Latest / Identity at the Center / #373 - Going Passkey Phishing with Nishant Kaushik

Transcript

#373 - Going Passkey Phishing with Nishant Kaushik · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity of the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Not so bad yourself. Doing great, man.
0:18
Other than the fact that I've been working on writing identity
0:22
access management policies all day.
0:24
But I mean, hey, what thing can you do this more important than
0:28
that to having a successful IAM program and having a good
0:33
bedrock of solid IAM policies? Rules of the road are important.
0:38
Got to know which side you're driving on, what speed limits
0:41
you can go, you know all that good stuff.
0:43
Prevents accidents. That's right.
0:45
I mean, it's at least a good starting point.
0:49
And then you kind of you build your automation on top, you
0:52
build your controls, but it's a good, it's a good approach to
0:58
have that is like your foundation rather than starting
1:02
with the technology. And then I'm trying to retrofit
1:04
policies to fit the the technical capabilities that you
1:08
have. See, I don't know if I would
1:10
agree with that. I think you should write a
1:12
policy is the way it should be, and not with your technology
1:15
limitations in mind. Those would be treated as either
1:18
exceptions to the policy or some other kind of mechanism.
1:22
So in other words, you agree with me completely because
1:25
that's what I that's what I meant to say.
1:27
However, it came out exactly what you said.
1:30
OK, then yes, we're on the same page and I and I concur Dr. All
1:35
right, Doctor. Yeah.
1:36
You know, the tough thing is sometimes taking some of the
1:39
newer standards, like the newer standards around 863 B with the
1:46
authentication insurance levels. I'm just trying to apply them
1:50
because essentially what I think what they say is if your, if
1:56
your data or your systems require this level of assurance,
2:00
then you should apply these controls.
2:03
But you have to kind of come up with a framework for the, you
2:06
know, how the organization decides what level of assurance
2:10
is required for that data, right?
2:12
Is it top secret systems or what is the classification or what
2:16
are the those rules of the road that your organization, you
2:21
know, maps to those assurance level?
2:24
So I won't say that I won't use the word fun, but important
2:29
work. Yeah, important, interesting, a
2:35
thinking game, fun. I don't know about that one.
2:38
But good news is once you've got it down, you know, you kind of
2:42
get your, you know, get your, your framework in place, get
2:44
your templates in place and just start filling in blanks of what
2:46
you want it to look like and, and stuff like that.
2:48
This should not be like a very difficult exercise.
2:51
Technically this is more of a political exercise.
2:54
What can the organization tolerate?
2:56
Yeah, you're right. I mean, often times it's
2:58
political because they, I think you and agree, you and I agreed
3:02
in theory that you want to write your policies for the way things
3:05
should be, not for the way they are.
3:07
There's not many senior executives that want to put out
3:12
a set of policies and immediately be out of compliance
3:15
with their own policies and have no hope of getting there within
3:18
the the near term. So the reality is, is it's
3:23
probably you're designing your policies somewhat based on where
3:26
you are with the goal of hardening them over.
3:31
Time. See, that's the catch 22 that
3:33
comes up is as soon as you write a good policy, you're
3:36
automatically out of compliance. And so like, you know, how do
3:40
you how do you demonstrate that to auditors or whoever you got
3:42
to show these to you is like, yeah, by the way, this policy,
3:44
are you compliant? No, but it sure is.
3:46
You know, this is where we want to be.
3:47
So you need to have a conversation with internal
3:50
audit. You know, you know, there's
3:52
C-Suite, etcetera, say, OK, how do we want to approach this?
3:54
Because if you don't have a good policy, then that just means
3:57
your security is weak. If you don't have the technology
4:00
to support the policy or the people or the processes that
4:03
those are also deficiencies. So it really is a little bit of
4:06
a political game and trying to make sure that everyone
4:10
understands, you know, where you are today, where you should be
4:14
and what is the approach to explain that, you know, policy
4:16
wise. And then obviously getting make
4:18
sure your auditors are on board as well so you can defend it.
4:21
I mean, that's, that's ultimately what, you know,
4:24
that's one of the real challenges for the practitioner
4:27
is dealing with. We all philosophically know the
4:31
right way to do things and at the same time we have to apply
4:35
pragmatism. I think you've got to find
4:38
strike the right balance. I mean, if you only go for the
4:41
lowest common denominator every time, it's just going to be the
4:45
definition of that term laggard. I think what's cool about being
4:49
a consultant is that you get to work with a lot of different
4:53
organizations and you have to kind of help your clients find
4:58
that that right pragmatic level between the reality and the
5:04
goals. And so, you know, obviously,
5:08
like we agreed, there's something about fun.
5:11
But I'll tell you one thing that I do find fun is conferences.
5:15
I think it's just fun to be there with our fellow identity
5:20
practitioners and get to know them, for them to get to know
5:23
us. We've got a bunch of discount
5:25
codes. What do you think?
5:27
I mean, we haven't been reading them off for the last few
5:29
episodes, even saying go to the website.
5:33
But maybe we ought to at least give the rundown of what
5:36
conferences we're actually going to.
5:38
And we have count I have discount codes for.
5:41
Yeah. Jim, would you say we have a
5:43
plethora of discount codes for conferences?
5:47
Yeah, and we have a guest, so we don't want to go through all of
5:49
them and then we'll have to end the episode, right?
5:53
This is a, a treatise on all of our conference discount codes,
5:56
Part 1A of, you know, 48. Let's just run through them real
6:00
quick. So we've got the official
6:01
Cybersecurity Summit. I think by the time people
6:03
listen to this, the IT will be probably too late maybe for the
6:07
one in Chicago that I'll be at, but Philadelphia should still be
6:10
available September 25th. I will be there as well.
6:13
So by the way, all these codes are on our website,
6:15
idacpodcast.com. Just Scroll down a little bit,
6:18
you'll see everything we've got listed there.
6:20
And I'm constantly adding new ones as we as we get those in
6:23
partnership with those folks. So that's Cybersecurity Summit.
6:27
Then we've got Authenticate 2025, which we're actually going
6:29
to talk a little bit more about here today.
6:31
That's coming up as well. So that's in October in the
6:34
lovely Carlsbad, CA. I just got back from Monterey,
6:37
CA like literally yesterday. So I'm heading back in a couple
6:41
weeks to enjoy coastal California weather.
6:43
You poor thing. I know, poor thing, I did come
6:46
back to find 2 nails in my tire at the airport.
6:49
So that was good times at about 1:00 AM.
6:52
But first of all problems, we're fine.
6:54
So that's the Authenticate conference.
6:56
Then we've got Infosec World, that's a new conference for both
6:59
you and I, Jim, that we've never been to, but we're happy to
7:01
partner with our friend, friends over at Sierra.
7:03
So shout out to Shirley. That is in Lake Buena Vista, FL
7:07
October 2728 and 29 discount code for that as well.
7:11
We got a couple special codes as well because they have like
7:13
government discounts and things like that.
7:15
And then we've got Ideniverse in DC in November.
7:19
And then I think what will be the last conference of the year,
7:21
which is the Gartner IM Summit in Grapevine, TX in December 8th
7:25
through the 10th. So we have a discount code for
7:28
Gartner coming soon. It's not up on the website yet,
7:30
but it will be coming. I think in October is when we're
7:32
we're able to post that. So keep an eye out for that.
7:35
IDC, podcast.com, Scroll down, everything's there.
7:38
Did I miss anything, Jim? No, no, I mean, I'm excited for
7:42
all of them, but special shout out for Infosec world.
7:46
You have a little bit of Disney while we're there, right?
7:48
And you know, I'm thinking if you're looking for a work
7:53
vacation where it maybe you bring some family members, roll
7:57
it all into one, why not? OK, So why don't we get to our
8:00
guest today? He is Nishant Kaushik.
8:03
He is the new CTO at Fido Alliance.
8:07
He's been with us before. But welcome back to the show,
8:08
Nishant. Thanks, Great to be back.
8:12
Yeah, so I was kind of shocked that it's been so long.
8:15
This is actually your third appearance with us.
8:17
You were way back on episode #73 and then episode 171.
8:22
So we've got to cut your origin story back then.
8:24
We'll ask people to go back and check that out.
8:27
And then I think this is going to be episode #373 if my math
8:30
lines up. So welcome back again.
8:33
And I did introduce you as the new CTO.
8:35
That is relatively new role. So within the last month or so,
8:39
I can't even write 2 weeks. OK, so, so there you go.
8:42
So what have you been up to now? You're with Fido Alliance as the
8:46
CTO. I thought we had solved
8:48
everything, you know, with pass keys.
8:50
And now we're done. Like what do you have left to
8:51
work on now? Well, I think.
8:56
It's interesting, when I was interviewing for this role, it
9:02
was one of the same, same thoughts was like, what's next?
9:05
Like why, why do why would I want to take this job?
9:09
And I think part of the challenge is digital identity is
9:15
getting so much broader that you kind of have to look at it in
9:19
the full picture and passkey is, is a important, but a part of
9:23
that picture. And I think we still have a long
9:26
way to go from having the right solution to actually having that
9:31
solution making a difference. And when I, when we were
9:35
discussing this role, one of the key things that I kept coming
9:39
back to is my own frustration that, you know, we've been in
9:44
this industry for so long, all of us, you know, on the vendor
9:47
side, practitioner side and so on, and standards bodies,
9:50
etcetera. And some of the smartest people
9:54
I know, the best people I've done were doing great work.
9:57
And yet everyday you're still seeing stories about breaches
10:00
and continuous, you know, stories about identities being
10:04
stolen. It's like, why haven't we gotten
10:07
there yet, right? Everyone says, are we there yet?
10:10
No, we're not. And a big part of that is coming
10:14
up with the solution isn't really the only thing.
10:17
It now has to scale. It has to be deployed and it has
10:21
to work for everybody. And I think there are still ways
10:24
for us to go before we solve all of the problems required to
10:28
achieve that There there's. So it sounds like there's still
10:32
ways to go here. And the really the reason that
10:36
we wanted to have you on, and this is kind of fortuitous
10:38
timing, is there was an article that was on the ID Pro
10:43
newsletter that just came out recently talking about Black Hat
10:47
and RSA and some of the concerns that were popping up around
10:50
past. He's on there.
10:51
So shout out to Rusty Deaton. He's the author of the article.
10:55
So I'll link in our show notes where people can kind of check
10:57
out what we're going to be talking about here and kind of
10:59
follow around. But have you read that article?
11:01
And if So, what are your sort of your initial thoughts on it?
11:04
Yeah, you know, as a, as a founding member of ID Pro, I
11:09
always pay attention to the ID Pro newsletters.
11:11
So it was not surprising to see that article.
11:15
You know, it's, there's been a few actually, right.
11:20
Not just Rusty's, but there's been a number of things in the
11:24
press where they people, journalists are going to the
11:28
same conferences, Black Hat, etcetera.
11:30
And they're attending these sessions and just walking away
11:34
with takeaways that are half the picture or are, you know, sort
11:39
of not really examining in things in a full in a full way.
11:43
And I think Rusty did a great job of sort of laying it out in
11:47
terms of, well, it's A1 sided story being presented on stage.
11:51
It's not looking at the entirety of the thing.
11:53
And I think one of the important things to take away from Rusty's
11:57
article, and there's a really good article on our Technica as
12:01
well. And I just wrote a blog post for
12:04
the Fighter Alliance blog, official official blog, which is
12:08
to understand that pass keys doesn't exist on its own.
12:11
It exists as part of a broader authentication framework,
12:15
digital identity framework. And so when you're looking at
12:20
the threat models that you have to account for, you have to
12:23
understand that pass keys operate within the threat model
12:25
that your organization operates with.
12:28
And you have to put in place supporting infrastructure for
12:30
any authentication framework, not just pass keys.
12:32
Maybe you're rolling out, you know, username, password, and
12:35
SMSOTPXOMER images still are doing.
12:38
Maybe you've gone to authenticator apps, so you're
12:40
using Microsoft Authenticator. Maybe you're using hardware
12:43
tokens. It doesn't really matter what
12:45
your authentication framework is.
12:47
It doesn't exist in silo. It still relies on the
12:50
environment within which the user is going to be operating.
12:52
And you still need to do the work to ensure that the
12:56
operating environment can support the Security benefits of
13:00
the authentication framework you're putting in.
13:02
And Passkey is no different in that sense.
13:03
So, yeah, it's great that it we have a technology that is
13:08
phishing resistant, that is based on cryptography as opposed
13:11
to shared secrets. But you're still operating with
13:14
browsers, you're still operating on a myriad of desktops and
13:17
platforms and phones all over the world.
13:20
And you have to account for the differences those bring in and
13:24
map those back to sort of your threat model.
13:27
It's it's what you were discussing earlier, right?
13:29
Policy. You don't define policy in a
13:31
vacuum. Policy has to work for the
13:34
organization, but it also has to work for the people that you're
13:38
going to be applying those policies to.
13:41
And you can't treat every end user as if they're the president
13:44
of the United States or, you know, the CEO of a Fortune 5
13:49
company, right? You have to, you know, talk with
13:53
the correct health model and therefore apply policies based
13:56
on that. And PASI is going to solve all
13:57
of that. Like, you know, PASI is not a
13:59
silver bullet. It is in a pretty cool solution
14:04
for a very specific problem, but it has to work beyond that.
14:09
Yeah, it seems to me kind of the take away I got from the article
14:13
was I think where you're going with this is that passkey is one
14:18
of the solutions you can use. And I guess what I'd want to
14:21
know as a practitioner is like where is it meant to be used?
14:26
Or maybe alternatively, it's looked at as where does it not
14:31
make sense to use it because it could potentially fall prey to
14:37
some of these things that Rusty brought up.
14:40
Yeah. So I think if you look at what
14:45
Rusty was commenting on with respect to the some of those
14:49
presentations and all those presentations were talking about
14:51
how pass keys can be hacked or pass keys can be stolen.
14:55
The fact of the matter is that pass key cannot be stolen.
14:58
What you can do is work around the pass key and attack the
15:03
authentication framework around it.
15:04
So for example, you know, if you can trick the user into going
15:10
through an account recovery flow, you know this is not new,
15:14
right? We've talked about this as
15:15
practitioners and for a long time, which is the stronger you
15:19
make the front door, the more likely the attacker is going to
15:22
go look for the back door or the windows and so on and so forth.
15:25
So a long time ago I wrote one of one of the body of knowledge
15:30
articles for the I for ID Pro called, you know, MFA for
15:33
humans. And our key part of that is that
15:36
when you implement MFA, you are making your authentication
15:40
stronger, which means you are create creating more incentive
15:45
for attackers to now start testing other parts of your
15:47
authentication framework, including especially your
15:49
account recovery flows. So anything that any
15:53
organization that is implementing pass keys is going
15:58
to get really good authentication characteristics
16:01
from that really good security. But now that means, OK, now
16:05
let's make take a look at all these other aspects, right?
16:08
So let's look at your account recovery post with look at look
16:11
at things like your notifications are banned.
16:13
Let's look at things like browser or hygiene, especially
16:16
if you're in an enterprise environment, you can see some of
16:18
the higher, higher risk enterprises going towards things
16:21
like hardened browser. Why?
16:23
Because they want to eliminate the threat of malicious
16:26
extensions that people can just deploy on their browsers if
16:30
they're using their own devices, right?
16:32
So stuff like that has to be accounted.
16:34
For yeah, it kind of feels to me like you're not here just
16:39
saying, OK, these aren't valid concerns, but you're saying, OK,
16:44
yes, these, but these are things that are understood.
16:47
They are shortcomings to how authentication is done today,
16:52
right until you truly solve how authentication was done, I mean,
16:58
you know, yes, these these problems were going to continue
17:01
to exhaust. Is that am I hearing it right?
17:06
In in a nutshell, yeah, like we talk about identity programs for
17:10
a reason, right? It's not deploy a product and
17:13
you're done. You have to have identity
17:15
programs. So you're right, you know, as as
17:17
more work is put into making passkey stronger, better, more
17:21
easy to use, it means you're going to get better security.
17:25
But it also means you now have to start looking at other
17:28
aspects of your security program.
17:29
Like, you know, there's such amazing work happening with
17:32
things like shared signals as well as continuous identity
17:37
continues to unintended, continues to evolve.
17:42
One of the reasons why for example, Fighter Alliance
17:46
started working on identity verification and binding is
17:50
because of the fact that you can't really rely on a strong
17:54
credential if you don't secure the way in which the credential
17:57
is created and bound to the identity in the 1st place as
18:01
well as how you go through recovery rules for for re
18:04
establishing a lost credential and so on.
18:06
So that's the reason why Fido Alliance went in and with the
18:10
members worked on the identity verification and binding working
18:12
group. So you have to continue to look
18:14
at the full picture, absolutely. And all these, any technology
18:19
never ends, right? So obviously we have to continue
18:24
to listen to security researchers who work with, you
18:28
know, the technology as it is today and can you to help
18:31
identify ways novel, novel attack methods or different
18:36
things that are being brought up.
18:38
We're always receptive to that. We have to be just because
18:41
technology evolving means protocols, standards, solutions
18:45
have to evolve. So it's a never ending cycle in
18:48
that sense. And that's part of the one of
18:51
the reasons why I I joined the fighter analysis.
18:54
There is still a lot to be done and it has to continue to evolve
18:59
as we continue to move in this, you know, increasingly digital
19:03
world. You know, one of the things I
19:06
remember Rusty brought up in this article was if you're kind
19:09
of, I mean, some of these attacks, I I think admittedly
19:13
are kind of sophisticated, but it was around if you are, let's
19:18
just say you're a journalist or human rights activist, right?
19:21
And you might be somebody who is the target of a state sponsored
19:25
actor, whatever your role might be in society and maybe pass
19:31
keys aren't for you. And I kind of thought to myself,
19:34
you know, with the sophistication of these attacks
19:37
is it was, I think tied to a lot of the, the fishing of sync pass
19:43
keys, right? And I thought to myself, well,
19:46
if you're in that kind of space, hopefully you, you're not as
19:52
susceptible to being fish as the the common human being is.
19:58
I don't know if that makes sense.
19:59
But in other words, it's like I'm a human rights journalist,
20:03
right? I shouldn't be sending money to
20:05
the Nigerian print scam. I think I think you're spot on
20:12
in that. As I said earlier, threat models
20:14
matter a lot, right? So as anybody who's deploying
20:18
pass keys for their audience, for their user base needs to
20:23
understand that it's one thing for you to be a retail
20:27
organization that is selling online, you know, charge keys.
20:32
It's a very different thing if you're, as you said, you're a
20:35
journalist who may be going into areas where you have to worry
20:40
about your security, you have to worry about phones.
20:42
A lot of the, one of the, I think one, if I remember
20:46
correctly, one of the demonstrations that Rusty talked
20:50
about requires proximity. So it's not a remote attack.
20:53
You have to be near somebody to be able to launch that attack.
20:56
And so proximity based attacks have add a whole different
21:00
dimension. Do this equation right.
21:03
So all those things matter. The, the platform providers, the
21:06
credential providers, they're all getting, you know, much,
21:09
much better at securing your credentials, including your pass
21:12
keys. If you're a journalist and
21:14
you're using, you know, for I think it's advanced protection
21:17
mode or something like that on, on, on app on iPhones that you
21:21
can deploy that can help, you know, even secure your phone at
21:26
a much in a much better way. A a journalist who knows that
21:31
they're likely to get targeted understands that and is probably
21:33
taking those kinds of security measures anyway, comes back to
21:36
environmental concerns. So absolutely sync passkey is
21:39
aren't necessarily a bad thing, even if you're a targeted user.
21:43
It just means that you have to understand you're in your
21:46
environment more accurately. And you know, it's going to be
21:50
coming increasingly common, for example, for people who are
21:53
going to be targeted to work, work with burner phones.
21:56
You're not going to log in with the same credential provider on
21:59
your burner phone that you are on your regular phone.
22:01
And in that case, if you're making that decision, sync
22:05
passing is it can still be a good solution for you on your
22:09
regular phone as opposed to your burner phone.
22:12
Yeah, and hopefully you're avoiding installing potential
22:15
malware and browser extensions and AD blockers and stuff like
22:20
that. Well, I, I think I wanted to
22:24
kind of wrap this up by thanking Rossi for putting that
22:28
information out there. Thank you for coming on to the
22:31
podcast to kind of talk about it.
22:33
And the way I'd like to wrap all this up would be surely folks
22:38
out there, I mean, look, passkey's has been deployed in
22:41
some of the largest tech and even financial environments
22:45
that, you know, I've been pleasantly surprised with how
22:50
quickly this has taken off. But they're probably
22:53
practitioners out there who are like this close to implementing
22:59
pass keys for their organization who are now taking a pause.
23:05
And I want to know what are the tips or tricks that you would,
23:10
you know, maybe key takeaways that you would have for them on
23:14
this topic so they can get smarter and, and feel more
23:17
confident in them in their decision.
23:21
I think start by understanding how Passkeys fits into your
23:26
authentication framework and what you're comparing it to.
23:28
I think a lot of the concerns that people have at Passkeys
23:32
tends to be because they're looking at in isolation as
23:35
opposed to looking at it within the context of their overall
23:39
solution. This is a very simplistic
23:42
example, but one of the key, one of the issues that folks bring
23:47
up is, well, if I'm using a sync passkey now it's getting synced
23:51
from one phone to another phone that the user has.
23:56
How do I know that I've lost control of them?
23:58
And my answer would be, well, what were you doing for
24:01
passwords before that, right? If you, if they were using a
24:04
password manager, that password manager may be on both phones.
24:08
If they were using Google Authenticator, they may have
24:10
Google Authenticator deployed on both phones.
24:14
They may be receiving their SMSODP on a virtual app on a so
24:18
one of those communicator apps which is also on both phones.
24:21
So actually understand within the context of what are you
24:27
comparing it to and what are your alternatives?
24:30
Understand your threat model and then figure out how it fits into
24:34
that. You're still looking at
24:35
something that's far better than anything else that is out there
24:39
because of the cryptographic, by nature of it, because of the
24:43
phishing resistance of that that it brings to the table.
24:46
And the platforms, you know, all of all of these are getting way,
24:50
way better. So it's not like you're losing
24:54
anything by going to that. In fact, you're gaining, but it
24:58
needs to be looked at within comes back to threat models,
25:01
larger, larger identity program. It's no different than what I'm
25:05
sure you both of you have done in the past where you've gone in
25:08
and somebody's doing the what is it the the proverbial digital
25:12
transformation project. And you have to show them, look,
25:15
this is how you go from post it notes to a single sign on
25:20
solution. And here's the benefits and so
25:22
on and so forth. It's the same same thought
25:24
process effectively. So really, it's a sliding scale,
25:28
right? It's passwords are bad, we can
25:30
all agree on that. Pass keys are better, but
25:33
they're not perfect, just like anything else in this space.
25:35
So if you're worried about a pass key synchronization attack,
25:40
a man in the middle attack, a phishing attack, those same
25:43
attacks can happen whether or not you have a pass key.
25:46
It's also true for passwords. It's also true for API
25:49
credentials. It's also true for literally
25:52
anything that could be intercepted.
25:53
So I still fall on the side of look, pass keys are still better
25:57
than a password. It's one less thing I have to
25:59
remember if someone's going to go to the the effort of, you
26:03
know, trying to intercept my synced pass key from, you know,
26:07
a wallet on one device into another.
26:10
OK, I accept that risk because what's the alternative?
26:13
A post it note on the back of my keyboard with a password.
26:16
Yeah. I mean, I'm not going to
26:19
denigrate that because there are certain people who certain model
26:21
means, you know, what is the the old lattice, the password diary
26:26
that is sitting in somebody's desk is still valid for certain
26:30
folks. I'm not going to say that that's
26:31
a bad idea. It goes back to what are you
26:33
trying to get it? What is your actual
26:35
requirements? Yeah.
26:38
You know, I've seen scenarios where you like you, you know,
26:40
you write out the password and you lock it in a safe somewhere,
26:42
right? It's like a break, a truly a
26:44
break glass account where you know, there are certainly needs
26:47
for all that. But I think for the vast
26:48
majority of consumers, when it comes to normal people doing
26:53
normal identity account things, passwords, pass keys are still
26:58
way better, way more convenient and just a better solution.
27:03
I'm curious, you know, I, I, it's kind of a good, good segue
27:06
into the authenticate conference because authenticate conference
27:10
tends to be the more technical group of people in this space
27:12
really focused on authentication.
27:15
And I know you've been there, you know, for many years at this
27:17
point, and now you're the CTO. Are these the types of
27:20
conversations that are already taking place either behind doors
27:23
or in the hallways at places like authenticate?
27:26
Because I remember when passkeys first came out and said, well,
27:28
that's cool. But now my pass key lives on my
27:30
Windows device and I have no way to get it to my phone and my Mac
27:33
and all those other things. And I was like, give me a way to
27:35
sync it. Because until then it's just
27:37
another, you know, another thing on my account that I, I can't
27:40
really use. It's like, it's not, it doesn't.
27:43
It wouldn't surprise me that these types of issues all have
27:45
already been thought about and are in the works of trying to
27:48
figure out OK, how do we how do we solve for these, you know,
27:51
criticisms or concerns around it, whether they are, you know,
27:55
a specific attack nation state directed or if it's just a spray
27:59
and pray and hope that you know, you get the point 1% to click on
28:02
the thing to give you their account.
28:04
Yeah, no, they're definitely happening.
28:06
And I think I'll actually give you a two-part answer, if you
28:11
will, right. One is absolutely this
28:14
conversation are happening at authenticate.
28:16
There's there's the, there's the meetings that are for the the
28:20
techiest of the tech folks who want to go in and really
28:23
understand how things are working in at the lowest levels.
28:28
And then there's some there are case studies and presentations
28:31
about how folks are rolling it out, whether it's Wells Fargo
28:35
deploying pass keys and bringing it, bringing it to the market
28:39
are really cool solutions for from Fido members who are
28:46
solving things like how do folks who are working on the factory
28:49
floor using Fido to authenticate and get access or be able to do
28:55
specific tasks but not other tasks and so on and so forth.
28:58
And you get to see sort of the broad range within which Fido
29:01
operates and you, you might and you also will discover things
29:06
that maybe you didn't understand that Fido could help with,
29:10
whether as Fido members providing solutions.
29:13
So one of the coolest things that I've been learning about is
29:16
this thing called Fido device on boarding, which you know, on at
29:21
first blush, I was like, well, why do we have a standard called
29:25
FDO, which is about IoT devices? There's no people whatever.
29:29
This is about device on boarding, edge computing, IoT
29:32
devices. But it comes back to that.
29:34
It's in supply. It's in support of the core
29:36
mission of getting rid of passwords.
29:38
And if you look at supply chain attacks and if you look at how
29:42
those things are being deployed today, you always end up with
29:46
the human involved in the process at a certain point
29:50
providing A credential, which can be stolen and can be fished.
29:53
And when you start looking at the broader bigger picture of
29:56
things like the Cyber Resiliency Act in Europe or supply chain
30:00
attacks that have become been in the news, there's a lot of
30:03
really cool, you know, Fido members like Intel, Dell, Red
30:08
Hat, who are all working, had built a standard and now working
30:11
action version too. And these might be applicable to
30:14
you or might give you ideas as you start looking at things like
30:19
you're running your data center, are you looking at the cloud?
30:21
Are you looking at NHI oriented stuff, things like that, that
30:27
you know, it's really, really cool to find all these members
30:31
working on these really cool projects and you get to learn
30:34
about them, discover them at conference, like authenticate.
30:37
So I really love that part. And the second part is just get
30:40
the second part of that is and then you can figure out where to
30:42
get involved, right? Some of the best conversations
30:44
are happening in the working groups.
30:46
So as if you join as a final member, I'm sitting and I'm
30:51
sitting in the UX working group for the enterprise deployment
30:54
piece. A lot of the conversation that
30:56
we just had where you're asking all these questions, the folks
30:59
in the enterprise deployment working group are asking the
31:02
same questions and saying, well, we have to cater to, to our to
31:08
our enterprise users who maybe bringing their own device and
31:13
somehow they're both a individual consumer user and an
31:18
employee on the same device. How do I handle that?
31:21
How do I manage, how do I manage their credentials without
31:24
interfering with what they're doing on their personal side or,
31:30
and what are the security considerations, the US
31:31
considerations? So they're having these really
31:33
cool conversations and they're always looking for input.
31:36
They're looking for requirements, they're running
31:38
surveys to get feedback and understand these things.
31:41
So just getting involved, even if just to participate as a
31:45
lurker sometimes can. I mean, I've been a lurker for
31:48
two weeks now in all these calls and I'm just hearing the sheer
31:52
volume of, you know, work that is happening in all of these.
31:55
It's it's kind of amazing to see that.
31:58
The workers have a very good description of, of how I attend
32:00
the Authenticate conference because there are way smarter
32:03
people that are doing, you know, really the yeoman's work of
32:06
getting these big behemoths from an IDP perspective to kind of
32:10
play together and agree on standards.
32:12
And so I learned a lot just being in the room and listening
32:15
to stuff. So I think that's great advice
32:17
to just kind of go and, and, and, you know, learn by osmosis
32:21
if that works for you. Historically, Authenticate has
32:25
been more focused on authentication, right?
32:29
Is that still the focus for the conference as you see it as it
32:32
comes up? Is it looking to expand into
32:33
other areas around identity? Like how do you see the
32:36
evolution of the conference itself and sort of the topics
32:39
that are going in front of the in front of the numbers now?
32:43
It's definitely evolving because identity is evolving and
32:47
authentication by its nature has to be playing in part in in
32:50
different parts of it. I mentioned for example, earlier
32:53
that identity verification and binding was identified very
32:57
early on as a very critical piece that Fido had to get
33:00
involved in because it was so crucial to the supply chain of
33:04
authentication and identity, right?
33:06
So they had to get involved in that.
33:08
You know, there's some really, like I mentioned FDO, there's an
33:12
automotive special interest group.
33:14
Like if you think about automotive and your computer on
33:16
wheels, right? It's so many services, so many
33:19
systems, but at the end there is a human in there that is a
33:22
driver who has to authenticate to the car, authenticate to the
33:25
services within it. And we're moving to an increase
33:28
in digital world. And you don't want that to be
33:30
left a chance. You want that to be secured as
33:33
well. So whether you're looking at
33:34
things like the automotive, say in service, obviously been there
33:38
for a long time, but you're looking at, you know, the
33:42
biometrics working group, right? The biometrics working group is
33:44
hard at work and figuring out how biometrics as it
33:47
increasingly becomes part of the equation of our identity lives,
33:51
How does that have to be there from a, from a assurance
33:56
perspective? So those kind of things sort of
34:00
are all there being discussed and a lot, you know, some of
34:04
these groups emerge from conversations that happen at
34:08
authenticate, right? You come there and people start
34:10
talking about their challenges and the next thing you know,
34:13
they're like, well, we should create a study group.
34:16
And then the next thing you know that's become a special interest
34:18
group and the next thing is now a working group.
34:21
And so authenticate is a great place to kick start something.
34:24
If you see your what you're working on not getting addressed
34:27
somewhere, come be a catalyst. So how does that work?
34:33
So let me let me pick on the automotive side of things
34:36
because I know digital key for automobiles is sort of like the
34:40
big thing and for good reason, right?
34:42
It's it's a great convenient thing.
34:44
But for whatever reason, and I'm not going to name manufacturers,
34:47
a lot of them still struggle with phone as a key or watch as
34:53
a key. I have to assume there that
34:55
there is some level of authentication hopefully being
34:59
being done there, right to make sure that's the right device to
35:01
the right thing. Is this an area where you know
35:05
for for instance, it's the automotive side of things can
35:07
say, hey, look, this is a problem.
35:08
Is this something to do with the way that people are
35:11
authenticating and it's rejecting it, or is it, you
35:13
know, something else in the software?
35:14
I point on those the Apple and only as an example because I
35:17
know that's a a common frustration point for a lot of
35:19
the newer vehicles that struggle with it.
35:22
Fortunately, it's about the only thing that works right on my
35:24
car, so I've never had that problem.
35:26
I have other software issues, but I'm just curious if, you
35:30
know, when you're having conversations with those types
35:33
of folks, are those the type of things?
35:35
Because it's like, OK, yeah, here's a problem.
35:37
And a lot of people like, well, what am I going to do about it?
35:39
I'm going to go on Reddit and complain.
35:41
Well, how about instead, why don't we go to like the source
35:44
of where the things might be happening and start to like,
35:46
yeah, build these, you know, special interest groups or
35:49
working groups or whatever we want to call them.
35:51
Walk me through like how that actually happens because I think
35:55
there's a lot of really great keyboard worries out there.
35:57
And here's like an opportunity to say, OK, let's, let's
36:00
actually solve the problem instead of just complaining
36:02
about it. Does that make sense?
36:04
Yeah. So to be clear, I'm not
36:07
advocating that people come there and start using it as a
36:10
support channel to say, hey, Micron is not working.
36:12
But. Yeah, please don't do that.
36:15
But that said, if you're in the industry, obviously if you're
36:19
working with with these and you're trying to build solutions
36:22
for this or you're trying to solve this problem, right, this
36:25
is the right place to come and have those conversations.
36:28
So like I said, a lot of these things sort of emerge from
36:32
conversations that starts and start in the hallways.
36:35
Maybe you go and have a have a discussion about it in a plenary
36:38
room. And then you discover that, hey,
36:41
there's a critical mass of issues here.
36:44
There's a critical mass of requirements here.
36:47
We can actually put something together and have multiple
36:50
people solving it because at the end of the day, the power of the
36:52
alliance is like anything else. It comes from the membership and
36:56
the collective wisdom and intelligence that they have.
36:59
So being in the room allows you to find those commonalities and
37:06
allows you to understand and define, hey, we have a common
37:09
set of requirements. I'm not the only one struggling
37:11
with this. I don't have to keep doing this
37:13
on my own or building my own proprietary solutions.
37:19
There is a way for me to find my community, my cohort, who I can
37:25
work with on solving this problem, and by virtue of that,
37:32
get access to the folks I can't directly interact with.
37:35
Right? You're not going to be able to
37:36
go in and talk with the head of identity and name your large
37:42
automotive manufacturer by finding the coffee shop that
37:45
they're frequent. Not recommending that.
37:48
But not that it didn't happen in ideniverse over sushi with
37:52
someone that I know me complaining about all the EV
37:54
problems. Not that would never happen.
37:56
Exactly, but it can happen at authenticate and Idiverse and
38:00
all these conferences because people are looking for their
38:03
community to have these conversations and often times
38:07
you find what you'll find is it's not like they don't know
38:10
these problems exist, right? It's not like the folks at The
38:13
Who are running identity at these at these at automotive or
38:17
hardware or industry or don't know these problems.
38:21
Just often times they need enough people to help them make
38:24
the business case to their own management that this is
38:27
something we need to tackle, right.
38:28
So there is a community project. It is working together as
38:31
community to build that solution.
38:33
So, Nishan, I'm going to bring up kind of the heavy topic.
38:36
We lost another great one in the identity industry recently.
38:41
Internash, I know you're close with Andrew.
38:44
What should people know about him?
38:47
So, yeah, this is a hard one. I was just using the word
38:54
community a lot, right? That's not a mistake.
38:57
Like that's really something that that's really something
39:00
that came to me from him. Like I really understood that
39:03
from him because he, as you said, he was one of the he's
39:08
been one of the O GS for a long time.
39:10
I was, I was lucky enough to be his partner on the program
39:14
committee for the identity track at the RSA Conference for many,
39:17
many years now running. And you know, he had this kindly
39:23
and he had this convergently, you know, persona to him that
39:30
hit one of the most generous people I knew, right.
39:33
He, whether he was, you know, sitting down and explaining the
39:36
most obtuse topics and identity or taking you down to his
39:41
basement to show you the machinery was machining work
39:45
that he was doing. And, you know, they opened their
39:49
home for so many years. Him and Pam opened their home
39:52
for so many years for the annual Bootstrap party before the RSA
39:55
Conference as a way of building community, as a way of making
39:58
connections, right? You know, a lot of us, I
40:01
wouldn't have this job if I didn't have connections that
40:04
exist because Andrew brought people together, right?
40:08
That was what he understood. And so when, when you, when you
40:13
when I was thinking about, you know, what did I want to do next
40:16
before I took the final role, it came a lot, a lot of it came
40:20
back to I want to make a difference.
40:23
And I learned that idea. I learned that that's what I
40:27
wanted to do because I saw how he went about his business,
40:30
right? He worked at some of the largest
40:32
organizations and build start-ups.
40:35
But he did it in such a generous, quiet manner.
40:39
You know, those of us who knew him knew him, but he wasn't out
40:42
there, like as the face of a company or, you know, doing all
40:48
the doing, sort of a national tour, if you will.
40:52
But he could have. He would have drawn crowds
40:54
because he was amazing. He knew everything and he shared
40:58
it generously. I loved it.
41:03
This was coincidental. I was having you on at this
41:06
time, but for you to be able to pay homage to him like that
41:09
means a lot. He's another one of these great
41:13
people within our industry who's now no longer with us.
41:17
But I do want to now lighten things up a little bit.
41:23
You know, we don't have a whole lot of time, so let's kind of do
41:26
this like a lightning round. If I could bring up a few
41:29
different topics, and a lot of times I bring up these topics
41:32
like talk about the future of this side or the other thing,
41:35
talk about AI in the future. Actually, what I'd like to do is
41:39
challenge you a little bit differently, which is let's take
41:41
two minutes on each one of these topics to talk about where
41:44
things are right now. And I will use AI, but AI is
41:49
creeping into everything and everywhere, including identity.
41:54
What is the state of AI and identity now?
41:59
It is, as you said, it's creeping into everything.
42:02
Everybody's trying to add AI to their products or say this, you
42:06
know, whether they're doing it or not, right?
42:10
On the other hand, there's people who have been using AI
42:12
for a very long time in their products without ever calling it
42:15
AI. So I think it's here to stay,
42:17
right? I think there is still a
42:19
reckoning coming in terms of just the cost of adding AI to
42:24
everything. Some people don't quite
42:26
understand that. As you've seen before, a lot of
42:28
the stuff is VC subsidized and a certain point.
42:32
This idea that you can continue to leverage that is going to
42:37
become an issue. But the technology is going to
42:39
continue to get better and it is going to stretch the boundaries
42:42
and break things, you know, along the way.
42:45
Like we see, you know, it just taking pass keys and an example,
42:52
pass keys means you don't have a password that you can share with
42:56
an agent for it to work to log in as you.
43:00
So what does that mean from an authentication flow standpoint?
43:03
What does it mean when you're building agentic processes where
43:06
you wanted to be able to operate on your behalf across services?
43:10
How does that factor in? What is that equation looking
43:13
like? So you see work happening
43:15
feverishly across the board, whether it's in the Fighter
43:18
Alliance, whether it's in the Open ID Foundation, whether it's
43:21
in W3C and other other standards organizations.
43:25
There's a lot that's going to be happening.
43:29
And as usual, the tech is going to outpace standards, the tech
43:33
is going to outpace best practices and guidance.
43:35
So we kind of have to be prepared for things to break a
43:39
little bit, but there are a lot of folks who are working really
43:42
hard on it. Yeah, something I've thought
43:45
about a lot about as well as what's going to happen with the
43:49
intellectual property, it just seemed like the lines could blur
43:53
where intellectual property, thoughts, things like that can
43:56
be put into an AI and then what becomes to them they are you
44:01
training a model that doesn't really keep track of what is
44:08
intellectual property where, where the thoughts belong?
44:12
Do they belong to some person or some entity or are they in the
44:15
public domain? So it's just a little thought
44:19
that I've been having lately. Next topic Decentralized
44:23
identity. I think it's a very loaded term
44:28
because it's been bandied about and used and misused many times
44:33
over. But we're definitely moving
44:35
towards a place where decentralized or Federated
44:42
models are going to start to become practical, especially as
44:45
we start seeing how wallets are becoming more, more and more
44:49
common. As people start building warrant
44:51
infrastructure, people start building out the standards for
44:56
being able to present credentials across
45:00
organizational boundaries, across jurisdictional boundaries
45:03
in a way that can be accepted and certified without, in a
45:07
privacy preserving manner. So they think there's a lot of
45:09
work happening there. I am very hopeful about that
45:13
aspect of what would have been called decentralized during the
45:17
past that that is actually going to be really driving utility and
45:23
value and creating a world where we can actually present an
45:30
aspect of our identity in a privacy preserving manner much
45:35
more seamlessly and easily than we used to be able to do before.
45:40
We've been here about decentralized identity for years
45:43
now and we're just, we're we're, I don't feel like we're anywhere
45:47
close to it in the US, at least Europe seems to be much further
45:51
along with their plans on it. Just based on what I saw at the
45:53
EIC conference earlier this year.
45:55
What I've also noticed is nobody's calling it blockchain
45:57
anymore. It's decentralized identity.
46:00
And so is this a, is this a branding shift?
46:03
Is this a marketing strategy to kind of get away from, you know,
46:06
the maybe the crypto sort of camp and more towards the
46:10
broader technology as a solution?
46:12
Because I can certainly see the benefit of it.
46:15
I just don't see it happen anytime soon in the US because
46:19
of either government, right, you know, and, and, and people not
46:23
trusting if the government runs it or maybe if it's healthcare
46:25
or if it's finance or if it's education.
46:27
Like who's going to run these giant rings of being able to,
46:33
you know, have a decentralized identity?
46:34
Because it's not like, you know, some the normal human being is
46:37
going to say, well, yeah, just connect to my, you know, to, to
46:41
my Ledger. Like that doesn't make sense for
46:42
most people. How do you see this happening in
46:44
the US, you know, going forward? Yeah.
46:47
So you know, as Jim said, I'm not, I'm not one to
46:51
prognosticate the future, but I will say this and I I think the
46:56
term decentralized, like I said, becomes overloaded.
46:59
And therefore, I'm not, I try not to get too hung up on the
47:04
word, especially not on the technology behind it.
47:07
You know, there's, there's companies that are using
47:10
permission blockchains, there are companies that are using
47:13
other stuff a lot. I think one of the shifts that
47:16
we're seeing is people are starting to focus more on the
47:21
use cases, which is always good. They're starting to focus on the
47:24
utility, which is always good. And so I think wallets is, you
47:31
know, and Heather Flanagan has an amazing post about should we
47:36
still be calling it wallets? And I highly encourage folks to
47:38
check that out and check out everything Heather Flanagan
47:41
says, because that's always good.
47:42
But leaving that as sticking with the wallet term for a
47:45
while, I do think that will help.
47:47
Like in the US, for example. Yeah, we're not going to have a
47:50
national identity that's going to be doing anything like that.
47:53
But you have MDLS. And MDLS, our driver's licenses
47:58
have been our de facto identity for a long time for many
48:01
different use cases. So can the MDLS become the way
48:07
we do this in a decentralized manner, especially if you take
48:11
into account some of the work that's happening on phone home
48:13
versus no phone home and all these kind of things that are
48:15
being discussed and you add in privacy considerations.
48:20
Yeah, that could be a way to get there.
48:23
And then it'll evolve from it. Like the minute somebody sees
48:26
something working, 500 other things are going to show up
48:29
saying, oh, we can do that but better, or we can do that but
48:31
slightly different and it'll mushroom from there.
48:34
So I do think utility will drive it.
48:39
And I think part of what will drive the US is seeing it happen
48:43
everywhere else. Like Europe is obviously very
48:47
visible in what they're doing on wallets.
48:49
But actually this is happening all over the world now, right?
48:52
Every place, whether it's Southeast Asia, I saw a lot of
48:55
work happening and the Middle East and Asia and in Africa,
49:00
what people want this because they see how it unlocks the
49:03
economic engine, right? Like they see the value of it.
49:07
So there's a lot of efforts that are going to be happening.
49:09
And I think in parallel, there's a lot of work happening at the
49:13
standards bodies to try and enable it to happen in a good
49:17
way, right? So that'll take some time, but I
49:20
think it'll happen. I was going to mention the MDL
49:24
as well, but you know Jeff, with Jeff's entry, we definitely
49:30
violated the two-minute answer in the Lightning realm.
49:34
I'm going to allow it. As as the judge, I'll allow it.
49:39
You're happy to judge I'm the jury, right?
49:41
Sure I can. Anyway, we'll just do one more.
49:45
It's 2025. Somebody's listening to this 800
49:49
years from now that there's a context.
49:52
We're talking about non human identity.
49:55
What do you think of non human identity?
49:56
Is it even a good term? Well, 800 years from now,
50:02
nobody's going to care about human versus non human identity.
50:05
It's all going to be just identity and hopefully it's
50:08
going to be invisible because it's just going to happen and
50:12
people won't have to do anything for it.
50:15
But that's 800 years from now. I think the NHI wave that's
50:20
happening right now, there's a, again, it's the same thing.
50:25
There's a lot of old technology that's being rebranded NHI.
50:27
There's a lot of new work happening.
50:29
I think the AI stuff is going to trigger a lot of interesting
50:33
work in that same same vein. But yeah, I'm not a, I'm not
50:39
sold on the term because I think it encapsulates too many
50:43
different things and, and blurs the boundaries a little bit too
50:45
much. Trying to put everything under
50:47
one umbrella can make things confusing.
50:50
And I think a little bit, just a little bit of precision can go a
50:54
long way in making sure that people don't overestimate what
51:00
something can do or miss misidentify what some, what
51:04
value something can bring. And we've suffered from that a
51:07
lot in our, in our, in our identity space, if you will.
51:11
So I think a little bit more precision would be valuable.
51:15
But hey, you know, if nothing else, it's it's putting
51:17
attention on the problem, and that's always a good thing.
51:21
Like like all things, I think it comes down to context and
51:23
context matters whenever you're having a conversation, whether
51:26
it's NHI, whether it's machine identity, whether it's, you
51:30
know, whatever term we want to use.
51:32
Again, these are not new concepts.
51:34
They've been around forever. There's always been, you know,
51:36
some sort of machine or non human identity operating behind
51:40
the scenes, service accounts, etcetera.
51:42
I just wish you would settle sort of like on a standard just
51:46
way to call it because we are awesome as a as an industry of
51:49
coming up with new acronyms and having like 8 different ways to
51:52
call the same thing. And so this is just an area that
51:54
again, creates it creates unnecessary confusion if we
51:57
can't agree to have the same at least, you know, vocabulary for
52:02
things like that. It just it bugs me.
52:05
Yes, that is unfortunately a problem with being, you know,
52:10
struggling with since ever since I started working and itinerary.
52:13
And that's been a long time. Well, let's wrap up this
52:16
conversation on your background. So I noticed for people who are
52:21
listening to this and you're, if you're not seeing us on YouTube,
52:23
come over, give us a like and subscribe.
52:25
That helps us out a lot. You've got a couple pictures of
52:28
New York stuff. I think I see Mariano Rivera
52:31
behind you. I think I see the Giants behind
52:34
you. Is this just you as a, as a New
52:36
York sports fan, or is there some deeper significance?
52:40
Or is this like a Taylor Swift thing where there's like hidden
52:42
meaning between these, you know, pictures like what is what is
52:45
the the play here? Nishant The play here is to suck
52:49
up the. Gym, right?
52:52
Well, Jim is a is a Yankees fan, unfortunately.
52:54
Yeah, the New York thing is just, I am a New Yorker at
52:58
heart. Like growing up, I, you know,
53:01
coming and being in New York was always my dream.
53:03
It was like, that's where I want to be.
53:05
That's where I that's where I want to go to succeed.
53:08
So, and then I have a lot of family and, you know, that just
53:12
meant adopting the New York sports teams.
53:14
And I don't do anything halfway. So if I'm in it, I'm in it all
53:19
the way. So that meant the good stuff
53:23
with the Yankees, the bad years with the Giants, then they'll
53:26
make those two improbable runs with the Giants and what Jim and
53:31
I are dealing with this year with the Yankees, which is not
53:33
good for my heart rate. So is it an all New York sports
53:38
or do you focus on just the Yankees and the Giants and you
53:40
say forget about The Jets and the Mets?
53:44
You cannot do both at the same time.
53:48
You have to choose, OK, Anybody who says they can, anybody who
53:51
says they can do both is not a New Yorker, let's put it that
53:53
way. And.
53:54
I feel the same way as a as a recovering Chicago and you had
53:57
the White Sox and you have the Cubs.
53:59
And it will always bug me. And people say, well, I'm a fan
54:01
of both teams. No, pick one.
54:03
You have to pick one. And the right answer is always
54:06
the Cubs. You, you definitely should not
54:07
be a Sox fan. It's just dirty, dirty, dirty.
54:10
So. Any any Sox fan if the name has
54:13
the Sox. You cannot be there.
54:14
White Sox, Red Sox, whatever it may be, they're all, they're all
54:17
the enemy. So sorry.
54:19
You know Boston and the South Side of Chicago.
54:22
Yeah, we just lost a whole bunch of listeners.
54:25
Thanks chef. You know what worth it.
54:26
That's fine. That's like hell.
54:27
I'm ready to dive on it and I'll start taking people as they try
54:30
to come up it. Deshot, thank you so much for
54:34
taking the time with us. Really excited to see you in
54:36
your new role and seeing you here in a couple weeks here at
54:39
the Authenticate conference. So I have.
54:43
Yeah, I was going to say I'm going to be looking forward to
54:44
seeing you at Authenticate and having Megan kick your ass at
54:48
again on stage. No way.
54:50
No way not. Mine, it'll be Jim's because I'm
54:53
I'm the Steve Harvey here. But yes, Fido feud Round 2 is
54:56
underway. I am working feverishly on the
54:59
questions that we're going to answer with Adrian 1 to 1.
55:02
So only she and I know the questions and we'll have the
55:05
answers. And so we'll be surprised if
55:07
we're already involved when it comes up to it.
55:08
But last year was a lot of fun and the goal is to make it even
55:11
bigger, better and maybe even more tequila or than it was last
55:15
year on stage. We'll see.
55:17
I don't know if we can do that again.
55:18
That might have been a problem that we just didn't ask for
55:20
permission last time. You know what though, I'm
55:24
thinking now, maybe I should have Mishawn on my team.
55:28
So hey, if they kick our ass, they kick our.
55:32
Ass the Royal, Ass the. Royal yeah gets kicked.
55:39
All right, let's leave it there. Nishant, thanks so much.
55:42
I'm going to have links in our show notes for people to connect
55:44
with you on LinkedIn, link to Fido Alliance.
55:47
Don't forget the conference discounts on our website for
55:50
things like authenticate as well as cybersecurity summits as well
55:53
as ideniverse and Gartner coming soon.
55:55
So check those out. Also have link to the article by
55:59
Rusty Deaton. So again, great article by
56:01
Rusty. Glad to see it out there.
56:03
We need to have conversations like that kind of put out into
56:05
the forum where we're going to have discussions around it.
56:07
And then let's see, Nishant, you mentioned Heather's wallet
56:10
article, so Kill the Wallet, Rethinking the Metaphors Behind
56:13
Digital Identity by Heather Flanagan.
56:15
We'll have that link in her show as well.
56:16
So encourage people to check that out.
56:18
And she's got a very cool podcast that she does where she
56:20
kind of talks through her blog as she's kind of written it,
56:23
which is very neat. So yeah.
56:26
Yeah, I keep driving around having the soothing voice of
56:28
Heather reading out Identity Toss to you.
56:31
It's a good way to go. See, the only thing missing is
56:34
like the cat in the background and she just can't get on, you
56:38
know, without the video component of it.
56:39
But maybe maybe there's an editing tip there to like put
56:42
maybe a a slow soft, you know, purr behind is like, you know, a
56:46
little bit of what's the, you know, what's the voice thing
56:50
that you do with like, you know, people like soothing ASMR, like
56:52
something like that, right? For for the podcast.
56:55
Maybe we'll do that on ours. Maybe we'll do it for next the
56:58
next April Fool's joke. Sounds good like and subscribe,
57:03
share with friends, share with enemies doesn't matter as long
57:06
as they hit like and subscribe idacpodcast.com.
57:09
And with that, we'll leave it there for this week.
57:10
Thank you everybody for watching and or listening and we'll talk
57:13
with y'all in the next one. You've been listening to
57:18
Identity at the Center. We hope you've enjoyed the show.
57:22
Make sure to like, rate and review, and we'll be back soon.
57:26
But in the meantime, hit the website at
57:29
identity@thecenter.com. See you next time on Identity at
57:35
the Center.