Latest / Identity at the Center / #171 - Identity Proofing with Nishant Kaushik

Transcript

#171 - Identity Proofing with Nishant Kaushik · Identity at the Center

• 0:09
  You're listening to the identity of the center podcast, this is
• 0:13
  the show that talks about identity and access management
• 0:15
  and making sure you know who has access to what let's get
• 0:18
  started. Welcome to the identity of the
• 0:25
  center podcast. I'm Jeff.
• 0:26
  And that's Jim. Hey Jim.
• 0:28
  Hey, Jeff, how are you? Oh, not so bad yourself.
• 0:31
  Good, I see. You're recording from a hotel
• 0:33
  room today. I am courtesy this this episode
• 0:36
  not sponsored by any one particular, but I am in a
• 0:38
  Marriott Courtyard right now. Well, we know what that that
• 0:42
  experience is like, if your business traveler, I think
• 0:46
  you've been to courtyards all over the United States or
• 0:50
  essentially, all over the world. Every one I've been to is pretty
• 0:53
  much the Same. I think if the consistency that
• 0:57
  I appreciate the most about it, you book a Marriott Courtyard.
• 1:00
  You know what? You're going to get.
• 1:01
  That's right. Yeah.
• 1:03
  And that there's something to be said for that.
• 1:04
  That's I think part of the reason, why McDonalds is so
• 1:07
  popular, right? Is you had McDonald's everywhere
• 1:10
  and they're pretty close to the same experience.
• 1:15
  But beyond that I've been, I had a funny.
• 1:19
  Thought we do. You remember Jack Handey on
• 1:22
  worse? Yeah.
• 1:23
  Jack Handey from My mother's alive, DDOS Deep Thoughts by
• 1:27
  Jack Kennedy. So I was thinking about verified
• 1:31
  identities and so that the deep thought would go, not everybody
• 1:36
  loves verified identities. For example, kids with fake IDs,
• 1:42
  do not want those identities verified It's pretty accurate.
• 1:46
  I would say nerdy but accurate. Well that was yeah that was part
• 1:50
  of the Deep Thoughts by Jack Handey.
• 1:52
  That was what it was all about. I can't imagine what he would
• 1:55
  write at this point. I know I should probably say
• 1:58
  what he would rather. I don't even know if he's still
• 1:59
  alive or not but classic for the 90s I guess.
• 2:03
  I just assumed that maybe he's moved on but I don't know for
• 2:05
  sure. Now they're only we had a
• 2:08
  researcher and you know and it like a producer that we could
• 2:11
  yell into our ear to look that up.
• 2:13
  What were the like an intern wherever you say?
• 2:15
  When you go to look up her ass Jack Handey episodes on or skits
• 2:20
  and are they still alive? We need an intern Jeff.
• 2:24
  We do it. Is it it pays - money.
• 2:27
  You actually have to pay us and it's thankless work.
• 2:30
  So if that's not an attractive job offer, I don't know what is.
• 2:34
  Yes. Exactly.
• 2:35
  So hey, we've got a couple of things coming up.
• 2:38
  Do you want to kind of run down the list or do you want me to
• 2:42
  I'll kick us off? Because you did it last time.
• 2:45
  We've got a few different things going on.
• 2:46
  So while you've got more going on than I do, at this point,
• 2:49
  you've got what next week, actually this week by the time
• 2:52
  people listen to this. So it'll be September 19th when
• 2:54
  this episode goes live. But later on the week, there
• 2:58
  will be a webinar that Jim is representing us on with one
• 3:02
  Cosmos and that they tried to fix passwords.
• 3:05
  But how do we fix MFA, you know, super sexy title?
• 3:08
  I'm sure be very interesting. So if you want to support the
• 3:10
  show, go support Jim register for the webinar.
• 3:13
  I'll have a link in our show notes.
• 3:15
  People can check out, but yeah, looking forward to I'll be
• 3:18
  catching that on the replay because I'll be on a flight back
• 3:20
  from Las Vegas. Theoretically, at that point.
• 3:24
  We've also got the authentic eight 2022 conference coming up,
• 3:27
  put on by our friends, over at Fido.
• 3:30
  That is October 17th to 19th. We're going to be out there,
• 3:32
  both Jim and I, and looking to do some, some podcasting.
• 3:35
  So, Jim has already started trying to fill up our schedule
• 3:39
  with the chose to record. So, you know, we'll we'll be
• 3:44
  looking to do some things. They're, we're also going to be
• 3:46
  at Octane and November in San Francisco.
• 3:49
  I think it's November 8th to the 10th.
• 3:52
  It's kind of like a partner / customer conference.
• 3:54
  But the idea there is again, we'll have hopefully
• 3:57
  conversations with folks, in and around sort of the
• 4:00
  authentication space and Folks at Octane and so forth that I
• 4:05
  want everything. I know, I think there's one
• 4:07
  other one, so we don't know the date for it yet.
• 4:09
  But friend of the show and friend of ours, Tom Lennon from
• 4:14
  sale Point has Says to present to the Carolinas identity
• 4:18
  Roundtable, so that's yet to be scheduled, but it should happen
• 4:23
  here in, you know, 2022 and just shout out to the Tom for giving
• 4:29
  us the opportunity. I think it's going to be a fun
• 4:31
  time. Yeah, that'll be cool.
• 4:33
  I don't know what we're going to talk about or how it's going to
• 4:36
  work, but we're excited to figure it out and so maybe
• 4:39
  something related to Identity and access management.
• 4:42
  I'm guessing I hope so. That's the only thing.
• 4:44
  Well, even that you could you could barely say we're qualified
• 4:46
  to speak about but we do it anyway but do it anyway.
• 4:50
  You want to get to our topic for today?
• 4:52
  Sure. Yeah.
• 4:53
  And so Jack Handy would be proud of us.
• 4:55
  We're going to talk about identity proofing, verified
• 4:58
  identities and verifiable credentials.
• 5:01
  And we had a good little conversation about making sure
• 5:03
  we got that terminology right with us, we have Nishant kaushik
• 5:08
  CTO with eunuch in former colleague of ours.
• 5:12
  Back in our adventure biddies. And I'd miss Sharpe was with us
• 5:18
  last on episode number 73 which was December of twenty 20,
• 5:23
  Rayven the the peak of the pandemic.
• 5:26
  So I guess he was not out running around the world at that
• 5:30
  point. Like the rest of us we use.
• 5:33
  He was at home and maybe we don't know.
• 5:36
  Yeah, I guess, you know, we can, we can introduce him and ask him
• 5:40
  what he's been up to since the last time he was on the show
• 5:44
  hidden, Sean. Hey everyone.
• 5:46
  Hi guys, I have definitely not been running around anywhere
• 5:51
  even now like I think. Oh the only work-related or
• 5:58
  identically trip. I took was when I went to
• 6:00
  identify verse earlier this year, other than that, I've been
• 6:02
  pretty much homebound in terms of working from home and
• 6:06
  focusing on the work we're doing at Seneca.
• 6:09
  Yeah. And what side is that conference
• 6:11
  wind up becoming like a super spreader.
• 6:13
  I think a few people left the Conference and I wound up
• 6:16
  catching covid shortly after but I mean covid is pretty much
• 6:20
  everywhere now. So I don't know if you can
• 6:22
  necessarily pinpoint. The fact that you were at the
• 6:24
  conference? Yeah.
• 6:26
  No I think it definitely happened but it pretty much
• 6:29
  happened at every conference that took place.
• 6:31
  So you know it's just the nature of going back to a world that
• 6:37
  used to exist before but and we're trying to live that same
• 6:41
  life but you know that world still hasn't come back yet.
• 6:45
  So, yeah, our say was the same way earlier in the year.
• 6:48
  Had I dodged it, but I know a lot of people got got sick and I
• 6:52
  think I heard to make the identifiers.
• 6:54
  Jim. I could make a Denver's.
• 6:55
  It was just terrible timing for, for both of us, were for
• 6:58
  different reasons. We were at Gartner a few weeks
• 7:00
  ago, and knock on wood, so far, so good for me.
• 7:04
  And I haven't heard of any sort of outbreaks, so maybe the same
• 7:08
  people who were or maybe already had the antibodies through the
• 7:13
  roof or something. By the time they got the Gartner
• 7:15
  Earlier. So maybe that was strategy on
• 7:16
  Gartner's part yet you let everyone else gets sick, build
• 7:19
  up the immunity and then you know at their conference after
• 7:22
  that Sonia Schott we're going to talk about identity proofing
• 7:27
  today and what we thought would be kind of a good way to start
• 7:32
  would be to start with the basics of what is identity
• 7:36
  proofing. And and one thing I wanted to
• 7:37
  throw out there is like I had to think of the process the way
• 7:43
  used to be, which was You know, showing up in person with a
• 7:48
  passport or and I, you know, like a driver's license or
• 7:54
  walking license that we used to call him.
• 7:58
  And I was kind of thinking of a client that I work with, you
• 8:01
  know, probably eight years ago, that was the University, a large
• 8:05
  University, in order to get your student ID ID to show up on
• 8:08
  campus. Or if there was a remote campus
• 8:11
  your or your full-time remote, you had to go to Some kind of
• 8:15
  Licensing station to go and actually go through this
• 8:19
  verification. That was you know in my mind
• 8:23
  what identity proofing was, how do you define identity proofing?
• 8:29
  Well, conceptually it's pretty much what you laid out, right?
• 8:32
  The idea there being that as a business as a service, you're
• 8:37
  trying to verify the identity, the real world identity of a
• 8:42
  person, whatever real world identity in that context means
• 8:45
  because it's very context-sensitive
• 8:47
  context-dependent. But the idea being that you just
• 8:50
  want to make sure that when somebody is coming in and
• 8:51
  saying, hey, I'm Jen and I work at a worked at identity.
• 8:56
  Actually, let me take a different example.
• 8:57
  I'm Jim and I used to work at So if I end, that's something that
• 9:01
  you care about, well, how do I verify that as a business before
• 9:05
  I allow you to proceed? And how can I trust that?
• 9:08
  So as you as you pointed out, you know, we're used to these
• 9:13
  men. These processes proofing
• 9:15
  processes being real world right in terms of brick and mortar, as
• 9:19
  we call it in my world, where we're dealing very much with
• 9:23
  this, in the consumer, a tiny space.
• 9:25
  We dealing with it in the context of how do you know
• 9:29
  People open bank accounts or people register for, you know,
• 9:33
  retail accounts or and get access to, you know, Airline
• 9:38
  accounts or health care, whatever.
• 9:40
  Everybody cares about the identity of the person and on
• 9:43
  the other side and that want to figure out today are required
• 9:47
  level of assurance and that's the key part is this that real
• 9:50
  person and you have to figure out how you're going to do that
• 9:52
  and the old way of doing it, which was show up in person and
• 9:56
  sure document to a human being doesn't work anymore.
• 9:59
  That's what we're trying to get past.
• 10:00
  And so in all the, in the identity proofing space that's
• 10:05
  literally what's being focused on right now, is how do I
• 10:08
  digitize the process such that I can take the human being for the
• 10:12
  most part out of the equation and allow it to be fully self
• 10:16
  service fully remote, you know? But with this the required level
• 10:20
  of assurance. Yeah.
• 10:23
  So we talked about, I think we just laid out they're pretty
• 10:26
  well was the verified identity. So in other words, you've gone
• 10:29
  through the proofing process now, your identity has been
• 10:32
  verified. We also hear about The right way
• 10:37
  to say it, I think is verifiable credentials their wrong way, to
• 10:41
  say, to her. What we commonly hear as
• 10:44
  shorthand is verified credentials.
• 10:49
  Yeah. Maybe do you run into do you
• 10:51
  experience that as well? Hearing people say verified
• 10:54
  credentials. Yes, because I think the area of
• 10:57
  verifiable credentials is still pretty new and unknown to folks,
• 11:03
  outside of the identity Community people who are dealing
• 11:05
  with this on day and that they are basis.
• 11:08
  If you you know, it's really important for a lot of us who
• 11:12
  work in identity to really, you know, make sure that we
• 11:18
  acknowledge the bubble we live in.
• 11:19
  You know, we think of these things and we know what they are
• 11:22
  and we have huge humongous debates about them when you go
• 11:25
  out and talk. Do actual practitioners and
• 11:27
  business people. They don't really know what it
• 11:30
  is. They're thinking of their
• 11:31
  problems that, right? So, you know, I like to, you
• 11:35
  know, my Twitter by, I put them solver of problems, right?
• 11:37
  So the point from my perspective, as always, been
• 11:40
  what is the use case? What are you trying to solve?
• 11:42
  And what businesses care about is, the verified identity part,
• 11:46
  which is I need to know you are, who you say, you are to the
• 11:49
  level that I require to have trust in that and that changes
• 11:54
  that's different for different organisms.
• 11:55
  Ization. Because if I'm a, if I'm, you
• 11:59
  know, shopping site a verified, any simply, yeah, you're
• 12:02
  somebody who has an email address that, I was able to send
• 12:05
  a link to in verify that you had possession of that email
• 12:08
  address. And that's sufficient for me to
• 12:09
  verify that. You are a somebody who wants to
• 12:12
  be a customer with me. I don't care what whether you
• 12:14
  use, Joe Schmo, as and as your name.
• 12:17
  I don't matter later, when I get it to payments, but for now if
• 12:20
  you just, you know, doing stuff on site, I don't care.
• 12:23
  But if you're a bank, then a verified at it.
• 12:25
  I mean, something very, very different because you're looking
• 12:28
  at looking at the legal identity and do I have enough information
• 12:32
  to know that this is a real person to have enough
• 12:35
  information to satisfy the know, your customer regulations that,
• 12:38
  you know, have to dare to do. I have enough information to be
• 12:43
  able to identify whether you try to previously, open an account
• 12:48
  with the different name. And, you know, you, you're
• 12:51
  somehow trying to create duplicate account fraud and
• 12:53
  things like that. So, So, verified identity from a
• 12:57
  business perspective, is trying to solve their problem with
• 13:01
  their very specific point of view.
• 13:03
  They're very specific lens that they looking at through.
• 13:07
  Yeah. And the processes that we that
• 13:09
  I've experienced in terms of going through a identity
• 13:13
  proofing, process is very device-specific.
• 13:17
  So, you know, I'm thinking of a specific example where I went
• 13:20
  through a self-service process to verify my identity.
• 13:26
  And use like a basically, a video selfie having me turn my
• 13:32
  head and things like that and compared it to my driver's
• 13:37
  license for sure provided copies of in terms of picture.
• 13:41
  So I'm wondering is that typical workflow?
• 13:44
  And you know what is and are different solutions, doing it
• 13:49
  differently and how device-specific it is it because
• 13:55
  I tend to have You know, higher and devices than the average
• 13:58
  person. So where does the average person
• 14:00
  fall? Yeah.
• 14:02
  I mean it's a very very tricky topic, right?
• 14:04
  Because at the end of the day, what you're trying to do is
• 14:08
  build an approximation for what for what that real-world
• 14:10
  process, that brick-and-mortar process that we talked about
• 14:12
  earlier, you're trying to build a digital equivalent for that
• 14:15
  and that's because people are working from a frame of
• 14:18
  reference and in many cases that actually constrained by the fact
• 14:21
  that There are regulatory requirements that I were
• 14:24
  designed for brick-and-mortar times that have not been updated
• 14:28
  for digital times. And there are no sometimes no
• 14:31
  better solutions that you have available to the best proof of
• 14:35
  who you are from a legal entity perspective is your physical
• 14:39
  document, your driver's license, your password, Etc.
• 14:42
  And there are no widespread digital equivalents so people
• 14:46
  are making do with what they have and that's forcing them
• 14:49
  down a path where you said the process you described.
• 14:52
  Which is yeah. Take take a selfie, you know,
• 14:55
  take a, take a picture of your document and you know, oh wait,
• 14:59
  if you have a passport that has a chip in it or we'll do that's
• 15:02
  great. We'll do an NFC lead and we
• 15:03
  trust that even more because now there's some cryptographic
• 15:06
  Assurance around it and stuff like that.
• 15:08
  And that is very much state-of-the-art simply because
• 15:12
  alternatives are still being developed and still fairly new
• 15:15
  and they're not widespread enough, and they have enough
• 15:17
  sort of friction in the process to have an adopter.
• 15:22
  Problem right now, right? So it's changing, I think this
• 15:24
  is a space that's very much changing their organizations
• 15:27
  like better identity Coalition etcetera, that are working on
• 15:29
  the regulatory side to try and introduce things that could make
• 15:34
  some of the stuff easier. But yeah, it's pretty still
• 15:38
  pretty much. What do we have available to us?
• 15:41
  That we can make do with and what's pretty much ubiquitous
• 15:44
  right now is essentially physical documents and digital
• 15:48
  phones with cameras. That's basically the starting
• 15:51
  set you up. With.
• 15:53
  Yeah. And I think that part of what
• 15:56
  I've heard referred to as liveness detection is part of
• 16:01
  that process, right? We we want to make sure that
• 16:04
  we're not just holding up a picture of ourselves to the
• 16:07
  camera. And then I guess even there's
• 16:10
  that next level of the call it like deep fakes where it's like
• 16:16
  I can create a video that maybe does the things that you're
• 16:19
  asking for. So I was trying to defeat that
• 16:21
  ahead of time. Time.
• 16:23
  We're certainly not the at the point of having droids or, you
• 16:27
  know, I'll be watching this Captain Picard sequel to the
• 16:32
  whole Star Trek, the Next Generation, and they call data
• 16:37
  and the folks like date of the the Bots like data they call him
• 16:41
  since. So we're not at that point yet,
• 16:44
  but yeah, they actually brought up something in that show that
• 16:51
  got me thinking about the Wife nurse sharks which was that the
• 16:55
  synths they could create absolute twins.
• 17:00
  So there's no difference between sin Theta and since B but that
• 17:06
  twins human twins actually are different even if they're
• 17:09
  identical twins and if you've known identical twins and you
• 17:13
  really get to know them eventually they almost don't
• 17:16
  even look the same to you anymore, right.
• 17:18
  They look like two very different people of people
• 17:20
  seeing them for the first time. I think, oh my gosh, you're
• 17:23
  stupid. Will that look the same?
• 17:25
  I'm wondering. Can liveness detection actually
• 17:29
  detect the difference between Twins?
• 17:33
  So it's important to understand the distinction between the
• 17:38
  technical components in the process that we're discussing
• 17:41
  here, right? So liveness detection enough
• 17:43
  itself isn't quote, unquote and identity piece.
• 17:47
  What it is. It's a security peace.
• 17:49
  What lyman's detection is trying to do, is ensure that the is
• 17:53
  person who's presenting the document is the real person
• 17:57
  associated with that document. So at the end of the day, when
• 17:59
  you're doing an identity presentation, Of a proven
• 18:02
  process. What you're doing is you're
• 18:03
  providing a document and saying, here's my document, that gives
• 18:06
  you all the data that you can verify whatever process you have
• 18:10
  for verifying that. And in that document, there is a
• 18:13
  picture of me essentially, right?
• 18:15
  Like and you don't want to say, and by the way, here's a selfie
• 18:19
  of me and make sure that it's the two people because you want
• 18:22
  a basic. What you're basically trying to
• 18:23
  do that is is essentially validate that the person
• 18:26
  presenting the document, is the person on the document, right?
• 18:30
  So that's what you're trying to do.
• 18:32
  But in order to ensure the Integrity of that, you have to
• 18:35
  make sure the person who's taking the selfie is the real
• 18:38
  person. And is not, as you said, a fake,
• 18:41
  a fake, because they picked up a held up.
• 18:43
  A photograph, to put on a mask, they played a video or something
• 18:47
  like that. So what liveness detection is
• 18:49
  trying to do is trying to determine that this selfie that
• 18:51
  was taken is taken off a real person, where any thing that
• 18:56
  would be used to fake, that can be caught so it's a security
• 19:00
  control around the ability. Selfie taking that you then
• 19:04
  during the match on and that you know, likeness detection is the
• 19:08
  core. The I've said the server a bunch
• 19:11
  of times in various talks that given the because people talk
• 19:15
  about, oh my biometric. If my Biometrics stolen is like
• 19:17
  my foot password, got stolen and things like that and it's not
• 19:20
  right. The power of biometric is an
• 19:22
  authentication Factor specifically.
• 19:24
  But in all of these cases where we were to using it in this
• 19:27
  context, in the proofing Factor doesn't like in its secrecy
• 19:31
  because biometrics Or the most part are not secret the life.
• 19:34
  The see the proof lies in actually the liveness detection
• 19:38
  of it. That's the that's the real
• 19:40
  thing. That makes sure that you have
• 19:42
  Assurance around the Integrity of the process that you're
• 19:45
  taking the user through. So that's why it's a really
• 19:47
  critical component that you really need to pay attention to.
• 19:51
  So, the satellite just detection, that would tell you
• 19:55
  the difference between identical twins.
• 19:57
  It's something else about that. King process is that an issue
• 20:05
  within the industry that we're struggling with it with
• 20:10
  identical twins. It doesn't come up a lot.
• 20:14
  So I would say it's not really I mean it's a nice interesting
• 20:19
  example. That always gets used when
• 20:21
  having a conversation about how good is this process.
• 20:24
  But in reality, identical twins performing, fraud isn't really a
• 20:29
  isn't really an attack Vector that we any business is worried
• 20:32
  about, right? It's not really high.
• 20:35
  The few cases where it might be high.
• 20:37
  Like, for example, if you're trying to commit some kind of,
• 20:41
  you know, Account takeover fraud, in the context of, you
• 20:44
  know, I want to take over your bank account and, you know, you
• 20:48
  know, siblings are falling out when you have a high risk
• 20:50
  transaction that like that, you don't rely on just that.
• 20:53
  Then at that point you bring in additional things to validate
• 20:57
  it, right? So you will do additional
• 20:58
  checks. In addition to this you won't
• 21:01
  you always risk adjust what you're doing.
• 21:02
  So from that perspective, identical twins fraud or you
• 21:06
  know, attack Vector is an interesting, you know,
• 21:10
  theoretical concept, but in practicality nobody really ever.
• 21:12
  Has to deal with it. What are bigger issues and
• 21:15
  bigger challenges right now that we see across the board is
• 21:21
  account takeover fraud, where, because you have identity
• 21:26
  documents themselves that are easy to spoof and fake.
• 21:32
  I can present myself as some as a fictitious person.
• 21:35
  So it's more akin to the synthetic identity problem or me
• 21:39
  stealing somebody's a day. Not because I looked like them.
• 21:43
  But because I took their document and put my likeness on
• 21:46
  the document. So it's the, it's Jim's
• 21:48
  document, but it's my picture on it.
• 21:50
  So how do you catch that? So verifying the document data,
• 21:53
  but I find that I approve of the identity that you're actually
• 21:56
  using. That's really where the real
• 21:58
  challenges are. Because quite frankly for an
• 22:03
  industry, where we are, so obsessed and work on standards
• 22:06
  and, you know, the xkcd article, there's 14 standards and it's
• 22:09
  not working. So that's figure out how to
• 22:11
  combine it together. Now, we have 15 Right in
• 22:14
  identity proofing and the document space is wide open.
• 22:19
  Like there is no real cohesive standards so when you're trying
• 22:23
  to do this you have to deal with each Place.
• 22:26
  Each jurisdiction each geographic region, completely
• 22:30
  different. So, when in our product where,
• 22:33
  you know, rebuilt, we're building the site every platform
• 22:36
  which does the whole end-to-end security around the identity,
• 22:39
  right? From proofing, onboarding,
• 22:42
  authentications Strong authentication account recovery.
• 22:44
  All of that. We're trying to put it all
• 22:46
  together into one cohesive seamless flow.
• 22:49
  That's what our platform does. And then we dealing with
• 22:51
  onboarding and, and this kind of identity proofing, we're dealing
• 22:54
  with you've got countries where they have fully digitized
• 23:00
  documents. Like, if you go to Singapore,
• 23:01
  you have sing pass, you have, you know, identity wallets.
• 23:05
  If you by the government, that can give you verifiable
• 23:07
  credentials in some sense and so on.
• 23:11
  And you have the US where We have passports that have chips
• 23:14
  in it, but we have, you know, state driver's licenses where
• 23:17
  every state has a completely different format and structure.
• 23:21
  And then you have, you know, we dealing a lot in areas like
• 23:24
  Africa and South America, where you have the gamut.
• 23:28
  You have really sophisticated chip-based and document but you
• 23:31
  also have in the same area, same jurisdiction, same population.
• 23:35
  People whose only identification is a piece of paper, like
• 23:38
  literally a piece of A4 paper that has been folded up because
• 23:41
  it's got stuff written on it. And and and Stuff and your as a
• 23:44
  business trying to cover the entire population, which means
• 23:47
  have to do with this in this vast range.
• 23:50
  That's really the challenge. And I think that's where things
• 23:52
  like verifiable credentials, Etc.
• 23:55
  Really are the answers that people are looking for.
• 23:58
  Whether we get, there is a whole different issue.
• 24:00
  Because there's, you know, like I said, other challenges the
• 24:03
  place, but if you get to the point where you have that, that
• 24:06
  can really solve a lot of these problems.
• 24:07
  Because right now, people are dealing with just Goofy stuff.
• 24:11
  Right? You know, this is not something
• 24:12
  we should be dealing with but we unfortunately have to deal with
• 24:14
  because we living in the real world, right?
• 24:17
  Yeah. I never really even thought of
• 24:19
  that fraud use case where you just change the picture on the
• 24:22
  driver's license and then take a picture of that.
• 24:25
  Now, I'm comparing my live self to a fake version of the
• 24:29
  license. If you're able to take that
• 24:32
  license and somehow verify that it hasn't been modified.
• 24:37
  So, give me an example on the state Of all the 50 states that
• 24:41
  they have some API that you go in here and you can download
• 24:45
  something that is like a low-res version of the license that you
• 24:49
  can somehow do a comparison to make sure that it's the same
• 24:54
  license. I mean how how do you make that
• 24:57
  work with it? That it would be nice right?
• 24:59
  But no and again it's not the challenge that we have is it
• 25:05
  sounds like a nice idea to start getting into the intricacies of
• 25:09
  Just look at the way you described it.
• 25:11
  Or is there an API can download? You know, I can connect to that
• 25:15
  APN and can download Jim's license and Jim's picture.
• 25:18
  Wait, what about privacy? What about Jim's privacy, who
• 25:21
  has access to that API? What are they doing with that
• 25:23
  data? So there's all these concerns
• 25:28
  and I want to say, answer your concerns but their envelope and
• 25:31
  concerns that you have to account for in this kind of
• 25:34
  thing where you have to worry about privacy after, right?
• 25:37
  But who has access of data, what are they using?
• 25:39
  For who's authorized to use it, you know, should the bartender
• 25:44
  have the ability to pick up a phone and look you up and get a
• 25:47
  dress, just take a picture of you, take a selfie of you at the
• 25:50
  bar as your ordering the drink and get immediately a download
• 25:53
  from the DMV saying, yeah, this is Jim and this is his date of
• 25:56
  birth or whatever you don't want that, right?
• 25:59
  Because that that has huge potential ramifications.
• 26:02
  But having those kind of identity Services is actually
• 26:06
  pretty important when designed correctly and you do it
• 26:08
  correctly. If we, because like I said, that
• 26:10
  is what will help us get past the current Log Jam, we find
• 26:14
  ourself in where one of the challenges we, you often find
• 26:19
  is, as it kind of what you bought pointed out, right?
• 26:22
  What is the technology that is available?
• 26:24
  But the technology default now has become smartphone based.
• 26:28
  So what you're immediately excluding from that realm is
• 26:33
  people who don't have access to smartphones, who are under the
• 26:35
  tech poverty line, people who don't have, you know, valid,
• 26:39
  Identity documents which is not as easy to have as you would
• 26:42
  think like people lose. I Dare You documents all the
• 26:44
  time. This is particularly problematic
• 26:45
  for folks who are, you know, displaced whether it's
• 26:52
  immigrants or local people, who are displaced, who have lost
• 26:55
  everything, and they don't have anything anymore.
• 26:57
  But they need that identity. So they can their identity to
• 27:00
  get the prove that I didn't. So they can go get welfare
• 27:02
  benefits. How do you solve the problem?
• 27:04
  These are really tricky. Really complicated challenges
• 27:07
  trying to do all of that and talk about All of that we could
• 27:09
  be talking for hours and not gonna get into that but you kind
• 27:13
  of get a sense of what the scope and the, you know, scale of this
• 27:17
  challenge is as you go that way. For example, one of the things
• 27:21
  we're working with one of our partners, we dealing with a
• 27:25
  banking product that is targeted for financial inclusion.
• 27:28
  So it's a it's a it's a banking platform that is used for
• 27:31
  providing services to communities that are that have
• 27:35
  traditionally been unbanked. And so they end up Having very
• 27:39
  very unique challenges that we kind of have to figure out that
• 27:43
  forced us to really rethink some of the ways in which we do stuff
• 27:47
  from an identity perspective. Then improve enforcement.
• 27:49
  I feel like everything you've been talking about is these are
• 27:54
  hard problems to solve the we does the industry.
• 27:57
  Draw a line at some point to say here are the things that we can
• 28:01
  solve and these are the variables that we can count on
• 28:05
  versus trying to design a system that works for literally Every
• 28:09
  single person in every single country and every single region
• 28:12
  by blah blah. Right, even planet right?
• 28:14
  Ya know how does that work? Like is there a line that
• 28:16
  basically says okay well you need to be, you know, this tall
• 28:20
  to ride basically. Yeah.
• 28:22
  For the identity space. Absolutely.
• 28:25
  And I think people draw the line all the time.
• 28:27
  The challenge I think, right. Now we're facing in the industry
• 28:31
  which was a key part of the, the keynote I gave it identifies is
• 28:38
  We've all been drawing that line, kind of arbitrarily and
• 28:43
  there are no guidelines. There is no, you know,
• 28:47
  overarching ethical sort of body or organization or anybody that
• 28:54
  is saying well no wait that line is drawn way too high or
• 28:59
  technical side weight that drawn and that line is Runway too low
• 29:02
  and you just not just never going to get there.
• 29:04
  So now you just spending a bunch of money and time and effort
• 29:07
  trying to build something That will never reach us objective
• 29:10
  Go. I mean, you guys have been doing
• 29:12
  I am projects forever, right? You know what it's like right,
• 29:15
  you define scope but you have to figure out a way to make the
• 29:17
  scope practical and actually deliverable because go scope
• 29:21
  creep happens all the time. And the challenge with this is
• 29:25
  that when you draw the line too high, then you have exclusion
• 29:29
  problems. And that that's obviously not a
• 29:31
  good thing especially with what we the role we play, right?
• 29:36
  If you know, we don't we say Yeah, you're going to need, you
• 29:39
  need the latest iPhone or the latest Android.
• 29:41
  Great technically it works great.
• 29:42
  But all of a sudden you now build something that up.
• 29:45
  Huge SEC. Check the population.
• 29:47
  You say yeah we don't care about you.
• 29:49
  Plus makes you wonder if we get down to a point where because of
• 29:52
  the the hardware assisted being fragmented amongst.
• 29:56
  Let's call it let's call it three major players, right?
• 29:57
  Microsoft Google and apple between Windows, the Apple
• 30:02
  series of of os's and then you've got Android from Google
• 30:06
  on the mobile device, side of things you know it's taken a
• 30:09
  while even with the for those three heavyweights who are also
• 30:13
  browser manufacturers to come to agreement on even a standard
• 30:17
  like web authentic and the fight.
• 30:19
  Laughs, getting involved with that and really making progress,
• 30:22
  but that took time, I wonder if we get to the point where, you
• 30:25
  know, it's it becomes, oh yeah, your can be verified, but it's
• 30:29
  like, the blue chat, green chat, where it only works on iPhone,
• 30:33
  or it only works on Android or Windows.
• 30:35
  Hello, only works on Windows right?
• 30:37
  Those sorts of things. If we are, we are we destined to
• 30:42
  basically repeat you know, history and have this
• 30:46
  fragmentation or do you think that there's hope that we can
• 30:49
  make? Maybe solve for this ahead of
• 30:50
  time through more neutral bodies or through third parties that
• 30:54
  are sort of acting as the bridge across devices. yeah, so I think
• 31:03
  I would love to say that this is a linear progression towards an
• 31:07
  objective and goal, right? Yeah, we see the advances, we
• 31:12
  see the advances with the mobile plant manufactures, with see how
• 31:14
  the cooperating, and things like that, and we're working towards
• 31:17
  something, and we're going to get there.
• 31:18
  If you keep going down this path, I don't have any faith
• 31:21
  that that will actually happen. What I do think is actually
• 31:24
  going to happen, is there's 50 different types of ways.
• 31:28
  People are trying to solve this and they're all, you know,
• 31:32
  trying to solve Sort of in a Jason sees, but with some unique
• 31:36
  differences, or whatever. But at the end of the day, there
• 31:40
  are doing this to one thing that has to happen.
• 31:42
  And one thing that I think will happen, one thing that has to
• 31:45
  happen is this will require investment from actors that are
• 31:50
  not incentivized by profit and not incentivized by business is
• 31:54
  that exercise. It was so.
• 31:56
  So we've seen. So if you think about it from
• 31:58
  that perspective, right? There's a reason why what
• 32:00
  Singapore did has worked really well because I looked at it and
• 32:04
  said, we are not. We're looking at it as something
• 32:07
  that gives benefit to Citizens, right?
• 32:10
  And so there's a regular, there's a government requirement
• 32:14
  or government mandate that came in saying, this is helpful, this
• 32:17
  will unlock a bunch of other things.
• 32:19
  So it's worth for us to make the investment.
• 32:21
  We've seen this happen in Canada.
• 32:25
  If you've talked to Joey Brennan, who heads diac, she can
• 32:29
  she's much better than me at explaining this and how she's
• 32:31
  been able to Wrangle the cats and get things working.
• 32:35
  To a public-private partnership and getting people on board on
• 32:39
  board with the idea, but it takes to your point.
• 32:41
  It takes a lot of time, but without that, kind of driver,
• 32:45
  it's not going to happen. So, that's the key key piece,
• 32:48
  right? So, we see in the US, for
• 32:49
  example, better idea. Coalition is trying to push for
• 32:53
  digital identity. Bills is trying to push for
• 32:55
  government to become an attribute provider and issuer of
• 32:59
  a silo credentials and things like that.
• 33:02
  That will that will have Downstream benefits.
• 33:06
  In our organization, we see in Africa, for example, a bunch of
• 33:09
  governments are heavily investing in digital identity
• 33:13
  initiatives because they see that this is a way of really
• 33:16
  unlocking the potential of their citizenship Citroen citizenry.
• 33:21
  So that's the thing that has to happen for us to any in any way
• 33:24
  shape form, get somewhere. The flip side of that is the
• 33:27
  thing that makes it will likely happen.
• 33:30
  Is this going to be something that comes out of nowhere?
• 33:32
  That we don't predict that the comment down would Killer app or
• 33:36
  something like that. Something will happen that we
• 33:38
  can't really see but that will unlock it sort of a methodology
• 33:43
  or a modality or something. We're always gonna be like, hey,
• 33:47
  let's jump on that. And that's that will that will
• 33:50
  be the thing that unlocks everybody else's ability to say,
• 33:54
  oh, I can use that, I can use that, I can use that, and that's
• 33:57
  going to happen. I be seeing that with to a
• 33:59
  certain extent with how, when Apple and Android start working
• 34:03
  with with the secure enclave and Paris.
• 34:05
  Metrics on the device and how all of a sudden that has
• 34:08
  unlocked a lot of potential around, how authentication is
• 34:11
  MFA happens and things like that.
• 34:13
  Those things will, I think show up and create they will be
• 34:17
  unexpected sources of advancement, but that when they
• 34:20
  show up will be like, well, that was totally logical.
• 34:22
  But we can't see it right now. I'm sure something like that
• 34:25
  will happen. Yeah, makes me wonder what that
• 34:27
  killer app will be because I feel like this is not a
• 34:30
  technology problem per se. It is a mindset problem because
• 34:34
  I think of anything that The pandemic has taught us is half
• 34:37
  the population. Will, you know, do do will make
• 34:41
  the societal choice and others may not for various reasons,
• 34:45
  whatever it may be right. What is the killer app that
• 34:49
  brings everybody to the table. I just, you know, I just moved
• 34:52
  and had to go in. I spent the day getting driver's
• 34:55
  license and license plates and things like that, and that was a
• 34:59
  pain in the butt. Like, this is all stuff.
• 35:01
  I should be able to do online. You don't make it easy.
• 35:05
  Things like that and maybe that's it.
• 35:07
  Maybe it's, you know, easy access to government services to
• 35:12
  pay your taxes. Get your IDs change your names,
• 35:16
  right? All the things that you kind of
• 35:18
  take for granted. They're like what do you mean
• 35:20
  this is, this is your 2022. What do you mean?
• 35:21
  I can't do it online. What do you mean?
• 35:23
  I have to make an appointment for 3 months out.
• 35:26
  Not saying that this didn't happen to me then show up and
• 35:29
  then wait another two hours after my appointment to actually
• 35:33
  get in for my scheduled. Like this is it seems, you know,
• 35:38
  weird to me that we still haven't sort of solve this
• 35:41
  identity at a macro level of making it easier for the
• 35:46
  population and it feel like it's not necessarily a technology
• 35:49
  thing. At this point, we have the tools
• 35:52
  I'm wondering what is that? Killer app that will pull
• 35:55
  everyone to the table and say, oh yes, we are willing to either
• 35:59
  invest in this, in some way, whether it's investment
• 36:01
  financially or investment in, you know, the The Privacy
• 36:07
  components, that might go into either managing that or giving
• 36:10
  up some level of privacy to be able to take advantage of things
• 36:13
  like that. It makes me wonder you know when
• 36:16
  will that happen? I don't know if we have an
• 36:18
  answer but it gives no thinking. I most definitely do not have an
• 36:22
  answer because honestly it is one of those things where you
• 36:26
  catch me on the wrong day and I'll be like, listen, I've been
• 36:28
  dealing with this for the last three months.
• 36:30
  I know exactly what's going on. This is never going to happen.
• 36:32
  I know the people involved, this is never going to happen.
• 36:34
  They will kill this. But then there's other days
• 36:36
  where I'm like, oh I see people who want to and they're willing
• 36:40
  to make the investment and you're right, it's not a
• 36:43
  technology problem. Honestly, you know, and we
• 36:46
  talked about this in, I am all the time.
• 36:47
  I'd like, it's not about technology is about process and
• 36:50
  it's about people. It's actually more than that,
• 36:52
  right? This is, this is not just about
• 36:54
  not even just about process. And people it's about Legacy
• 36:58
  that or detect that and the fact that yeah, we have the
• 37:01
  technology but shifting what you have today to the new
• 37:04
  technologies, just way too complicated.
• 37:05
  Because nobody figures out how to do a migration correctly.
• 37:08
  That's not something people invested, its political, it's
• 37:12
  highly sensitive and personal like that's one of the things
• 37:15
  that, you know, both frustrates but also attracts me to this
• 37:21
  identity thing that we work in which is it's not a pure Tech
• 37:25
  problem, right? It's not just throw a bunch of
• 37:28
  cryptography that or, you know, just build build a service and
• 37:31
  it's fine. I can just, I just need to
• 37:32
  figure out how to do high availability or something like
• 37:35
  that. And configure my network nodes,
• 37:37
  this is about people and people by definition become nebulous
• 37:42
  and problematic to figure out because you can't do it one way
• 37:44
  for across everybody. We were is unique and so you end
• 37:47
  up with this really challenging in many times philosophical
• 37:50
  issue. But usually like I said, it's
• 37:52
  political its Financial, you know, it's just problematic that
• 37:57
  way. Yeah, the experience that I went
• 38:00
  through recently was I was going for a mortgage and had to go and
• 38:05
  It's some transcripts from the IRS, so it's forced to go
• 38:08
  through the ID dot me process. It seemed like the ultimate
• 38:13
  example of a friction user experience, right?
• 38:17
  We're all shooting for this frictionless user experience.
• 38:19
  There's a ton of friction to get that verified identity now
• 38:24
  effort. And if it wasn't that I needed
• 38:27
  those transcripts so badly, I would have abandoned the
• 38:30
  process, right. But there's enough value there
• 38:32
  that as willing to go through, so to kind of go back to the the
• 38:35
  killer app to me, what I was thinking was now that I've gone
• 38:39
  through this now the IRS has my identity verified boy.
• 38:44
  It would be great if I could use that verified identity Elsewhere
• 38:48
  for other government services or, you know, be even better if
• 38:53
  I could somehow stick it in a wallet on my phone and use it to
• 38:58
  authenticate for high, you know high risk transactions and never
• 39:04
  have to go through this. Again, or not have to go through
• 39:06
  this again for a long time. So to me, it was killer app
• 39:10
  being that. I go through it one time because
• 39:13
  I have to but then I get to leverage it for much more.
• 39:17
  What are your thoughts on that? So, it is precisely, what a
• 39:22
  bunch of organizations taught would happen, right?
• 39:25
  Which is, we just need that one place where there is enough Of
• 39:32
  an incentive for people to go through a very heavy friction
• 39:36
  process to bootstrap, they're sort of verified identity system
• 39:41
  and now you can take that verified identity and use it
• 39:44
  everywhere else, right? That's the Nirvana.
• 39:48
  Right? If you will and then that falls,
• 39:51
  that doesn't fall apart on technical reason.
• 39:53
  It falls apart. Found like I said, Let It Go
• 39:56
  policy controls. Like who else has access to it
• 40:00
  wherever I'm using it somewhere else, with why using Somewhere
• 40:02
  else. What if I don't want those, I
• 40:04
  don't like we saw with the backlash that happened to I eat
• 40:09
  at me of a huge part of it because this is a private
• 40:12
  entity. Yes, it's for IRS but it's a
• 40:14
  private entity. They now have a huge
• 40:18
  Stranglehold on something that's very valuable and they can do
• 40:21
  things like I can look across Services, I can see what all
• 40:24
  you're doing. There's these are political
• 40:26
  issues that prevent stuff like this and that's the reason why
• 40:28
  we folks have been trying to do verify the credentials and do
• 40:31
  something. Where it sort of dissing
• 40:33
  disambiguates or this intermediates the whole process.
• 40:37
  So you can set up a service where you build it, they will
• 40:39
  verify your identity but then they can issue your credentials.
• 40:43
  And then you can take those credentials with you and use
• 40:45
  them without having the authority knowing that you're
• 40:49
  using it. And the service provider has a
• 40:51
  way of using your verifiable credential to it's verifiable
• 40:56
  because they're getting the credential.
• 40:57
  They getting the other stations that are in that credential and
• 41:00
  saying, well, I can verify this. But I don't have to actually go
• 41:03
  back to somebody or I have a way of doing it without requiring,
• 41:06
  the dots, getting connected, the dots getting connected piece is
• 41:10
  a huge block of in a whole bunch of energy initiatives that show
• 41:14
  up and that's the flip side of it right there.
• 41:17
  I use the Singapore example for a couple of times.
• 41:21
  The flip side of the sink of example is also an example of
• 41:24
  the kind of idea that would never work here because it is
• 41:26
  highly centralized and it is all the dots are connected and
• 41:29
  somebody has complete visibility on your whole life.
• 41:31
  And You know, you know, that would never work here.
• 41:34
  That's the reason why we don't have a single federal identity
• 41:37
  Federal national ID and all that sort of stuff.
• 41:41
  So, like I said, it's not that the picture.
• 41:43
  It's like you said, Jeff I? This is not that, it's a
• 41:45
  technology issue. The technology to do many
• 41:48
  different things exist. It's about, can you do it in a
• 41:51
  way that satisfies the needs of the various constituents,
• 41:55
  including the citizen, including the human being?
• 41:58
  That is part of this process. It sounds to me, like what
• 42:01
  you're proposing is sort of like this this set of different
• 42:06
  attributes and their kind of chain together.
• 42:09
  And then, you know, maybe they're like different shapes,
• 42:11
  may be just like blocks or something like that.
• 42:14
  And then, you know, you somehow leverage.
• 42:16
  This thing I do, I'll call it Block Chain.
• 42:19
  Now, that'll be better term. Okay, I got to drop off that.
• 42:23
  I got to be part of this great job.
• 42:29
  Let's shift gears a little bit. How to make sure we respect the
• 42:32
  Sean's time. A few weeks ago, actually
• 42:35
  probably a couple months ago at this point we asked a bunch of
• 42:39
  identity folks out there what the difference was between
• 42:43
  digital identity and identity and access management.
• 42:46
  And we had us a show and I think we played like five or six
• 42:51
  different responses that we got everyone answered it
• 42:54
  differently. And what I want to do now is I'm
• 42:58
  going to ask you the shot the same question here.
• 43:00
  But before I want to get that our friend Alec fry fry identity
• 43:04
  for those who are in the know, also responded to it a little
• 43:08
  bit late, but I promised we would get it in.
• 43:11
  So I'm going to play it now. It's about three or four
• 43:12
  minutes, sort of his explanation of what he thinks the difference
• 43:15
  is between digital identity, and he has some good analogies in
• 43:18
  there and then what we'll do is we'll just kind of talk about it
• 43:20
  real quick. So let me play that now, good
• 43:24
  day, gents for identity here. I'm so excited to say that I
• 43:27
  have the, the answer, I have the solution to the major.
• 43:30
  You know, of I am versus digital identity at first, when I
• 43:34
  recorded something it was a lot like what you guys said late in
• 43:37
  the conversation in session. 151, where if you ask what your
• 43:42
  practice does earlier used to say that you do?
• 43:44
  I am and recently you would say you do digital identity.
• 43:48
  And the reason why I think that during the responses from
• 43:52
  different people where digital identity fits kept flipping from
• 43:56
  being the umbrella layer above I am and then later Terron being
• 44:00
  the lower component underneath. I am, I think the major reason
• 44:04
  for that is because if I ask you, what does the word football
• 44:08
  mean? You might tell me.
• 44:10
  It means a sport. If two teams are people running
• 44:12
  around on a field trying to score goals against each other
• 44:16
  or you might tell me it's a little leather ball that's used
• 44:19
  in that sport on the field and I think digital identity is
• 44:23
  exactly that. So, earlier on identity and
• 44:26
  access management in the early days meant as someone pointed,
• 44:30
  At user account management. So it means giving users access
• 44:33
  to systems basically getting their identity validating it
• 44:37
  with a password or now with MFA or password list, even and and
• 44:41
  then allowing them access to certain systems.
• 44:43
  I am kind of became the umbrella term for things that also
• 44:47
  included IGA. So technically I am is the
• 44:51
  access and the authentication and IGA is governance of the
• 44:55
  user the user profiles and everything else.
• 44:57
  But arguably, I am was kind of you As an umbrella term above
• 45:01
  that anyway. So the interesting thing is as
• 45:04
  you said as well that with Siam now I am is sometimes got an
• 45:09
  invisible W-4 Workforce in front of it.
• 45:11
  So again there's not really a new umbrella term to sit over
• 45:16
  Workforce, I am and Siam then, as we said there's also IGA and
• 45:21
  other areas. And then as pointed out by Sarah
• 45:24
  as well, ID proofing, so whole verification of physical.
• 45:30
  To a user's online digital representation.
• 45:34
  Now interestingly, as well, as I think Jim said that when you log
• 45:39
  into a certain environment, whether it's apple or an online
• 45:42
  store that you deal with, they have a digital identity
• 45:46
  representation of you. Similarly, as you said, in the
• 45:49
  Internet of Things devices, each have its own digital identity.
• 45:54
  So I think the challenge here getting the terminology sort of
• 45:59
  sort it out. Out or agreed upon.
• 46:01
  I think, as you said, the real challenge is the context in
• 46:05
  which the person you're talking to is referring to this whole
• 46:08
  Space, where the umbrella which arguably.
• 46:12
  For now, let's say doesn't have a proper title includes.
• 46:15
  I am and Siam and Workforce. I am and IGA, and authentication
• 46:24
  of, you know, identity proofing and assurance and all those
• 46:27
  other factors including things like The sea and other areas
• 46:31
  that fit in that space as well. And even risk and fraud
• 46:34
  detection, everything that fits in what's needed to manage user
• 46:40
  access. And, you know, identifying the
• 46:42
  correct person making sure the right access to the right
• 46:44
  systems at the right, time in the right context and everything
• 46:47
  that we've sort of come to phrase a lot around this whole
• 46:50
  space. But I think the biggest
• 46:52
  challenge is that in the last, however, many years now that
• 46:55
  we're looking at that record that is stored in systems.
• 47:00
  Of a user and their habits, and their system access.
• 47:03
  That's a digital identity and for lack of a better umbrella
• 47:07
  term, I think I am and sort of more recently.
• 47:10
  Digital identity is being used as the umbrella term as well
• 47:14
  because we don't have a great umbrella term for it.
• 47:17
  So, there you go. I think, at the end of the day
• 47:19
  football is the whole answer to the question of?
• 47:22
  What's the difference between I am and digital identity.
• 47:25
  Hope that was helpful. Thanks bye.
• 47:27
  Alright, so that was from Alec Friday.
• 47:29
  I think you here. Brings up a few different
• 47:30
  points. For what I'm hearing is, he
• 47:33
  agrees with sort of my assessment?
• 47:34
  Is that context matters who you're talking to, how you're
• 47:38
  using it, the words, I guess and that it can kind of morph around
• 47:43
  anything in there. Kind of jog, may be a difference
• 47:46
  of opinion or maybe you want to add on to that in a second.
• 47:50
  So I hate this question, just because it's what's good, where
• 47:56
  you will never have a good, you will never get a good answer
• 47:58
  because everybody comes That it slightly differently and I'm
• 48:02
  sure you've seen that with all the responses you got from
• 48:04
  everybody else. But and I can just hear Steve
• 48:09
  Wilson yelling at me. No, the we should just ban the
• 48:12
  word identity, identity doesn't exist.
• 48:14
  Everything is about data. Everything is about, you know,
• 48:17
  got it. What it is, that's rather than
• 48:19
  some trying to figure out something, but at the end of the
• 48:21
  day, I think, So I understand all of these perspectives
• 48:27
  because at the end of the day there is no right answer.
• 48:30
  It's more about what is it that we're trying to solve?
• 48:33
  Like I can't like I said, I come at everything from a use case
• 48:35
  problem and and also an architecture background.
• 48:38
  So I think about about everything like architect and
• 48:40
  architect. And the me I am is simple in
• 48:44
  terms of a definition and can get very complicated very
• 48:46
  quickly but it's simple, it's about the tools.
• 48:49
  The technology is the methodology is the processes
• 48:53
  around. Managing identities.
• 48:55
  The word management is right in there, right?
• 48:56
  It's about managing identities. What is an identity?
• 49:00
  That's what digital the word, digital item in somebody's as
• 49:02
  well as a digital identity. Well, you're managing the
• 49:06
  digital identity, but what is the digital identity is so
• 49:10
  nebulous and so directly tied to, who's using it?
• 49:14
  Not who has, it is not about the individual, but who's using it
• 49:19
  and what that sort of consuming entity the business, the
• 49:24
  service, whatever it needs. It defines what?
• 49:26
  It considers an identity and when it defines what?
• 49:29
  It considers an identity you then pick what are the I am.
• 49:34
  Components tools, technology Etc that you need in order to
• 49:38
  satisfy that requirement. So for example, you know, it's
• 49:43
  interesting because obviously I come from an identity management
• 49:47
  background where I was doing what is called Enterprise
• 49:50
  identity, which is Workforce identity, etc, etc.
• 49:52
  But I do not consider, I am to be the silent W, right?
• 49:58
  For me, I am is encompassing because I very much deal with.
• 50:01
  I am even in the consumer space because Consumer space requires,
• 50:06
  I am methodologies, whether it's onboarding proofing which is
• 50:09
  essentially what in the Enterprise and anywhere we would
• 50:11
  have called account registration.
• 50:13
  User registration is the equivalent thing but they're
• 50:15
  doing it from a different place. Different requirements,
• 50:17
  different needs. Do you need IGA in consumer
• 50:22
  identity, not necessarily, but you do need proofing.
• 50:25
  You do need you. A lot of nice people don't think
• 50:28
  about authorization the vast majority of consumer.
• 50:32
  I am deployments. Don't care about authorization.
• 50:34
  Because every user is a customer and they're all kind of the same
• 50:37
  but then you go to another scenarios.
• 50:40
  Oh well they end user logged in and I want them to have certain
• 50:44
  oauth Scopes based on who they are.
• 50:46
  Certain rules that allow them to do what they can do.
• 50:49
  Allow them to access certain features that I pray for them.
• 50:53
  So now you've got authorization in the space so digital
• 50:56
  identity. So digital identity itself is
• 50:58
  nebulous and very much defined by who's using it and because it
• 51:02
  is defined by who's using it. That dictates what that
• 51:06
  consuming entity service etcetera will call I am.
• 51:10
  But at the end of the day, I am just on the ID Pro body of
• 51:15
  knowledge. There are lots of definitions
• 51:17
  there. I don't necessarily agree with
• 51:19
  all of them, but at least with stuff like I am Etc.
• 51:22
  It tries to get to that point which is I am is a much much
• 51:25
  simpler definition because it's mostly focusing on the tools and
• 51:28
  Technologies and processes and digital identity is in the eye
• 51:31
  of the beholder. So that's nebulous and that and
• 51:33
  they're connected. There are talking about the
• 51:35
  connected so you can't in you can't separate the two.
• 51:38
  So it's not about umbrella or anything.
• 51:41
  I've introduced a new dimension right, there are talking to each
• 51:43
  other and related, right? Well you bring up, you know, the
• 51:47
  different definitions even like within ID Pro right, which is
• 51:51
  made up of a whole bunch of identity people.
• 51:53
  And I think there's value in that because it's offering
• 51:56
  different perspectives. And yeah, I don't think will
• 52:00
  ever come. I don't know if we'll come to an
• 52:01
  agreement on the definition itself, but I I think at least
• 52:05
  understanding the different viewpoints and the context that
• 52:09
  people might be approaching it from is helpful in the design,
• 52:13
  the thinking, you know, of both the architecture business
• 52:16
  processes, cetera things like that.
• 52:18
  That was I think one of the things I took away at our
• 52:19
  original episode, we did on this was a damn Michael.
• 52:23
  He was the only one of the folks that we had kind of played.
• 52:26
  He's from Texas A&M and he's in the business.
• 52:29
  Meaning he's not a identity vendor, he's not an identity
• 52:32
  consultant, he's running identity, For a very large
• 52:35
  organization. So his viewpoint on what is
• 52:39
  difference in the two was completely different than
• 52:41
  everyone else, not that it wasn't more or less valid.
• 52:45
  It was just a different Viewpoint and you're basically
• 52:47
  looking at the problem and looking at the space and all the
• 52:51
  answers are probably right to some degree based on the context
• 52:55
  of looking at it. Yeah, and I'm sure you've
• 52:57
  encountered this like there's a bunch of stuff that we do and
• 52:59
  identity that we get pulled into.
• 53:02
  That from a business, the business doesn't even consider
• 53:05
  it or think about it as identity.
• 53:06
  They're like, why are you guys here?
• 53:08
  Like this is not anything that you think this is my, you know,
• 53:11
  kyc project is my fraud. This is a fraud system.
• 53:14
  Why is the identity folks are like?
• 53:16
  Well, because we're feeding you the data, that is helping you
• 53:20
  drive, your fraud and risk decisions.
• 53:21
  And so you need to tell us what you care about.
• 53:23
  And so that we can build that into the identity system.
• 53:25
  Etc. Etc.
• 53:25
  So, most of the time, the businesses don't even think of
• 53:28
  this as identity for them is their Core Business.
• 53:31
  Well, identities, at the center. Jill, what do you do?
• 53:34
  What do you think about what Alex said?
• 53:36
  That's it. I think this is his definition
• 53:39
  is as good as any that I've heard because I think it's it's
• 53:43
  kind of a nebulous answer. But here's here's what I'm going
• 53:46
  to bring new to the conversation.
• 53:48
  So I had this thought. Recently, which is that?
• 53:53
  You know, when we went from calling it, I am to some people
• 53:56
  are now calling you digital identity.
• 53:58
  We don't know if that's going to catch on, and everybody's just
• 54:00
  going to call this space digital identity, and not identity and
• 54:04
  access management and a year. But or in five years or or any
• 54:09
  time down the road but it brought me back to the term, IGA
• 54:14
  the term IGA didn't exist, whatever.
• 54:16
  It was 10 15 years ago, it was called identity management,
• 54:20
  right? Then something happened to those
• 54:23
  platforms. That someone said these are not
• 54:25
  like the old identity management platforms out there doing
• 54:28
  governance right there, a full circle picture of the identity
• 54:33
  lifecycle. And now we're going to call it
• 54:36
  identity governance and administration.
• 54:37
  I think it was identity Administration and governance
• 54:39
  and first, but that kind of the same thing, right?
• 54:43
  So actually something change to go from one, you know, identity
• 54:48
  management, which was, you know, Oracle.
• 54:52
  See a son and then sell point and of exit came out and like
• 54:58
  created this new space and all those other tools that went on
• 55:01
  to acquire Government Solutions, bolted them onto their
• 55:05
  traditional identity management system and said you know hey
• 55:09
  we've got iga2 and everything kind of fell into the bucket but
• 55:12
  the ones that were truly IJ systems, are the ones that
• 55:17
  survived in and kind of made it, our hooks that hook So much I
• 55:21
  know because I was there you wrote Thor but you know then it
• 55:26
  got bought by what Oracle, right?
• 55:29
  Yeah. And then but that's the thing,
• 55:30
  right? It's like we had a identity
• 55:33
  management platform which was focused on provisioning and to
• 55:37
  meet the business requirements. We built-in capabilities for
• 55:40
  Access certification, a recertification, right?
• 55:43
  And it was just part of our identity management solution,
• 55:46
  right? And we had it, and then we've
• 55:48
  said, had it and then we all got four in And so son, had it, and
• 55:51
  then Oracle had it. And then you had the nerve to
• 55:56
  newer folks short of show up saying, well, we're going to
• 56:00
  focus on that one feature but saying, you can't raise money
• 56:05
  and you can sell a product saying, what you're selling is a
• 56:08
  feature, so they built it better.
• 56:12
  But was essentially a super if you think about it, is
• 56:16
  supercharged version of what, all of these products had where
• 56:18
  we were sending it. As a feature, they cameras are
• 56:21
  It's it's own thing and the term identity governance was born out
• 56:25
  of Marketing. Is my cynical take.
• 56:27
  That's exactly what I was going to say.
• 56:29
  It was a masterful marketing. It look it was a masterful
• 56:31
  marketing move. I wish I had thought of it.
• 56:35
  But you know at the end of the day why did that happen besides
• 56:40
  the money part of it? Is because of the fact going
• 56:43
  back to this definitions are nebulous and we all keep not
• 56:47
  working, we don't work of a single lexicon.
• 56:49
  We don't have a single unified terminology that we all agreed
• 56:52
  on. So it gives you the opportunity
• 56:54
  to come in and say I'm going to create a new thing.
• 56:56
  So yeah, we're talking about verifying identities and
• 56:59
  somebody else will come in and say well yeah, that thing is
• 57:02
  verified that it is his this new thing and it's going to be
• 57:04
  called something else and people will be like, oh that's its own
• 57:07
  thing. When it's not, it may just be
• 57:10
  the same thing in different color clothing, but, you know,
• 57:14
  you you get enough mindshare and all of a sudden, it becomes a
• 57:17
  self-fulfilling prophecy seeing this.
• 57:20
  And again, I'm not in any way shape, or form trying to
• 57:24
  denigrate that, it's just the reality of the space.
• 57:26
  We live in, which is as things evolve people look for ways to
• 57:30
  stand out and differentiate. It's just the nature of being in
• 57:32
  product, and business and analysts.
• 57:36
  Worlds, right? Analyst Juan To also come up
• 57:39
  with new say that we look we understood and this is a new
• 57:41
  thing that is emerging because you need that you need to pay
• 57:43
  attention to. So there's these there's forces
• 57:47
  at work that happen in this context that aren't really
• 57:52
  driven by again. Like I said not, everything is
• 57:55
  linear things just happen. Sometimes you can only get these
• 58:00
  hot takes on the identity at the center podcast.
• 58:05
  Exactly, it's all marketing for sure.
• 58:08
  That, you know, someone there are taste makers that are in the
• 58:11
  space, right? The big analyst firms and they
• 58:13
  come up with these things to call similar products and it's
• 58:17
  whether it's IGA or privileged access management or identity
• 58:23
  threat detection and response or zero, trust the concepts that
• 58:27
  make those things up are not new.
• 58:30
  It's just a repackaged, maybe it's better refined message,
• 58:34
  maybe it is a collection of additional tools.
• 58:38
  That maybe weren't quite a long as they were maybe two or three
• 58:41
  years ago but a lot of stuff does I feel like it does come
• 58:44
  down to marketing and yeah, it's you know it's how do you get
• 58:47
  that in front of the potential buyer?
• 58:49
  Well you got to have something that snazzy new.
• 58:50
  You can't go off and to your point in a shot say well, we
• 58:53
  have a whole bunch of features, right?
• 58:55
  I think that's, I think that's sort of Windows thinking and the
• 58:59
  early 90s versus apple and telling a message and telling a
• 59:04
  story you wanted an iPhone. You didn't Eat an iPhone and I
• 59:09
  think that was part of the message and I think that's where
• 59:10
  we saw some of those up-and-comers.
• 59:13
  Kind of hit at the right time and say okay well we've got this
• 59:15
  kind of legacy to. He myth this web thing seems
• 59:18
  interesting. Maybe there's something there.
• 59:20
  I don't know right. And you know they rode that wave
• 59:24
  and you know they've been very successful with it and there
• 59:27
  will be another thing that comes along that maybe is another
• 59:29
  killer app and identities based kind of circle back for four.
• 59:32
  But I think that's, you know, it's like it's almost like a you
• 59:36
  know, web authentic No one's going to really know what web
• 59:39
  often is what they're going to know is, oh, pass keys.
• 59:42
  I heard that from Apple Windows Google and sort of having this
• 59:47
  marketing term associated with a very technical term that the
• 59:52
  fight Alliance came up with to kind of call it.
• 59:54
  This multi thing which makes a lot of sense to Identity nerds
• 59:57
  like us. You know.
• 59:59
  No one else is going to know what though, they're gonna know
• 1:00:00
  what has passed keys and that's and I think that's good to some
• 1:00:04
  degree. But when we have this nebulous
• 1:00:07
  language, We have, you know, loose interpretations of what,
• 1:00:11
  some of these things mean, that's where we get into
• 1:00:13
  trouble. And that's, that's generally,
• 1:00:14
  writing could get concerned, I see things, you know, everything
• 1:00:17
  is zero trust. Now, you know, there's a zero
• 1:00:19
  trust IGA, what does that even mean, right?
• 1:00:23
  Like, it's just your writing marketing at that point because
• 1:00:26
  you're hoping for, I don't know. SEO.
• 1:00:28
  Search engine optimization more hits in your website.
• 1:00:30
  I don't know what it is, but it's a component of it, but to
• 1:00:33
  say that you are the zero trust solution.
• 1:00:35
  Doesn't make any sense in that context.
• 1:00:38
  Listen, there's a lot of money that gets raised as a lot of
• 1:00:40
  sales that get me. She made, there's a lot of, you
• 1:00:44
  know, sales that get could get closer doors that get open, when
• 1:00:47
  you have the right Buzz words, it's just the reality of the
• 1:00:50
  world. I'm not going to get better
• 1:00:51
  about that. It's true.
• 1:00:52
  Like like we do with perception. We deal with.
• 1:00:55
  We're dealing with humanity and people, as you said they want
• 1:00:58
  stories and thus, it sounds a lot better to spend money on
• 1:01:02
  something. When somebody's telling you,
• 1:01:03
  it's a product not a feature and then you're willing to spend
• 1:01:06
  that kind of money on it. He's already a real things and,
• 1:01:09
  you know, it unlocks things as well, right?
• 1:01:11
  I thought, I think there's a lot of things that would never have
• 1:01:13
  advanced. If they had stayed in the
• 1:01:15
  feature space, they needed to come out of that, right?
• 1:01:18
  So we can agree to disagree on specific examples.
• 1:01:22
  But in general, I try not to be a stickler for terminology or
• 1:01:26
  things like that, except when it causes breakdown in
• 1:01:28
  communication, which happens fairly often in our space as
• 1:01:31
  well. But I tried not to be a stickler
• 1:01:33
  for communication for terminology because I try to
• 1:01:35
  say, okay, what is it? You really want.
• 1:01:37
  Tell me exactly. See what you're looking for.
• 1:01:39
  Tell me your use case, explain to me what you're trying to
• 1:01:41
  figure out, and let's figure out what you need for that.
• 1:01:44
  Yeah, I need help with, I am. Okay, what?
• 1:01:47
  Part of my act? All right, let's say we've gone
• 1:01:50
  a little bit long, but I want to end with something on a lighter
• 1:01:53
  note. Something stupid, your Ledger
• 1:01:54
  than that better than that, for sure.
• 1:01:58
  All right, here's what I've come up with for this week and
• 1:02:01
  Nishant, I'll start with you and they'll go to gym Nashawn.
• 1:02:04
  If you could replace all the grass in the With something
• 1:02:08
  else. What would you replace it with?
• 1:02:12
  No more grass. You can replace it with any
• 1:02:15
  other type of surface that you would like hypoallergenic grass.
• 1:02:18
  That doesn't require water tank. So I want like AstroTurf
• 1:02:23
  basically something like no but it should ask Jeff is not grass
• 1:02:26
  that come on but you know if you don't have hypoallergenic dogs,
• 1:02:31
  right? So it's like why can't you bring
• 1:02:33
  create a great grass? That's hypoallergenic.
• 1:02:35
  I don't know. It feels like it's something
• 1:02:36
  that should be able to be done and never has any hot.
• 1:02:39
  Never gets weeds. Just all looking.
• 1:02:42
  Now, you're making it a certified.
• 1:02:43
  Oh no, no, it needs. It should, it should grow.
• 1:02:46
  It should be allowed to go wild, you know.
• 1:02:49
  So it's funny, right? Astroturfing you don't we talk
• 1:02:52
  about because some talked about football and I keep thinking
• 1:02:55
  about this like natural is good because I don't want to lose the
• 1:03:01
  natural. I don't, you know, this is a
• 1:03:03
  describe your topic for a whole other discussion about metaverse
• 1:03:06
  and stuff like that. But I don't want to lose the
• 1:03:08
  connection and with reality and the real world and Right.
• 1:03:11
  So you know it's it's I hate I don't I don't like when grass
• 1:03:19
  causes me to, you know, have allergy reactions to it and
• 1:03:23
  everything but I'd like the fact that there is natural grass all
• 1:03:26
  over the place. That is something that has
• 1:03:28
  existed for a long time. It was probably a better Jim.
• 1:03:33
  What would you replace grass with?
• 1:03:35
  So have you ever heard of kudzu? It sounds familiar.
• 1:03:40
  Refresh my memory. So you're in North Carolina now
• 1:03:43
  so the idea with Kudzu was that it was this plant that could be
• 1:03:48
  grown and takes very little resources and it just goes crazy
• 1:03:52
  and it could be harvested and turned into fuel.
• 1:03:57
  So anyway the problem was it became an invasive species and
• 1:04:01
  went absolutely Bonkers and like it's not a good idea.
• 1:04:05
  So, I think that the whole question You know, we could come
• 1:04:09
  up with an answer and say, you know, I'd rather have this plan
• 1:04:13
  that might cause other Downstream problems.
• 1:04:16
  So, I'm just putting that out there.
• 1:04:18
  I definitely wouldn't use Kudzu as a replacement for grass.
• 1:04:23
  What I was going to say is candy, you know, this is, this
• 1:04:28
  is like we, we really can't do. This isn't like a question based
• 1:04:33
  in reality. Why should my answer be based in
• 1:04:35
  reality? God, I took like so, what candy
• 1:04:40
  You know, I meant like the mood for something like very sugary
• 1:04:44
  and so I'm thinking smart, he's just like Laura Smarties, that
• 1:04:47
  would grow and you can just pick them off and eat them whenever
• 1:04:50
  you want. Okay?
• 1:04:52
  So that's so then, at some point in Jim's World, someone will
• 1:04:55
  have to go out and buy. I got to go get some nor
• 1:04:57
  Smarties boots, it's very deep with smart, he's outside.
• 1:05:00
  Gotta get the smarties shovel right, stuff like that.
• 1:05:04
  It's just like you. Fling on somebody, they open
• 1:05:06
  their mouth and just try and catch.
• 1:05:08
  Catch them in their mouth. Yeah, exactly.
• 1:05:11
  Why not a side of insulin for everybody as well?
• 1:05:14
  The go on with that. Yeah, we're live again.
• 1:05:16
  In this in this fantasy world where we're basically.
• 1:05:20
  It's Candy Land living in Candy Land and no one needs known as
• 1:05:24
  diabetic and Kendall and I like it, that sounds like, that
• 1:05:28
  sounds like a very happy world. I'm going to go high fantasy and
• 1:05:33
  just not even thinking of very, very I didn't think a very very
• 1:05:37
  through, or thoroughly Solar panels being able to capture
• 1:05:41
  that much energy and have it be able to turn back into something
• 1:05:45
  back into the grid. I think would be super cool, I
• 1:05:47
  think would be very hot, a lot of services, and we would be
• 1:05:51
  walking on glass quite a bit or maybe, you know, thin layers of
• 1:05:56
  plastic or whatever. Maybe but yeah.
• 1:05:59
  And and my world, we don't pay for energy.
• 1:06:01
  It just it just happens. Yeah, you know in like it in
• 1:06:06
  colleges, usually they have signs like Stay off the grass,
• 1:06:09
  right? Like, stay on the sidewalk.
• 1:06:12
  If you put solar panels there, you wouldn't have to put the
• 1:06:15
  signs up anymore. You save so much money in signs.
• 1:06:19
  Well, they'd be blocking, uh, you know, the energy production
• 1:06:22
  be like, stay off the solar panel.
• 1:06:24
  Yeah. Well, in my college dorm we had
• 1:06:27
  a sign that said, keep off the grass because we thought it was
• 1:06:30
  funny that, you know, grass is also like the 70s era term for
• 1:06:36
  something else. Yeah, I yes, we know what you're
• 1:06:40
  referring to. We'll call him.
• 1:06:43
  Jim, get off my lawn McDonald. At this point.
• 1:06:45
  There you go. All right, let's go ahead.
• 1:06:48
  We've successfully gotten super, super dumb with it here in the
• 1:06:52
  last couple minutes, but this shot really appreciate your time
• 1:06:56
  and joining us for this week so far.
• 1:06:58
  It seems like the Courtyard Marriott Wi-Fi gods have held
• 1:07:02
  with us. So hopefully this turns out to
• 1:07:03
  be a good recording. I'm sure it was conversation was
• 1:07:05
  excellent. Anything.
• 1:07:06
  You want to wrap up with Michelle before we Let you go.
• 1:07:09
  And no, I think it was an interesting conversation, that
• 1:07:14
  kind of reflects the vastness broadness and nebulous nests of
• 1:07:18
  what we do. So I think I will sort of end
• 1:07:22
  with saying hey everybody go sign up for Ida Pro.
• 1:07:26
  Good one, I like that one. But come on, I deep remember,
• 1:07:29
  bring these conversations into the slack Channel.
• 1:07:31
  We need more of these. The slack channel was definitely
• 1:07:33
  worth the money. All three of us are ID Pro
• 1:07:35
  members, the slack Channel, I am, I'm more of a worker there.
• 1:07:39
  But I can go there and post something with a couple times I
• 1:07:42
  have. And I get like an answer back in
• 1:07:43
  like, 30 minutes. It's crazy.
• 1:07:45
  So totally worth it just for that.
• 1:07:47
  Yeah, Jim. How about yourself final
• 1:07:48
  thoughts for this week? I can't top with new Chandra
• 1:07:51
  said, but you know, definitely open to networking.
• 1:07:56
  Please connect with me on LinkedIn connect to all of us on
• 1:08:00
  LinkedIn. And yeah, I hope to have a
• 1:08:05
  chance to, you know, connect with so many people as possible.
• 1:08:08
  It really helped when we were at the Gartner conference because
• 1:08:12
  with the show and kind of all the new connections that we've
• 1:08:16
  made. I got to kind of meet so many
• 1:08:19
  folks in person, it was really great.
• 1:08:22
  I really feel like we're kind of building Community with the
• 1:08:24
  podcast. Yeah, it is very cool, very
• 1:08:28
  happy with being able to even do like that show that we did with,
• 1:08:32
  you know, listeners that we hadn't met before.
• 1:08:35
  I was like, hey, let's you know, let's sit down and just talk
• 1:08:37
  identity and we turn it into I think I can our episode and we
• 1:08:40
  had a good old time doing it. So yeah that's that's the kind
• 1:08:43
  of stuff that we're into and definitely will have links to
• 1:08:45
  all of our linkedin's the shots, Jim's myself and show notes have
• 1:08:49
  a link to Yuna Kim's. You can check out what in shots
• 1:08:51
  been working on as well as don't forget to support gym with his
• 1:08:55
  webinar later this week and hopefully we'll see people that
• 1:08:59
  sonicate maybe at Octane and we're on the web.
• 1:09:03
  Idac podcast.com we're at Twitter idac podcast and we're
• 1:09:07
  enough with all that. That promotion.
• 1:09:09
  Will it ever let everyone go and call it for this week?
• 1:09:12
  Thanks everyone for listening and we'll talk with you all in
• 1:09:14
  the next one. Thanks for listening to the
• 1:09:18
  identity at the center podcast. If you like what you heard,
• 1:09:21
  don't forget to subscribe and visit us on the web and identity
• 1:09:24
  at the center.com.