say.
2:14
Yeah, you're going to say what you're going.
2:15
To say you can't make that all sound good.
2:17
You got to come closer with a microphone though, so other
2:19
people can hear you. Yeah, this big crowd that we've
2:21
drawn in, right? Exactly, we're here at
2:23
Authenticate 2024 conveniently located next to one of the food
2:27
buffet things. So if you hear dishes and things
2:29
like that, we're also providing entertainment for people who are
2:32
scooping up chicken and or fish or whatever is over there.
2:35
So yeah, we're live I. Mean, hey, we're here in San
2:38
Diego. It's golf country.
2:41
They've got a beautiful golf course here on site.
2:45
I'm dressed for the occasion and but it's baseball season, so I
2:49
was on the phone today. So this episode goes live
2:52
November 4th. We'll have a world champion in
2:55
the Major League Baseball. But as of today, we're two games
2:59
into it's the American League Championship Series.
3:02
The Yankees are up to nothing. It's on a call today with a
3:06
bunch of folks from Cleveland, and they're not too happy at the
3:10
moment. And oh, the Yankees are up on
3:11
Cleveland too. Nothing.
3:12
OK. You said a lot of baseball stuff
3:14
and I just tuned out because I don't, I don't care about
3:16
baseball. That's not your thing.
3:17
Yeah, never talk about the Bears, totally different story.
3:19
I would totally be talking about NFL Caleb Williams, but that's.
3:23
Football. That's a different podcast.
3:25
Exactly. So yeah, we're here to
3:26
authenticate 2024. Today's the last day for us.
3:30
It's Wednesday, October 15th. This will go out in a couple
3:32
weeks and I've enjoyed myself. It's been a great conference.
3:35
We had kind of like the party last night.
3:38
There was food, there was karaoke, there was a whole bunch
3:41
of stuff going on. It was good times.
3:43
It's like the identity of the Center podcast, education and
3:47
entertainment. It's edutainment.
3:50
Exactly. Yeah, What's next for us is
3:53
we've got Gartner coming up, so that will be in December and
3:56
we've got a discount code for that.
3:58
So if you use the code IDAC 375, guess how much money you get
4:02
off? 250.
4:03
Bucks, you are wrong, $375 off of your registration.
4:07
I know it's a very convenient code.
4:09
I have not yet put that on our website.
4:10
I have to do that. It's on my To Do List, but we'll
4:12
have a link in our show notes as well.
4:14
So IDAC 375, you and I are going to be there doing something on
4:18
stage, use case, whatever that means.
4:21
We hope to see people there. Definitely want to give a shout
4:24
out to RSM as well for funding us to get out here.
4:26
That's our day job. A lot of people don't realize
4:28
that we actually do identity consulting during the day, and
4:31
the podcast is something at night that is totally separate,
4:33
but they're very supportive of what we do, including sending us
4:36
to things like. This Yeah, I mean, we've been
4:38
doing conference coverage for like 2 1/2 years now.
4:41
It's very expensive. We get to go to the conferences
4:44
for for 8:00 because we're providing media coverage, but
4:48
there's a lot of travel and I had breakfast this morning and
4:52
it was like 40 bucks after tips so.
4:55
Well, like, you should have just gotten breakfast here, I guess.
4:58
OK, Daniel, if you didn't hear that.
4:59
Daniel Ghazi, Whoever's approving.
5:01
Special seat in here. Jump on calls to 630 maybe?
5:03
That's true. OK, All right.
5:05
Why don't we get to our main topic?
5:06
Because this conversation is something that actually started
5:10
a year ago. I sat next to this individual at
5:14
one of the tables outside when the food trucks were out and she
5:17
started to tell me about her deal.
5:20
And we'll let her get into it in a second.
5:22
But I'm very excited that it's only taken a year for us to get
5:24
Tina Srivasta, who's the Co founder of Badge, back on the
5:27
show. Or I should say, on to the show.
5:29
So welcome to the show, Tina. So glad to be here.
5:32
Thanks so much, Jeff. It's taken a while, but we're
5:34
here now. I want to get into a little bit
5:36
of your background here, and that's the first thing we always
5:38
start with, is how did you get into the world of identity?
5:42
Is it something that you chose or did it choose you?
5:45
It shows me as we found is something common among many
5:49
identity rofessionals. So my background of all things
5:52
in in aerospace engineering and we talked about how I'm a pilot
5:56
and I instruct in aerodynamics at MIT.
6:01
And after my doctorate, I went on to Raytheon where I was
6:05
building large electronic warfare systems.
6:08
So I was the chief engineer of our precision strike and attack
6:10
systems. Great experience, focused very
6:13
much on national security and defense.
6:17
Noticed some vulnerabilities in how we transferred waveforms out
6:21
to our sensor systems and founded a previous cybersecurity
6:24
company to solve that problem. It was a great experience.
6:28
We built the company from scratch, grew it ultimately sold
6:31
to a public company, one of the leaders in Network Assurance.
6:34
And along the way we had customers in the public and
6:36
private sector. So US Strategic Command, Army,
6:41
Air Force, these were some of our customers.
6:44
And that meant that I had a security clearance and that
6:48
meant that my fingerprints, these fingerprints were stored
6:51
in the Office of Personnel Management OPM database.
6:55
And I got that notification in 2015 along with millions of
6:59
others that my data had been compromised.
7:03
And it was this eye opening moment that how do I prove that
7:06
I'm Tina without giving up what I used to prove who I am.
7:09
There's got to be a better way. And being a cryptography nerd,
7:13
it allowed me to dig into the math.
7:16
We found this 20 year open problem in this field called
7:20
fuzzy extraction. We made a breakthrough there.
7:24
That's a field of innovation and we have over 20 issued patents
7:28
and that's what brought me to identity and to badge.
7:31
So that's just a common story of Defense Department, you know,
7:34
Defense and MIT and a whole bunch of stuff.
7:39
OK, so take me through the translation from that, that
7:45
pivot. So you mentioned the OPM breach
7:48
and your data was part of that, your fingerprints, I assume, and
7:51
other biometrics on there. So you can change your
7:53
fingerprints. At least not yet.
7:55
What was it like to get that information from your
7:57
perspective at that point as someone who was the breechy from
8:02
a data perspective? Yeah, it was scary, Jeff, and
8:05
you're absolutely right. I can't reset my fingerprints.
8:08
It's not like a password. It's something that you know,
8:11
now is, is a is a permanent breach of my data.
8:15
And that it wasn't just me, but it's people with security
8:18
clearances, which just seems to be not the kind of people whose
8:22
data you want compromised and, and floating around.
8:25
And that data is, of course, used to access systems.
8:28
And So what does that mean for our security posture and the
8:31
threat landscape that this unlocks?
8:34
And that's really why I got to think, you know, why do we store
8:38
these data? It seems like only a matter of
8:40
time. We keep hearing about breaches.
8:42
It's only a matter of time if you store very sensitive data in
8:46
a database until it gets compromised.
8:49
There's got to be a better way. You're a Co founder of Badge.
8:52
Give us a real brief overview of what Badge is.
8:56
It is based around identity without secrets.
9:00
What we figured out how to do is to derive keys from your
9:05
authentication factors, and these can be any authentication
9:08
factors, biometric or otherwise. Our most popular face
9:12
fingerprint device characteristics, PIN code,
9:14
whatever factors you want in the time of enrollment, you provide
9:19
your authentication factors and some kind of an e-mail address
9:23
or username badge allows you to derive a private key and a
9:26
public key from that information.
9:29
And then here's the innovation. We destroy those authentication
9:33
factors, so no biometrics are stored, no hashed credentials,
9:37
and we destroy the private key. So all that's left is that
9:41
public key. And that means that now on
9:44
another device, maybe you dropped your first enrollment
9:47
device in the ocean and it's not available to bootstrap your
9:50
identity on a new device. You can put in that e-mail
9:53
address or username, pull down your public key, provide your
9:57
authentication factors and re derive that private key on the
10:02
fly locally on your device. And this is what really unlocks
10:07
these use cases on account recovery, shared devices, owning
10:11
your identity on whatever device you go to.
10:15
And it's been an exciting journey.
10:16
We just came out of stealth mode in January and we have been
10:20
approached by some of the largest companies.
10:22
We've announced partnerships with Okta, Ping Identity, Cisco,
10:27
Tallis, Cyber, Ark, Radiant Logic, and many of those
10:31
companies are here. We just talked about, we can see
10:34
the booths that authenticate from Cisco and Tallis.
10:38
They're actually demonstrating our integrations and and showing
10:41
the blogs that they've put out in the last few weeks.
10:44
So very exciting. It's a great story to see that
10:47
happen. And yes, I wish I'd heard of
10:50
some of those companies that you mentioned.
10:51
They're just not working on space.
10:53
Let's talk a little bit about Authenticate 2024 though,
10:55
because I think you've had a couple of talks you've done
10:57
here. Tell me about some of the
10:58
conversations that you've had here at the conference.
11:01
It's been a great experience being here.
11:03
We presented yesterday with Bill Wright, former Executive
11:08
Director of USAA Bank and Fido board member and the the wealth
11:13
of experience he brings has been fantastic.
11:16
We discussed specifically how to deploy passwordless
11:21
authentication in financial regulated environments.
11:24
This is very critical. You have to be compliant with
11:28
these privacy regulations. You have to be able to adhere,
11:31
adhere to the strictest standards and we talked through
11:34
that guidance how you can achieve that and some of the
11:37
specific use cases that badge is addressing in the space.
11:41
Hey, Tina, I think that what Jeff said about, you know, being
11:46
kind of a different archetype coming into the security space,
11:50
I love the perspective that you bring.
11:52
I love kind of this kind of technical edge, obviously that's
11:57
within the space, but love the the approach what I wanted to
12:02
ask about. So you've also been invited to
12:05
brief the, what is it the, the US Congressional AI Committee or
12:13
I'm sorry, the AI Caucus on AI and privacy and wanted to get a
12:18
little bit more on that. Of course, Jim, yes, it was a
12:24
huge honor to receive that recognition of badges impact on
12:27
privacy and what it can mean for national security.
12:31
When we talked about the advancing threats of AI, of
12:34
generative AI and what does that mean for people?
12:37
Well, in one example, it means that you can have much more
12:41
sophisticated phishing attacks. So we've talked about phishing,
12:44
phishing emails, the emails that are meant to look like they came
12:50
from somebody that you know or somebody that you trust to
12:53
coerce a user into clicking on a link.
12:56
These types of emails are, you know, used to be easy to flag.
13:00
They had a lot of typos or the English didn't quite make sense.
13:04
Now with AI, they're very sophisticated.
13:07
They can be very effective. I kind of miss the Nigerian
13:09
Princess though. I mean, I was really hoping one
13:11
of those would pay off for me. So nostalgic.
13:14
Yeah, exactly. And so, so people that feel
13:16
like, hey, I'm very good at detecting these, I don't get
13:19
trapped with these. They're finding more and more
13:22
that they are in fact getting getting stumped by these.
13:25
And so one of the things that's really critical is to have
13:28
phishing resistant authentication.
13:30
That was one of the things we were recognized for at RSA with
13:34
the Global Infosec Award and being phishing resistant MFA,
13:37
but also on the recovery side. So on account recovery, this is
13:41
a a critical issue. It was something that I
13:43
presented on at Authenticate this week was when you think
13:46
about The MGM casino hack, you know what happened there?
13:51
Well, they took advantage of the account recovery scheme,
13:55
pretending to be an employee and gained access to the system and
14:00
perpetrated a ransomware attack. And so this is, this is really
14:04
critical because when your authentication is bound to a
14:09
phone, for instance, if you lose that phone, then how do you
14:13
authenticate? Well, you can't.
14:14
So you fall back to account recovery.
14:16
You call in, oh, you know, I lost my device, I forgot my
14:19
password. You have to let me back in.
14:22
Unfortunately, a lot of the account recovery is the weakest
14:25
link in the identity system. The account recovery social
14:29
engineering, what you brought up with the phishing emails.
14:31
I actually, as an example of the reverse, I got a e-mail from my
14:37
insurance company saying click this link.
14:39
Like, no way am I falling for that.
14:41
You know, I know better. Then I get a text message from
14:45
them and a chain of text messages that I've talked to the
14:48
insurance company. So that's legit.
14:51
But they almost have to design their emails now so that, you
14:55
know, the US, the, the folks like us who are smart enough to
14:58
avoid spam, don't think their emails are spam.
15:02
I wanted to go back to this congressional committee again
15:06
and kind of I, you know, Congress isn't thought of as the
15:10
most technically savvy votes. So how do you take what you're
15:15
presenting to them on and turn it into real world
15:18
recommendations that they can do something about?
15:21
Yeah, great question, Jim. And it was really great and
15:24
refreshing to see this bipartisan caucus talking about
15:28
this issue and the importance of privacy and what can we put in
15:31
place today. One of the main reasons that we
15:34
were invited to this talk is that the need is out there to
15:38
share with the world that, hey, there now exists technology that
15:41
eliminates the need for central databases of biometrics.
15:45
We've seen with the BIPA legislation, the Biometric
15:48
Information Privacy Act, which started in Illinois, but now we
15:52
have dozens of other states with similar modeled legislation
15:55
pending, that the storage of biometric data is quite
16:00
prevalent. And when you think about the
16:02
companies that are storing this data, it's somewhat surprising,
16:06
right? BNSF, Railroad, White Castle,
16:08
you know, why does White Castle burgers need that Rite Aid, All
16:11
of the types of companies that are storing this biometric data
16:15
and you ask, you know, why are they storing it?
16:17
Well, in many cases, they're just trying to authenticate
16:20
their users, authenticate their workforce.
16:22
And so, you know, people show up to work at different locations.
16:25
They need to prove it's them and get to work, and having a
16:28
central database of biometrics is a quick way to do that.
16:32
Now. Unfortunately, it's also a very
16:34
ripe target for attack. Well, with BADGE you can
16:37
actually convert an existing database of biometrics into
16:40
public keys, eliminating that threat surface but still
16:44
allowing users to authenticate on any device.
16:48
So we get jaded, I think, to the number of attacks that we see
16:51
coming across the wire. It seems like every week I get
16:55
3510 emails. Your data is part of a breach.
16:59
OK, great. What am I supposed to do about
17:01
that? I want to give a, a, a shout out
17:03
to Kyle, who's sitting here off camera.
17:05
He came up with this, this, this term of a data pandemic, which I
17:08
think we're in where, you know, there's all this data that's out
17:11
there. And it's becoming more and more
17:14
available through means that they're not supposed to be
17:17
available. So, you know, maybe the answer
17:20
to this is simple, but why are data breaches so commonplace
17:23
today? And do you think that we've
17:24
gotten jaded as a society or an an industry that's like, OK,
17:30
you're not going to go change your fingerprints, right?
17:32
What? How do we approach that?
17:34
Yeah, that's a great question. And and I agree that your
17:37
discussion with Kyle really brought out, you know, it's like
17:40
a, it feels like a data pandemic that we, we have these
17:43
conferences year after year about how we can protect these
17:47
issues. But what we're actually seeing
17:48
is the numbers are going up. It's now over 80% of data
17:53
breaches are due to the theft of identity credentials.
17:57
So what are we doing as an identity, the industry to really
18:00
turn the tide? And that 80% I believe is from
18:03
the Verizon data breach report. And that number has not changed.
18:06
I mean, I look at it every year and I think since 2018 or 2019,
18:10
it's been the same pretty consistent 80% of breaches have
18:14
something to do with a compromise credential.
18:16
So what are we supposed to do about that?
18:19
And the other thing is we're actually making the problem
18:21
worse by putting more and more data into these databases, such
18:26
as biometric data, which as you pointed out, Jeff, you, you
18:29
can't reset and it's in more and more places.
18:32
You actually can't get into the Disney World theme parks in
18:36
Florida without scanning your biometrics, having them stored
18:39
in a central database. When you go through the airports
18:42
with clear, you know, that's 20 million users biometrics stored
18:46
in a central database in New York on a server.
18:49
And the problem is that we don't have the luxury to redo this in
18:53
10 years. We need to get it right now and
18:55
we need to prevent this type of OPM scale breach from happening
19:00
to the average American consumers.
19:03
And we have the tools today to make that possible.
19:06
And we need to think critically about what are the tools
19:09
available and what are what are the protections we actually can
19:12
offer to consumers today. So, Tina and we live in this
19:17
world of the digital economy. We really can't be an equal
19:21
member of society without your identity and this digital world.
19:26
So what are some of the challenges in making sure that
19:29
access to the economy and access to services provided by the
19:35
government etcetera, as we become higher and higher tech,
19:39
how do we make sure that that's available to everyone?
19:41
What are the challenges to that? I love that question, Jim.
19:44
I think it's really critical. We found that identity is really
19:48
the way that people access the economy, that access education,
19:53
access healthcare, access their banking and financial
19:56
information. And so you've reached a
19:58
situation where access to identity needs to be a right and
20:04
therefore it needs to be inclusive to all people.
20:08
Sometimes we live in this Silicon Valley bubble and we
20:12
create these solutions. And when you step back you
20:15
realize, oh, not only do I need an iPhone, but I need a backup
20:20
iPhone in order to recover my account if anything happens to
20:23
my first iPhone. And it's got to be at least an
20:26
iPhone 15 or something like that.
20:28
Yeah. Yeah.
20:29
It's easy to fall into that trap.
20:30
Yeah, exactly, Jim. And I think that's the issue is
20:33
that when you think about the world or even just the United
20:37
States, that's not a reality for most people.
20:40
People use shared workstations in library to access things.
20:45
And when we think about, OK, hey, we're adding security by
20:47
having an MFA requirement, well, what are we actually doing?
20:51
We're saying that you actually have to be bound to a physical
20:54
hardware device. Well, that's not always an
20:57
option. The other thing is if that
20:59
particular phone is the route that allows you to access your
21:04
information, we have to think about places where not every
21:08
individual has ownership and control over that device.
21:11
So one example in particular, Jeff, that we talked about that
21:15
really means a lot to me and that I wanted to share on the
21:18
show is, is with women. When you talk about a domestic
21:23
relationship, in some cases women don't have full autonomy
21:28
and control over that device. And if that device is sufficient
21:33
to access your healthcare data, your banking data, it means that
21:38
that privacy and that autonomy is not afforded to women in that
21:43
that domestic relationship all the time.
21:45
We need to have the ability that when I'm in possession of that
21:49
device, I can recover my data, access my information, but then
21:52
as soon as I'm not, no one else with that device can access that
21:56
information. And it's becoming more and more
21:58
critical today as we think about healthcare privacy and the need
22:02
for people in All in all areas to have that access and
22:07
inclusivity. And I think that's, you know,
22:11
This is why I like doing this podcast and having these
22:13
conversations because that, that idea of a domestic abuse
22:17
situation never occurred to me. And that's why I like him in his
22:21
conversations. Like ever since you've said
22:23
that, it's been in my mind, I was like, oh, yes, this is
22:26
something that we as an industry need to figure out how to solve
22:30
and how to protect folks who are in those types of scenarios.
22:33
And it, it can be that it can be, you know, access issues, you
22:35
know, whatever it may be, the, the availability of being able
22:39
to have a digital identity in the 1st place.
22:40
There's still a lot of places that don't have modern cell
22:44
phones, modern technologies where they're able to take
22:46
advantage of that. But I think that's, I think
22:48
that's one of the things that I really appreciate about one,
22:50
having met you last year. And then you putting that bug in
22:53
my ear of like, yeah, I haven't thought about that.
22:55
And, you know, that's probably me as a male and the role I'm
22:59
in. I haven't thought about that.
23:00
And I think that's why we want to have conversations like this,
23:03
to bring those things up, because I'm sure there are other
23:06
people that are out there that, yeah, Tina, tell them, you know.
23:10
Yeah, I'm really glad about that and I'm glad that it had an
23:12
impact and I appreciate that because we have to have these
23:15
conversations. We have to talk about
23:17
inclusivity, making sure everyone has access.
23:19
Another, you know, part of it is accessibility, how to make sure
23:22
that these technologies are accessible.
23:25
That's something that at badge we care about deeply in making
23:28
sure we have that testing and feedback from different
23:31
accessibility. You know, a lot of the ways, you
23:34
know, we're here at authenticate at the Fido conference, there's
23:37
a requirement that, hey, you have to use AQR code in order to
23:41
make certain flows work while holding up a camera with AQR
23:44
code lining it up for people that are visually impaired.
23:47
It's just a non starter. And we really need to offer
23:50
optionality to folks that that keep in mind and take into
23:54
account our full user population are the 8 billion people on the
23:58
planet. And we need to make sure
23:59
everybody has the access to that identity so that they can access
24:02
the economy and participate fully.
24:05
You know that that idea of having options, I think is is
24:07
really the key part there because there's a lot of people
24:09
CEO well, we just put in pass keys, we're done.
24:12
And it's like, OK, wait a second.
24:14
That's just one option that's out there.
24:16
It's the I'll use a Marvel analogy.
24:18
It's one of the arrows in Hawkeye's quiver and there's an
24:21
arrow for everything. Jim's rolling is his who is
24:24
Hawkeye now, but there's options that are out there and and it
24:28
doesn't have to be A1 size all it's, you know, solution for
24:31
people so. I'm with you on the marble.
24:33
Marble and Hawkeye, so all. Right.
24:35
Cool Hawkeye. Not cool.
24:37
I thought Hawkeye was on. Match Yeah, I'm sure you did
24:39
that. Just that just highlights the
24:41
age difference. Here, we're not that far apart.
24:45
I'm gonna go with it. So, so Tina, I think this is one
24:48
of many use cases where you have the, the shared device and this
24:52
problem could take place. I'm wondering in your mind,
24:57
whose responsibility is it to take this on?
25:00
Because it seems to me that, you know, you have the device
25:03
manufacturer, you have the, the telecom company, you have the
25:06
applications that require this second factor.
25:11
Who has to do something to fix it?
25:12
Or is it just got to be an industry effort?
25:16
Well, I can tell you for sure that we can't just rely on big
25:19
tech and assume that these problems will get solved.
25:23
We have to keep raising our voices.
25:25
We have to keep having innovative startups that look at
25:28
things differently and raise, raise these issues.
25:31
And we have to keep bringing them forward in these
25:33
conversations like the one we're having right now, so that people
25:36
understand the importance of this and, and frankly that the
25:40
people that are developing these solutions come from that same
25:45
inclusive, diverse background as the people using them.
25:48
So in this battle for privacy and identity, are we losing?
25:53
Is the user losing? Are we winning?
25:55
Is it a tie? Like, where are we at and how do
25:58
we address this battle? Well, on one statistic on
26:03
breaches, it looks like we're losing.
26:05
It looks like they're ever increasing like the data
26:08
pandemic. On the other hand, I think we
26:11
finally have reached the point that there are now technologies
26:15
that are privacy preserving that are actually able to deliver the
26:19
user experience that we demand along with the security and
26:23
privacy. So it doesn't have to be a trade
26:25
off. We can actually win on on all of
26:27
those fronts. I feel like it's like a tug of
26:30
war. It's.
26:32
It's a title work. Total work.
26:34
And I also feel like on the privacy front, it's there's
26:39
there's some buffs going on, right?
26:41
If you ever go to your iPhone, you see who's been tracking you
26:43
or you go to a website now and it says, do you accept these
26:46
cookies? You almost just reflexively say
26:50
accept. You want to get past that so you
26:52
can obviously you went to the website for a reason.
26:55
Now all of a sudden you've given them permission to track you or
26:59
Eve said you could say deny and they still may track you.
27:02
They may have something on the website that's tracking you.
27:06
So I, I feel like we're losing on the privacy front.
27:10
I think we're making gains in the, the breach area.
27:15
Like I do believe you're right that if you look at the breach
27:19
statistics, but I also I see the vendors in his vendor hall, how
27:24
many folks are trying to fight the good fight in that respect?
27:29
But I just kind of feel like until we have a good regulatory
27:32
environment around privacy, we're not going to to make
27:36
progress. Well, I mean, let's let's look
27:40
at GDPR, right? I think that was something that
27:43
really sparked a lot of behavior in EU and then that behavior has
27:48
started to filter over into the US as well.
27:51
But I think that was also one of the reasons.
27:52
Now you have a pop up on every website that says, Hey, we're
27:55
going to be tracking you. And if you either you're opting
27:59
in and you're using a service or you're not, you know, it's, I
28:02
don't know what the right answer is.
28:04
I maybe it's regulation, but then the, the counter to that
28:07
would be OK. Well, what about people who
28:09
don't care about the regulations anyway?
28:10
Criminals, they're not, they don't care about regulation.
28:13
So again, it's another area where we have yet another quiver
28:17
arrow coming out of the quiver. It's OK.
28:19
Well, regulation's part of it, but you know, people aren't
28:22
going to follow the law. So we look at the vendors in
28:26
this vendor hall that we're in now and say, OK, can they help
28:29
us? And maybe it's a layered
28:30
approach and things like that. It is a layered approach.
28:33
It is and I agree with you, Jeff, because you know, one of
28:35
the things that Bill Wright and I talked about at our
28:37
authenticate talk was about, you know, the regulation in the
28:41
financial industry in particular and the importance of having
28:43
compliance solutions on that side.
28:46
But broader to your, to your point, Jim, when you feel like,
28:49
you know, we're using this fight, well, let's think about
28:51
when we first had the Internet, we had this idea that you can,
28:57
you know, access whatever you want, talk to whoever you want.
28:59
It was this beautiful world, but that's not what it's turned out
29:02
to be. The way you just described it.
29:03
It's very frustrating. You have to provide all of this
29:07
data so you can just prove who you are.
29:09
You can access your stuff, then you get locked out, then you
29:11
don't have your phone, then you have to, then you give up on
29:14
your cart because, you know, it's just wasn't worth the
29:16
hassle in the 1st place. I think that we're going to a
29:20
point where people look back on this age and it it kind of looks
29:22
like a dark age and that the world is going to be so
29:26
seamless. You can you can get up out of a
29:29
swimming pool, walk up to any device you know, access your
29:33
data securely, walk away from that device and not leave any
29:37
trace behind. Go up to any system, whether
29:41
you're in a mall, in a store, in a virtual experience, be able to
29:45
prove who you are. And that big question that today
29:49
is lingering over us. How do I prove who I am without
29:52
ceding it to some Big Brother or central database?
29:55
I think that that problem is, is what we're on a mission to solve
29:59
so that. The big question like who is
30:01
that Big Brother that we trust? Because I don't think there's
30:05
one that everybody trusts. I think that there cannot be a
30:10
Big Brother because I don't think that you'll ever reach a
30:13
point where you should be able to trust one.
30:15
The way out of this has to be you.
30:18
You are the root of your identity and you don't have to
30:22
trust anyone. That has to be the way out of
30:25
it. Not having a Big Brother and yet
30:28
working in an interoperable community where you can prove
30:31
who you are to any data, any application, any service,
30:35
anywhere in the world. To me, that's terrifying.
30:38
If you think about the normal user out there, they just click,
30:41
OK, OK, accept whatever, and they're giving away their data,
30:45
their privacy rights, whatever, ever the things in exchange for
30:48
whatever it is they're trying to do.
30:50
And I get it right. I use Google Maps and I'm fine
30:52
with that. So they know where I am, or at
30:54
least they know where my phone is.
30:56
So I'm trading a little bit of privacy, maybe a lot of privacy,
31:00
in exchange for being able to know where I'm going to go.
31:02
And I don't have to have a AAA triptych printed out in my car.
31:06
The problem would. Be so say I trust Google to have
31:10
my information where I am if they start selling it to other
31:13
parties like, oh, he's near Brooks Brothers now Brooks
31:17
Brothers says I'm going to start sending you a bunch of
31:20
advertisements or text messages like that's cringy to me.
31:25
Cringy, but. Do you click on the ad?
31:27
Oh yeah. I really wasn't the market for
31:28
that. Yeah, but I used to kind of.
31:30
A safer example, but yeah. You know there could be some.
31:33
Company that you don't know where that data goes so perks
31:36
brothers traded it off with click.com now where does that
31:42
data go who has access to that data and there's a lot of these
31:44
large. Data brokers that are collecting
31:46
all this information and that is their entire business model.
31:49
I don't wanna get too far down into that, but no, I think
31:51
that's a great. Point and Jim, it's exactly what
31:53
you said. You don't know where that data
31:55
goes and the fact of the matter is if that data is stored, you
32:01
can't just rely on the promises of a company as to what they're
32:05
going to do with that. Their incentives will change and
32:08
if they have the ability to monetize it or they reach a
32:11
different situation, that'll be what happens.
32:13
There was recently a Bloomberg article about Worldcoin and it
32:17
highlighted the the fact that there are these different
32:20
incentives. My Co founder, Doctor Charles
32:23
Herder pointed out that hey, whatever the promises are that
32:27
they're making today, they may not be able to uphold those
32:31
promises later. The only way you know as a
32:33
consumer for sure that those promises are there is if they
32:36
technically, physically cannot monetize the data.
32:40
If they don't have the data, they can't monetize it.
32:43
That's kind of where I was going with it too.
32:44
It's like. We're really good at giving away
32:46
data. We're terrible at taking away
32:48
data and may not even have the ability to do that.
32:51
Right. If I give an application or
32:53
whatever permission to do something, I might uninstall
32:57
that app three months later, a year later, and I never pulled
33:00
back those rights. That's right.
33:02
And that data is still out there.
33:03
Yeah. Revocation.
33:04
Is critical and as consumers we need to demand it because if you
33:08
don't have revocation, then then you don't have, you don't know
33:12
where that data went and that's really fundamental for.
33:14
Identity, right? We see this a lot in our day
33:15
jobs is companies are really good at giving access to people,
33:19
but they're really bad about taking access away when somebody
33:22
moves, you know, a group or it gets transferred or promoted or
33:25
whatever it may be. It's very similar to the
33:28
consumer mindset as well as we're really good at giving away
33:30
our data in exchange for a service.
33:32
Not so good about flying that back.
33:34
Yeah, I was about to. Say Tina had her slam dunk
33:37
dropped the mic moment when she said take her own identity with
33:42
us, control our identity. I do think that's the best
33:45
answer. I think some of the concerns
33:46
you're bringing up are completely legitimate, but I
33:49
also think that's the future, right.
33:52
So that's maybe where we're heading.
33:55
Heck, maybe five years. I think that would be very
33:57
optimistic. Five years down the road, that's
34:00
where we are. But what about today?
34:02
What can consumers do today? And by the way, we're all
34:05
consumers. Even though we're in the
34:06
industry, we're still consumers. What can consumers do to start
34:10
safeguarding their privacy and security today?
34:14
Jim, I actually think it's. Closer than you realize.
34:17
And that's what we're excited about.
34:19
I mean that's why we're here at Authenticate is that these
34:22
technologies have actually reached the point where now as a
34:25
consumer you can demand that privacy, you can demand
34:28
revocation, you can say no, I don't want 23andMe to have my
34:34
data and to sell it to the highest bidder.
34:36
And I think we've reached a point as consumers that we have
34:39
a voice and we can influence that and there exist
34:43
technologies. Again, that was the the point of
34:44
the the bipartisan AI Caucus, to highlight that there now exists
34:49
technologies that can make that possible.
34:53
I kind of snorted because. When he said the 23 Mei yes,
34:56
reading I was reading that article the other day.
34:57
I'm like, all right, well, I never did it.
34:59
And I know that there is strong feelings by the way, I see the
35:02
benefit for it. But that's a.
35:05
Awful lot of data to have out there, yeah.
35:08
And it's like. It's your health data,
35:10
essentially, like, oh, you've got a gene that makes you
35:13
susceptible to this certain illness.
35:17
And now what? Is that open and sellable to
35:20
insurance companies? Yeah.
35:22
And then they raise your rates. Because or an insurance.
35:24
Data broker that sells it to every insurance company.
35:27
Like that's yeah, that's not where we want to be.
35:29
Those are the nightmare scenarios.
35:32
I thought you were talking about how we heard a big cheer in the
35:34
background as Tina started talking.
35:36
And I was like, yeah, Tina's used to that.
35:38
She. Always gets cheers whenever
35:39
she's talking. Why don't we start to wrap
35:41
things up because you've been very generous at the time.
35:42
We've got a keynote that's going to start here in a little bit.
35:45
I want to talk about some of the activities that have taken place
35:49
here at Authenticate. Last night was the party.
35:53
As I mentioned, there was karaoke and to my surprise, I
35:56
turned around, I was front row and I look and I see there's a
35:59
bunch of people and they start singing Katy Perry's Firework.
36:02
And on the end, who do I see but Tina rocking it out there?
36:07
Awesome. My hat's off to anybody who is
36:09
willing to go up in karaoke because this is what I sound
36:12
like, not singing. Just imagine what it sounds like
36:14
singing. It is.
36:15
It does not get any better, folks.
36:18
So how did you get up there? Did somebody make you do it?
36:21
Did you go up there of your own accord?
36:22
Spill the beans. I can't hide my excitement and
36:27
enthusiasm to sing Katy Perry with my my friends.
36:31
And, you know, we're all just having a blast.
36:33
This identity community has become so close and tighten it
36:37
and that it's just a it's just a fun time every time we're here
36:40
together. And and that's the group that I
36:42
love to hang out with wherever we are, whether it's an
36:45
identiverse or an authenticate and, you know, getting together
36:49
and it's not always about, you know, one thing or the other.
36:53
We may debate stand or we may debate rollouts, but when we get
36:57
together, ultimately we're all trying to make identity better
37:01
for the world. We're all united by that
37:03
mission. And so we can get together and
37:04
have fun. And yes, I had quite a few
37:06
cheers. Thank you very much.
37:08
So we, I think we all did a great job.
37:10
And with all my buddies up there, I wasn't alone.
37:14
But yeah, it was, it was a lot of fun.
37:16
So is karaoke something? That you've done before.
37:17
You like to do it. Is this a one time thing?
37:20
And I only have the video from last night and that's the only
37:22
copy that exists. You have a video, I have some.
37:25
Video I talk about might end up in.
37:27
This little podcast video. Maybe not.
37:31
I don't know I'm. Already.
37:32
Living to regret it. Most of my singing is reserved
37:36
for the car. Well, if I protect your.
37:38
Privacy. We're we're good like that.
37:40
There you go. I'll blur.
37:41
I'll put a. Blur over it when I first when
37:44
I. First soloed as a pilot, the
37:46
first thing I started doing was singing in that cockpit and it
37:49
was amazing so I'll. Blur your face and I'll put
37:53
something like definitely not Tina with an arrow.
37:56
I'm sure that's totally fine. Truly privacy.
37:58
Preserving and then your DNA. Sequence.
38:01
Yeah. Yeah, exactly.
38:02
There you go, Jim. Are you a?
38:03
Karaoke guy. I know you are because I've seen
38:06
you. You've seen me karaoke.
38:08
Yeah, so, you know, I'll do a country tune or two like some
38:11
Morgan Wallace from Riley Green. Those are my favorites.
38:14
I sing a lot in the shower, but not in public.
38:18
My partner Denise obviously is a very good singer.
38:22
I would have loved to have had her come out and sing some heart
38:26
for Andrew Shikiar. That's crazy on you.
38:28
Totally missed opportunity. Yeah, you were too busy with
38:31
the. Yankees.
38:32
I mean, look, I've. Watched like 120 games during
38:35
the regular season. What?
38:36
I'm not going to watch them in locked over.
38:38
Kind of crazy, but I did what I had to do.
38:41
Well, I'm not a karaoke. Guy, I like to watch it, but I
38:44
cannot sing so I don't even bother.
38:47
Hey, we'll get you up there. I will I.
38:50
Will run out of the room. I will toss chairs in front of
38:53
you so you can't chase me. That's how opposed to getting up
38:57
there that I would be. Well, you are in front of a mic.
38:59
Right now, yeah, this thing is I'll do this.
39:00
This is fine all day, but as soon as the the tune starts to
39:03
come out like no, nobody wants to hear that.
39:05
Trust me, we got to hack. The next podcast to put in the
39:08
music and the background and get you grooving like a groove, you
39:12
know? Yeah, we.
39:12
Actually. Changed our our podcast song
39:15
beginning of the podcast Doo Doo Doo Doo Doo and we got so many
39:19
complaints. People loved it.
39:21
Yeah, they like the Jingle. So we've just.
39:22
Kept it. So we've kept the yeah.
39:23
All right, let's get to this. Keynote, we're going to wrap
39:25
things up for this week. Tina, thank you so much for
39:27
joining us. Hope to have you back on the
39:28
near future. See you probably conferences
39:31
later this year, Gartner or something like that.
39:34
You can find us on the web, IDC podcast.com yes, Jim, we have a
39:37
YouTube channel, yes, idacpodcast.tv.
39:40
So we're putting videos like this and all of our episodes up
39:43
there as well. So like and subscribe, do all
39:45
the fun things like that. I'll have a link in our show
39:47
notes to where people connect with Tina and to learn more
39:49
about Badge Badge Inc inc.com. We'll get you more information
39:54
about that. And yeah, you can connect with
39:55
Jim and I and let us know what you think about these episodes.
39:57
And this is our final episode of Authenticate.
40:00
So definitely want to thank Fight Alliance, Andrew, Adrian,
40:02
Megan for bringing us out here and helping coordinate the
40:06
Family Feud thing was so much fun.
40:08
I hope we can do that again at some point in the future.
40:10
And then again, RSM for funding our travel and getting out here
40:13
and paying for Jim's $40 breakfast this morning.
40:15
Yeah, it's wonderful. All right, we'll go ahead and
40:17
talk with. Everyone else later and see you
40:20
in the next one you've been listening to.
40:24
Identity at the Center. We hope you've enjoyed the show.
40:29
Make sure to like, rate and review, and we'll be back soon.
40:33
But in the meantime, hit the website at
40:35
identity@thecenter.com. See you next time on Identity at
40:42
the Center.