Latest / Identity at the Center / #383 - Navigating Identity and AI with IDPro at Authenticate 2025

Transcript

#383 - Navigating Identity and AI with IDPro at Authenticate 2025 · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:14
Oh. Not so bad yourself, I'm.
0:15
Doing great. We're here at Authenticate 2025.
0:18
You know, the vendor halls, like it's a smaller vendor hall, but
0:22
it gives you more time and more ability to focus.
0:25
And one of the coolest things I saw was the Fido booth, right?
0:31
And they have on the Fido booth these fingerprints on like
0:36
pieces of gum and stuff like that.
0:38
And they also have like this face mask.
0:41
Wait, wait, wait, wait. Fingerprints on gum?
0:43
That does not sound. So it doesn't.
0:46
Sound healthy? And it's not modern, right?
0:49
But the idea is like 3 years ago.
0:51
These are the the hacks you were looking to prevent.
0:54
Right. And they're.
0:55
Like put a mask on and pretend you're somebody else.
0:58
Or you could do some kind of wamboozle with fingerprints and
1:03
gum, yeah. Walk up here.
1:04
Can you put your thumb in here please?
1:06
Yeah. And with AI the deep face are
1:09
whole new world. So really I think that's kind of
1:12
at the heart of where this conference is right now.
1:15
It's like those masks kind of like brought you back three
1:19
years, like that's where we were.
1:20
Where we are today is AI just does that.
1:23
And if you're not on technology that can prevent that, well,
1:29
you're not in a good place. I don't think we can prevent it.
1:31
I think the best you can do is to hope to mitigate it to some
1:34
degree. But there will be.
1:36
Yeah, it's it's getting easier to do AI stuff.
1:38
I thought for sure you're going to bring up Phyto Feud, the
1:40
rematch. This is the first time we're
1:42
actually, like, talking about it.
1:44
That was a real highlight. A tie.
1:47
Well, do we want to give it away or we're going to release?
1:49
The episode, it'll be an it'll be an episode, Yeah.
1:51
It'll get out there at some point.
1:53
And it is a tie. Yeah, it ended as a tie, which I
1:55
thought was there was some. Questionable judging, I'm not
1:57
sure who is behind the scenes like pushing all the buttons but
2:02
whatever. Yeah.
2:03
So how do you feel about like the match because you were down
2:07
and then you got up and then it came down to the last question
2:10
and literally ended up with a tie for points I.
2:13
Was happy with the way it went. I thought one of the cool
2:18
moments was that someone had answered something and the
2:23
judges like gave that person credit and the audience booed.
2:28
And that told me like, oh, people really care.
2:31
People are actually booing what's going on?
2:34
Like you have to care. It's not just polite clapping.
2:37
Yeah, I know There were boos, there were cheers.
2:39
It was those interesting. I think it sets up, you know,
2:42
Fido feud, the rematch of the rematch 2026, Yeah.
2:46
So, you know, a year from now, maybe we'll have settled it.
2:49
From now, though, Megan gets to keep the you know, the necklace
2:52
with the. The tiniest trophy ever.
2:53
Yeah, I could have fought over it.
2:55
But, you know, I mean, I probably would have lost it and
2:57
then felt like a real jerk. So you know, it's better staying
3:01
with her. Yeah, no, it was a good time.
3:03
Happy we were able to come back and do it and hopefully get
3:05
invited to do it again next year.
3:06
But I just figured, like, this is the first time we've had a
3:09
chance to like, sit and talk about it.
3:10
Great moment, great conference, having a great time, Yeah.
3:14
So let's see, we're at Authenticate 2025 and we have
3:19
guests today. Let me get my notes here.
3:21
Tina Srivastava, she's a PHDID Pro board member and the Co
3:26
founder of Badge Inc Hope I got all that correct.
3:28
Welcome back, Tina. Hey, great to be back.
3:31
So I always enjoy our conversations.
3:33
We actually met, I actually met Tina for the first time here two
3:36
years ago, three years ago. It was like the food truck year,
3:38
I think, or one of the food truck years not doing anything
3:40
this year. And so we were sitting down at a
3:42
table and she's kind of tell me what you worked on and now
3:45
you're part of ID pro. But let's talk about
3:47
authenticate 2025 S you hear at the conference, like what do you
3:50
think about the conference? How's it going for you?
3:53
Any highlights that you want to bring up?
3:56
Yeah, it's a it's great to be back and we're back here in
3:59
Carlsbad. I started coming to authenticate
4:02
back when it was in Seattle, but now I think we've really filled
4:06
into this location. People have a a regular routine
4:10
and flow. And yeah, I think there's a lot
4:12
of great sessions really checking in on what is the
4:16
regulatory environment like, how are things getting accepted, how
4:19
are we getting adoption, What are the challenges that we're
4:22
facing on the privacy front. So all the real topics.
4:27
And of course, just what you were talking about, how are
4:30
these attacks evolving? How is AI supercharging these
4:34
attacks? And it's even more critical in
4:37
this world of Gen. AI to ensure authenticity.
4:41
And I feel like it's a practitioners conference.
4:43
It's not like just all technology vendors kind of
4:47
looking at each other's technology.
4:49
Like there are actual practitioners here looking for
4:52
solutions to real world problems.
4:55
Oh yeah, absolutely. In fact, on my session later
4:59
today, we're going to have Bill, right.
5:01
So bringing such a depth of experience from USAA Bank and
5:06
talking about having to overcome the challenges of implementing
5:12
consumer facing authentication authorization for members that
5:19
in that case of course there are a lot of service members.
5:22
So how to deal with the challenges of not necessarily
5:25
being connected, moving across different devices, being a
5:29
submariner and being completely out of content for for nine
5:33
months, right. How is that, how's your fraud
5:35
risk profile going to really characterize that?
5:38
And then of course, the work side where the workforce and
5:40
we're seeing more and more challenges with again with the
5:44
just supercharging of AI attacks on these individuals and trying
5:49
to get gain access, elevate privilege.
5:51
And so absolutely, seeing the practitioners out there dealing
5:54
with the onslaught of threats. So is that spoiling it?
5:58
Because by the time people listen to this episode, it'll be
6:00
3-4 weeks in the future probably.
6:03
Is that the talk you're giving? Is there more you want to share?
6:05
Like for people who maybe for people who aren't able to be
6:08
here and authenticate, right? Either it's on site or on a
6:11
stream like. What is the gist of the
6:13
conversation that you're having there?
6:16
Well, the reason that we came up with, we as an industry came up
6:20
with synced pass keys was because.
6:23
We were sort of between a rock and a hard place with how do we
6:27
overcome account recovery? How do we overcome people
6:31
switching between devices? And the idea that your your
6:35
private key was bound to your phone was simply too restrictive
6:39
to meet what most users needed. And so synced passkeys were
6:44
supposed to be the way forward. But the security questions that
6:49
it opened up data provenance where, you know, key provenance
6:53
and if I could just AirDrop my key to you, then we where you
6:58
know, how can we really rely on this passkey for security?
7:02
And NIST brought up a lot of questions around if we don't
7:05
have user verification at the time that we're using the
7:08
passkey, then how do we know, you know, is it Jim or Jeff
7:12
that's using this pass key? And So what we are unfolding on
7:17
stage with Bill as well as Pedro Martinez from Tallis, also a
7:21
depth of experience in the financial regulatory banking
7:25
area is how are regulators seeing this?
7:28
And in fact, what we're seeing is that the payment providers
7:32
are just going backwards and they're saying, OK, if we're
7:34
using a pass key, we're going to have device binding, which is
7:39
sort. Of like the opposite of why did
7:41
they even go to passkeys in the first place?
7:44
And so it really brings to focus how important resolving account
7:49
recovery, moving across devices, how that all is, because if you
7:53
have your passkey on your phone and then you don't have that
7:57
phone, now all of a sudden you're falling back to insecure
8:01
methods. So if we can really close that
8:03
gap and make it possible to recover your account on a new
8:07
device, get a passkey when you cross, you know, Google,
8:10
Microsoft, Apple, that's really going to be critical.
8:14
And so that's the path forward that that we discuss.
8:17
So, right, you mentioned regulators and you know, my
8:22
mind, regulators are notoriously slow at keeping up and catching
8:26
up to where things are at. How do we talk to regulators?
8:29
And I know you've got experience talking in front of Congress,
8:31
and I just wanted to say that, right?
8:32
But how do we talk to regulators to say, look, this is where we
8:35
need to be and This is why it's secure and sort of, you know,
8:38
make them comfortable with it? How do we make that case to
8:41
those types of folks? Yeah, that's a great question.
8:43
And yeah, thank you for bringing it up.
8:45
It was great speaking to the bipartisan Congressional AI
8:49
Caucus. And what we've seen is that
8:52
policymakers are receptive to understanding what are the
8:56
threats and the challenges coming about today.
8:59
And unfortunately, we don't really have a choice but to, you
9:03
know, we don't have the choice to stick with legacy methods
9:06
because they're not sufficient to protect us from the next
9:09
generation of threats. I mean, let's just take phishing
9:13
as an example. Phishing has evolved from
9:15
something that you could train people to be able to detect,
9:21
right? You know, misspellings in
9:23
emails, awkward phrasing, not really expecting that e-mail.
9:28
And so you could train people not to click on certain types of
9:32
links. And even if you did have a very
9:35
effective phishing campaign, it took a lot for those attackers
9:38
to tailor it, to really customize it into something that
9:42
might be successful. Well, what about AI, right?
9:45
So now you can add a mass scale, tailor, customize, improve your
9:51
phishing emails and make it that much easier for people to click
9:55
on these links. We've made QR code, something
9:59
that even AQR code. I mean, look on this water can
10:02
behind you, Jim. There's AQR code, right?
10:05
People scan them anywhere, everywhere and.
10:08
And it's the same thing as clicking on links and so we've
10:11
really seen. Mean that phishing in the world
10:14
of AI has just become supercharged and so getting
10:18
towards phishing resistant authentication is absolutely
10:22
critical. Well, it's, it's, it's, it's
10:24
inherently convenient to have AQR code, right?
10:27
And then, but it's also makes it really convenient to drive by
10:30
malware. You don't know what you're
10:31
scanning. I remember, you know, originally
10:33
when we were seven, several years ago when we were doing the
10:36
podcast, you know, we did like a TinyURL and we got a lot of
10:39
blowback from the information security group is like, don't
10:43
use tiny URLs, don't use URL shorteners because people want
10:46
to know what they're clicking, which, sure, OK, Yeah, totally
10:49
makes sense. Yeah, yeah, yeah.
10:51
But we're doing the same thing with QR codes.
10:52
You don't know what you're scanning, right?
10:54
And they're all over the place. And how do you trust something
10:56
like that? I always point back to the
10:58
Nigerian Prince who used to be, you know, very, very poorly
11:02
educated from like an English trans, you know, perspective to
11:05
send those emails to people. But now there's no
11:08
differentiation. It's super easy to create
11:10
something that is targeted in the right language, the right
11:13
tone, phonetics, audio, visual, all that stuff is out there and,
11:18
and understanding the Providence of where does that piece of
11:22
information come from? Can we trust it?
11:24
Like obviously I know you're here, right?
11:27
But if someone's watching this, like could easily, you know, be
11:29
a digital fake of you, right? I don't know how we get past
11:32
that other than education. And do we need regulators to
11:36
talk through like, OK, is it like a watermark on digital?
11:42
How are you going to explain that to, you know, Jim, your
11:44
dad, we always put, you know, point to is like someone who's
11:46
not up on the technology side. Well, you got to look for the
11:48
watermark. Now you got things like Sore 2,
11:50
which is going absolutely nuts stuff.
11:53
So it's a very interesting time that we're living in right now.
11:55
Yeah, And I think the watermark analogy is very apartment,
11:58
because really, that's what a digital signature is, right?
12:02
It's a watermark. And if every person had their
12:05
own cryptographic key, then you could assert that at least this
12:10
content, this message, this post is really coming from me.
12:13
And no one else could pretend to be me or impersonate me.
12:17
And that's really what's necessary in this world of Gen.
12:20
AI. How can we have authenticity?
12:22
How can we really know that you are you in this world where it's
12:26
increasingly a big question mark?
12:28
And I think the other thing with QR codes, I I would be remiss
12:32
not to point out because in fact the Fido community is what
12:36
brought badge to some of the understanding around
12:39
accessibility issues. So we care a lot about making
12:42
sure that the product, the technology is accessible to
12:45
everyone. And Fido has a real emphasis on
12:48
that. And working with that team
12:50
helped us understand that, you know, QR codes are actually very
12:54
difficult for people that have visual impairment.
12:57
I mean, it's just, it's just impossible even for us to line
13:00
up the the QR code, let alone if there's any challenge in doing
13:04
that. And so being able to offer
13:07
alternatives, not rely on these sort of clunky methods.
13:10
And I think overall there needs to be this, this call we were
13:14
just talking about this, this call to the community because.
13:17
We're in our 6th. Year of the Fido conference and
13:21
yet we just saw this breach of 16 billion passwords, right.
13:27
Why are we still living in this world where there's so much
13:31
reliance on passwords when there has been obviously so much
13:36
progress towards phishing resistant authentication that
13:40
moves away from passwords. And it's really what is what is
13:44
missing there? And is it this usability, this
13:46
accessibility? How do we make it easy?
13:49
You know, for for our grandparents.
13:51
To be able to comfortably and easily authenticate in a secure
13:55
way. So I don't think it's a
13:57
technology problem. Why does it take so long Budgets
14:02
Like that's the number one reason I see with, you know,
14:04
clients that I talk to in our day job and stuff like that, is
14:07
it takes time to get that out here as as much as the work that
14:11
fight alliance has done, which has been incredible, right, to
14:14
get large companies like Microsoft, Google, Apple just on
14:18
the same page, right. Talking is heroic in and of
14:20
itself. But this is still a what I see
14:23
is like a bleeding edge conference, right?
14:25
We're talking about the authentication that's going to
14:27
be in place in three to five years.
14:31
Two to three years ago it was, hey, we finally have a standard
14:34
around pass keys. Awesome.
14:36
And guess what, two to three years later, you know, now I
14:38
think Andrew Shakira mentioned like billions of passkeys are
14:40
out there. And so for me, I just look at it
14:43
as this is a normal adoption cycle for any, any number of
14:47
corporations out there. They can't just say, OK, passkey
14:50
sound great, sign me up and implement it tomorrow.
14:52
They've got to go through their governance processes, their
14:55
budgeting processes and cycles. And if you don't catch it at the
14:58
right spot, that means you got to wait another year to get part
15:01
of that right. Unless somehow, man, money
15:02
magically frees up. I'm sure economy plays a part of
15:04
that. But I, I don't think, I don't
15:07
think we're behind. I think we're right where we
15:09
should be given sort of that budget process that every
15:14
organization has to go through. Yeah.
15:16
And I agree about sort of the bleeding edge and it's, it's not
15:20
just here, it's at Identiverse, right.
15:22
We feel in these communities, at IIW in the room, the concepts
15:29
are so clear, OK, verifiable credentials.
15:33
Everybody's going to have a wallet.
15:35
Everybody's going to have this zero knowledge.
15:37
Way of proving who they are to all of these relying parties.
15:42
And you just have to Step 1 foot outside that community for
15:46
people to have no idea what you're talking about.
15:48
What is an issuer? What is a relying party?
15:51
What is a ZKPI mean? And the idea that we're going to
15:55
have the whole world adopt this when we have such foreign
15:59
terminology, I think, you know, it's it's.
16:02
A little bit eye opening when you're in the in the world, when
16:05
you're right among among the people that speak that language
16:08
and then when you step out to see how how different we are and
16:12
I think. That again, it comes back to, we
16:15
can talk in our language in the identity community, but once we
16:19
build something that an everyday person needs to use, it needs to
16:24
be something that doesn't require anybody to know
16:26
cryptography. It needs to be something where
16:28
people don't even know what a key is.
16:31
It needs to be that you don't have things like catastrophic
16:36
failure if you lose a device. I mean, we even see pretty
16:41
regularly this concept of an emergency kit, right?
16:44
You have to keep a 12 word phrase somewhere that you can't
16:49
ever lose. And these things are actually
16:52
pretty foreign to an average consumer that they would drive
16:57
to the bank to. Put a paper in a safe deposit
16:59
box just so that they can access their accounts.
17:03
And so really bringing the bar down to normal experiences is
17:07
critical. Absolutely go.
17:08
To the bank, that's crazy. But I also heard your points
17:12
that you're making about budgets, but the bad guys aren't
17:16
going to wait until you get the budget.
17:18
And that's just, I think one of the positives is you're at this
17:22
conference, you're seeing a lot of the big tech representation,
17:28
you're seeing a lot of big tech representation.
17:30
You're seeing a lot of folks from mostly from large
17:32
organizations, tech first organizations that are looking
17:37
at either adopting pass keys or have adopted it, but not only
17:41
adopting pass keys, but it's this intersection between
17:46
identity verification and authentication that that's the
17:51
real ticket, right? I'm, I'm sold on it.
17:54
I mean, that is where it becomes pretty hard to hack.
17:58
Having said that, you keep and maybe this just comes down to
18:04
the password is stupid, but you keep seeing these major breaches
18:08
happen because of social engineering and phishing.
18:12
You're just like, how are we still falling prey to the same
18:18
level of attack and we were falling prey to 2025 years ago?
18:22
Well, I don't. I don't think it's a scenario
18:24
where because it's the right thing to do isn't good enough.
18:28
There has to be something to drive behavior, regulation, a
18:32
breach, something like that I hate.
18:34
Catastrophic event, exactly like like we asked Ian yesterday.
18:38
Do we need another? Do we need another Enron?
18:41
Yeah, to do something. Should it be like that?
18:44
No. But those are the things that
18:47
drive behavior. It's catastrophe.
18:51
Nobody just looks at it and says, well, yeah, that's great,
18:54
let's go ahead and do it. There's very few companies that
18:56
can afford to sit there and say, yeah, let's let's be on the
18:59
bleeding edge or even the leading edge of this.
19:01
It's like they're they're having to make choices.
19:03
Hey, I I am a personal testament to the fact that a breach can be
19:07
motivation, right? The whole reason I got into the
19:10
identity space in the 1st place was because working in national
19:14
security, my fingerprints were stored in the Office of
19:17
Personnel Management, the OPM database.
19:20
And when OPM got breached, I was one of the six million people
19:24
who had my fingerprints compromised.
19:26
And so that was actually the whole reason I'm even part of
19:30
the identity community, the reason we founded Badge.
19:33
I'm just very much a believer in what you said, Jim, that a
19:38
breach can be a motivating factor.
19:40
And in fact, we see that a lot. We see people joining the
19:44
identity community after a breach.
19:47
We've seen members of ID Pro join because they had
19:51
experienced A breach and now there was a double down in
19:54
effort around doing this. And these breaches will continue
19:58
to happen as long as people continue to use passwords,
20:01
stored credentials. These are just ripe.
20:03
Honeypots for breaches and I do actually think regulation has
20:07
moved forward quite a bit. I mean, even in the last six
20:11
years since we're reflecting on it, the, the biometric
20:14
information Privacy Act has gone from sort of being non existent
20:19
to having the first trial cases with BNSF railroad going to
20:24
trial talking about, OK, hey, these employees and workers were
20:30
storing their biometrics in a in a database and, and what are the
20:34
privacy implications of that? What were the, the rights of the
20:37
users and seeing these very large settlements come out of
20:42
that, that OK, this is actually something we really need to pay
20:45
attention to. We've personally seen that
20:48
really making a difference with people questioning that hey do.
20:52
We. Need to store biometrics?
20:54
Is that in compliance with the Biometric Information Privacy
20:58
Act? Texas now has a very similar
21:01
legislation. Kubi CUBI Eye and it follows
21:05
some very similar aspects of Bippa from Illinois.
21:08
And you can see for for instance, Facebook at the time
21:12
now Meta getting a massive lawsuit from Bippa and now we
21:17
see the Kuby legislation coming after the same thing.
21:21
And so this legislation and regulation it is it is causing
21:25
change. It is causing people to question
21:28
are they following appropriate privacy practices?
21:31
And in that sense, I actually think that's a good thing.
21:33
It's. It's important, it's important
21:35
that we think about that. It's important that global
21:38
companies think about, hey, if I build this solution, will it
21:42
only work in the US or can I also do it in Europe?
21:45
And I think it's actually something that helps everyone to
21:49
have. Those privacy legislations and
21:52
regulations, yeah. Regulate, regulation, audit,
21:55
those things are going to drive it forward, but it might be at
21:59
like a glacier space. I feel like the identity
22:03
practitioners, we need to go back into our organizations.
22:06
We need to beat the drum. Our organization, the way I look
22:12
at it is ID Pro. You're a board member of ID Pro
22:16
Am I speaking the right language?
22:18
Is that where we should be? And where is ID Pro at right
22:23
now? Yeah, One of the best resources
22:26
of ID Pro is this ability to bring practitioners together.
22:30
And in the Slack community, we actually have some real legends
22:36
in the identity space that are there that have been practicing
22:39
in this community at the forefront that have been some of
22:42
the founders of these conferences and events and
22:45
standards that we're using today.
22:48
And then we also have people that have been out in the field
22:51
implementing this and what's nice about the.
22:54
Community is the culture is very supportive.
22:56
People can ask, you know, so-called dumb questions.
22:59
Hey, I tried to implement this, you know, OIDC the, the tokens
23:03
not working. Oh, hey, did you check the login
23:05
hint? And people really coming
23:07
together to help each other out. And there isn't really a
23:11
financial motivation. There's just helping people out.
23:14
We're all in this together. We all become safer if we work
23:17
on this together and helping people understand, hey, there's
23:21
this, this new technology, there's this new approach.
23:24
Have you heard of it? Oh, yeah, we're, we're
23:25
implementing that now and having people be able to discuss that.
23:29
Hey, we ran into this question or how did you share with your
23:33
stakeholders the importance of this or even hiring that?
23:37
Hey, we, we are looking for someone in this space with this
23:40
particular skill set. And so it's been.
23:44
Really a focal point for identity practitioners to say,
23:47
hey, there's a community for you.
23:49
There's a place where you can join and talk to other people
23:53
that are facing the same challenge as you are.
23:56
So let me ask you some questions around ID Pro, because it's no
24:00
secret, right? We're big fans of it.
24:01
We're the official podcast, right for ID Pro.
24:03
Lots of people who are members of ID Pro had been on the show.
24:08
If you're not a member, go out, get your membership because the
24:10
Slack channel alone I feel like is worth it, whatever it is,
24:13
$150.00 a year, whatever it is. So I like to bring up the Slack
24:17
channel a lot as sort of like one of the key benefits and it
24:20
is that community where you experience everything
24:23
essentially, right? There is technical
24:25
conversations. I think there's a dogs or cats
24:27
of ID Pro channel as well, right?
24:29
So you can kind of, you know, be amongst your own people.
24:32
As a member of the board, how often are you looking at things
24:37
like the Slack channel? I'm saying, OK, yeah, this is
24:40
like one of our key things. Or are you hearing it?
24:42
Or are there other part? And there's other things that ID
24:44
Pro does as well, right? We've got the blog, we've got
24:47
body of knowledge, right, the certification, things like that.
24:50
But like, how much does like the board look at things like the
24:52
Slack committee and say, oh, this is what people are talking
24:54
about And how does that influence the direction of the
24:57
organization? So we don't moderate the Slack
25:02
channel in in a sense of kind of directing anything, but in terms
25:06
of encouraging, we do that a lot.
25:09
So coming up to conferences and events, it is a place where
25:14
people, for instance, for this event said, hey, I want to dry
25:18
run my talk. Can anyone do that?
25:19
Same with identifiers. Similarly for submitting
25:23
proposals. Hey, I'm, I'm working on a topic
25:25
around this. Can someone help me crystallize
25:27
it? And you'd be shocked with how
25:29
many people respond Yeah, hey, I can, I can dry run that with
25:33
you, you know, hey, let's meet up.
25:35
And so it's it's a focal point that really just helps support
25:38
people and advance them on their journey and getting into ID pro.
25:44
There's also an introductions channel where people when they
25:48
first joined say hey. I'm new or hey, I've, I've been
25:52
involved for a long time, but I just joined and it's great to
25:55
see the reception of, hey, if you're interested in this, you
25:58
should join that. There's a podcast channel where
26:01
of course, identity at the center.
26:03
We discuss episodes coming up on that.
26:05
And it's a place where podcast leaders can get feedback too,
26:09
that, hey, I'm thinking about a topic around this or here's a
26:12
survey. What are you interested in?
26:13
Or of course, for identity squabble and other things.
26:17
Hey, give us some feedback. 1 surveyed 100 people.
26:20
Where do you get the 100 people ID pro exactly exactly and so?
26:26
I think that where we see the the thought leadership, the
26:31
emerging trends actually just comes from the membership.
26:34
So many members of ID Pro are actually speaking at this event
26:39
here at Authenticate that speak at EIC, at Identiverse, attend
26:44
the identity and Internet and identity workshop, IOW.
26:48
And, and it just turns out that people that are passionate about
26:51
identity are in ID Pro and we lead, you know, webinars, talks,
26:56
we share what we're up to and people also use that community
27:00
to share resources. Hey, here are my slides from
27:02
this or here's a talk I just did on this.
27:05
And people are very open about sharing that content with each
27:09
other, enabling each other. So it's a, it's actually, I
27:12
think a core backbone of what makes the community great.
27:16
It's also allowed just a, a common communication point for
27:20
people to do other things. So when people want to host a,
27:23
an identity beer or a get together anywhere in the world,
27:26
whether you're talking about Australia or San Francisco or
27:29
London, they use that as a place to say, hey, come on out, let's
27:33
let's meet up. And so we found that ID Pro is a
27:36
great way to bring people together to meet other people,
27:39
whether locally or around the world, that are interested in
27:42
similar topics. Yeah, if you're not a member of
27:45
ID Pro, do it. Where do you see ID Pro as an
27:50
organization going in the next few years?
27:53
So I want to kind of give, you know, the membership a sense of
27:56
like what's where do where's this thing go?
27:58
Because we have to evolve right with the space.
28:02
Like where do you see this, this where we're going?
28:05
Let's put that here. Well, some of the core tenants
28:09
of ID Pro are going to remain the same, being very member
28:12
driven, having a kind of a grassroots, informal way where
28:17
people can network and talk about other topics with each
28:20
other, help each other out in a supportive way.
28:23
Some of the things we're evolving as an organization just
28:27
to become a more mature organization over time.
28:30
Well, one is, you know, we have our regular board elections.
28:35
We welcome some more board members to the board, which is
28:38
great. It's always great to get that
28:40
new energy on the board, you know, re discuss what are our
28:43
strategic priorities? What are we focused on?
28:46
We're very focused on delivering value both to our members.
28:51
So what? What do they see as valuable?
28:53
And we asked them that a lot. What is the most valuable thing
28:56
we see the Slack community come up as #1 but we also listen for
29:00
what else is helpful? What could we do differently?
29:03
And then also to. Our corporate members, so we
29:05
have corporate members as well, which is a big boost to ID Pro
29:10
and finding out, you know, what's most valuable to them,
29:12
what topics do they want to see, what do they want to be involved
29:15
in and engaged in. And one of the things that we're
29:19
that I would like to announce on this show that we're doing at ID
29:23
Pro is we are announcing the creation of committees.
29:26
And this is a new thing. So used to be that you had to
29:29
be, you know, an elected board member to serve on the board to
29:33
sort of make any decisions about ID Pro.
29:36
We want to include more of the membership into the operations
29:41
of ID Pro. So the board has created some
29:44
committees that members who want to volunteer just like the board
29:49
members to participate and get engaged can get involved.
29:53
So we have, we're going to have a committee that's focused on
29:55
the internal operations of ID Pro and governance, as well as
30:00
on the external side and how ID Pro engages outside of ID Pro
30:04
with other organizations with conferences, social media and
30:08
things like that. So I would like to specifically
30:10
make a call. If you're, if you're watching
30:13
this and you want to get engaged, there's an opportunity
30:15
for you to do that. So please raise your hand.
30:18
This is a great way to get involved.
30:20
What's the timing for that? When?
30:22
What are these committees going to start hitting the hitting the
30:26
road? Yeah.
30:27
Well, we're actually creating the kind of draft charter and
30:31
purpose right now, which we hope to be formalized by the
30:34
committees themselves. So you'll be seeing those coming
30:37
out just in a few months. So I'm real interested in the
30:41
topics that we've been discussing.
30:43
What's really hot here at the conference with identity
30:46
verification and obviously pass keys and authentication, most
30:52
tie in with Identity Pro. Like it feels like that's the
30:56
community that's got to take this thing forward.
31:00
Is that the context that the way we should look at it?
31:03
Oh, yeah, absolutely. And I think that, you know, we
31:05
were discussing sort of the evolution of how different parts
31:10
of the identity life cycle are really critical and need to be
31:13
brought in together. You were just talking, Jim,
31:17
about sort of the identity verification and the
31:20
authentication side. And we've seen that a lot how
31:23
doing sort of that selfie driver's license document
31:28
authentication to initially check, hey, are you the person
31:31
that should create the account and how that's merging into, OK,
31:35
now have your ongoing authentication credential.
31:38
I think what we were just discussing is that also when you
31:42
fall off of that journey that you've lost your credential,
31:46
you've lost your password or device.
31:49
And now you're starting over and ways that you can actually
31:53
extend your identity to remain on that identity life cycle to
31:57
persist through things like account recovery.
31:59
Because frequently even if we have fishing resistant
32:04
authentication, we fall back to very fishable identity recovery,
32:09
account recovery methods that tend to go back to KBA knowledge
32:13
base authentication. You're back to a very fishable
32:16
thing, which is, you know, we talked about The MGM casino hack
32:20
in Las Vegas, right? That was taking advantage of the
32:24
account recovery flow. So even if you have super robust
32:27
authentication, you can have MFA set up, you can have all this
32:31
great stuff, as long as you can call in as an attacker, pretend
32:35
to be the user and say, oh, I, I don't have my device anymore.
32:38
I forgot my password. Now you can, you know, get
32:42
credentials. And so the fact that that back
32:45
door is still open is a problem. And I think as an identity
32:49
community, we got to look at that whole identity life cycle
32:53
and make sure that we're not, you know, just giving up on
32:57
certain entry points for fraud. Because I think ultimately one
33:01
of the big things we're trying to thwart with this identity
33:05
world is, is the fraud side of things.
33:08
I. Want to bring up like a big
33:11
topic because I, I think everybody thinks about this in
33:15
some way. So I talked about like that face
33:18
mask and the thumbprints and gum.
33:20
It almost sounds comical, right? It's like, who would have ever
33:24
been concerned about that? I was like 2 years ago, you
33:28
know, we were talking about that like that was the deep fake of
33:31
the moment. Now deep fake is AI.
33:34
And it's like we think about how much geography we've covered in
33:41
just two years. What's it going to be like 2
33:43
years from now, three years from now?
33:46
I had a colleague the other day saying like, well, should people
33:51
move forward with like an IGA platform or should they just
33:54
wait two years up? You know, chat GPG is going to
33:57
do the whole thing. How do you look at that
33:59
technology? Because I'll be more than happy
34:01
to share my answer, which is that you fall too far behind.
34:05
Good luck catching out. You can't just not invest and
34:09
then say, hey, we're just going to wait until the next whiz bag
34:12
thing comes and then we're all in.
34:14
It's like it's going to be too late.
34:16
And that's not also the way it works, right?
34:18
You have to keep. So that's my opinion, but I'm
34:20
wondering what yours is. Yeah, absolutely.
34:23
And I think I think the point is that we're seeing AI really
34:27
transform the market from a lot of different dimensions.
34:31
And when we started off, we were really talking about the
34:34
onslaught of threats. And I think that's the reason
34:38
that you can't wait. You can't just sit around and
34:41
and wait for technology to evolve because you're even more
34:44
vulnerable today. And if you might have been a
34:46
little bit vulnerable to like a phishing attack before, with AI,
34:51
it's going to be every attack, it's going to be so easy to
34:54
tailor and target phishing attacks.
34:56
And so the, the age of AI really is here from an attacker and,
35:02
you know, adversary perspective. So the existing technologies
35:06
that are not phishing resistant are, are not able to, to keep
35:10
up. I think what you were seeing
35:12
what you're talking about with the, with the masks and things
35:15
that's in this category of presentation attacks.
35:19
Well, here is a place where actually AI helps with AI.
35:23
And so you can actually see that machine learning is very
35:27
effective detecting is this a mask, a photograph, a screen
35:33
versus a real human person sitting in front of me.
35:36
And so we see AI being used on that presentation attack defense
35:41
side as well. And then finally, of course, on
35:44
the injection attack defense, making sure that you can't be
35:48
injecting an AI stream of some Gen.
35:51
AI version of Jim as opposed to the real person sitting there.
35:56
And all of these things have to come together in a holistic
35:59
solution because for for good or for bad, the world has really
36:03
embraced biometrics. Biometrics are are here to stay.
36:07
We found that for users, they just find it intuitively easy.
36:11
And also on the security practitioner side, knowing that
36:15
you are you, that you are the person that performed that
36:20
action, that you can't deny that it was you, that somebody can't
36:23
be pretending that it's you. That is really critical piece as
36:26
well. So bringing all of these things
36:28
together is going to be critical.
36:30
And I agree with you completely that.
36:32
Just assuming that you're going to wait and see how things
36:35
evolve won't. Keep you protected.
36:37
Yeah, the term I keep hearing is AI arms race.
36:40
And I think that's kind of a real thing, bring you back to ID
36:46
Pro and like the speed at which this is going.
36:50
I think the answer you're going to say is that how does ID pro
36:54
keep up with this? Well, that's the members, right?
36:57
We provide the forum as the members have to bring this to
37:02
how, how do the members keep up with this?
37:04
This is moving so quickly. Yeah.
37:07
And it's exactly that. And it's also through sharing
37:11
with each other. Look, I came from the world of
37:14
cybersecurity. Cybersecurity was very
37:18
fragmented in the sense that, you know, large, large banks,
37:22
large institutions, they didn't share when there was a cyber
37:25
attack. And there was a huge effort by
37:28
CISA and by others to say we got to share because you're probably
37:33
actually facing the same attack that I'm facing.
37:35
But as long as we keep bit to ourselves, we don't know.
37:39
And facilitating that information sharing was was
37:42
really critical. I worked in that intersection of
37:46
of cybersecurity kind of right when that concept of information
37:51
sharing became to the forefront. And I really think that that's
37:54
what you need in order to stay ahead.
37:57
We have to be telling each other what we're seeing, what's going
38:00
on out there, one from the adversary and the tax service,
38:04
but also from the user perspective.
38:06
You know, what is what is usable, what is seamless, what
38:09
is frictionless for people versus what is too cumbersome,
38:13
what is too difficult or inaccessible to certain types of
38:16
users. You know how passionate I am
38:18
about making sure that different categories of users don't get
38:22
left behind? Well, part of the way that comes
38:24
to the forefront is through a community like ID Pro where we
38:28
can share and talk about women, talk about people that don't
38:32
have dedicated computers, talk about people that have to share
38:35
their workstations or for their devices.
38:38
You know, talk about all of the communities of users and what
38:42
their needs are and how we've made strides in addressing them.
38:46
So we can share that with others.
38:47
Because I do think we're also in a very fortunately, a positive
38:51
community that wants to provide identity for everyone, right?
38:56
Identity is how we access the economy, it's how we access
39:00
education, it's how we access our financial resources, our
39:03
healthcare. Identity is really critical in
39:06
making that in inclusive for everyone.
39:08
I, I have found to be something that the community has been
39:12
really embracing. And so, yes, absolutely, that
39:15
dialogue, that discussion, and that sharing is how we're all
39:18
going to stay ahead. You talked about those internal
39:21
committees. I think for an external
39:24
committee like AI agents, I am for AI and AI for I am like.
39:29
Those are topics that I think will be great external
39:33
committees. Absolutely, yeah, we're, we're
39:36
tackling that right now with agentic AI.
39:39
How do you make sure that your agent is able to check in with
39:43
you? How do you make sure that it's
39:45
authorized to do what you want it to do?
39:47
How do you know whether it's acting sort of rogue, whether it
39:51
hallucinated or whether whether in fact, you know, was, was that
39:55
really Jeff's intention when when this AI agent was was kind
40:01
of commissioned by him to go do something?
40:03
And so all of these. Questions come back to identity
40:06
authorization authentication, Absolutely.
40:10
Identity's at the center. How do you stay sharp on stuff
40:13
like this? So, you know, like, this is a
40:15
gym question I'll go out there with is there's so much to keep
40:19
up with? Like what are your sources of
40:22
knowledge that you go to? Are there specific websites or
40:24
people that you follow? Like for people listening to
40:27
this is like, OK, this is how Tina stays up to date on things.
40:31
Well, I would be remiss if I didn't point to ID Pro.
40:34
I think that in the ID Pro community, we bring up topics,
40:38
the latest things that are out there, the latest advancements,
40:42
the standards that are coming out and the latest breaches.
40:44
How is this impacting people? We also have people speaking at
40:48
conferences, which I think is a great place, as you mentioned,
40:51
that can be sort of the bleeding edge of what's coming forward.
40:55
And then of course, just talking to people in the community,
40:58
being working with folks, we are, you know, constantly
41:03
working with some of the largest and smallest companies in the
41:07
community and seeing what do they have on the horizon.
41:10
What's next? I'm believe I am a strong
41:13
believer in learning and education.
41:15
As you know, I am a lecturer at MIT and I continue to teach and
41:20
I continue to learn. So being, being aware that
41:23
there's always something to learn is absolutely critical.
41:27
You know, if you have not tried some of these AI tools that are
41:31
out there, played with them yourself, you have to do that.
41:33
You have to get your hands dirty.
41:35
Even if you're not a, you know, a programmer or a developer,
41:39
start using these tools, seeing the the advantages and seeing
41:43
the disadvantages, experiencing the risks yourself, seeing that,
41:46
oh, you know, if I enter this information is that now being
41:50
trained in a global way, you know, being careful of your
41:54
company proprietary information and where it's going, but still
41:57
embracing and experiencing these new tools.
42:00
Because I guarantee you the tools that we have today, even
42:03
in one year, are completely changing and will be a whole new
42:06
set. This is the worst it will ever
42:07
be, I should say the least capable it will ever be.
42:10
It just keeps getting, you know, stronger from a capability
42:13
standpoint. Could be more evil.
42:14
Right. Well, yeah, that's what I say.
42:16
I changed my word. Not worst.
42:18
It's the it's the least capable. It will be right now like it
42:21
just continues to get more capable over time.
42:24
And I we usually closeout our episodes on a lighter note, but
42:27
I want to ask you, how do you see AI affecting your karaoke
42:32
career? Because you're, you've been on
42:35
the highlight reel here at Authenticate.
42:37
I think last year for that at ideniverse earlier this year for
42:41
our Dennis Global game, you did an 8 mile.
42:43
I think it was eight mile right from Eminem, you know, on stage
42:46
with us as part of the end of it.
42:48
You're like, I didn't get to do it.
42:49
I'm like, OK, well, go ahead and do it.
42:50
No, you wanted that bad. So how do you say AI impacting
42:55
sort of that sphere of your life, you know, from like a
42:57
music standpoint? Oh, that's great.
43:00
I think, I think that my my band teacher would get a kick out of
43:04
that knowing that I had, in his eyes, a very poor musical
43:09
progress or, or potential. But yes, I had a blast at the
43:15
identity squabble. Thank you for running that.
43:17
You have a certain talent with these, with these fun shows and
43:20
bringing out the best in people. And yeah, it was great.
43:23
I am I am a fan of Eminem and so I had to work in an MFA rap.
43:28
That was pretty fun, I think getting getting people engaged
43:31
in the importance of authentication in a secure way,
43:34
but also, you know, bringing in the in the fun side.
43:37
So I actually did try to use ChatGPT to see if it could help
43:42
me with some of the the lyrics, but it didn't it didn't really
43:46
grasp what I was trying to communicate.
43:48
So I ended up going back to the pen and paper for that one.
43:51
So I think the the real question is, can it can it improve?
43:55
Can it help me get some better lyrics for next time?
43:59
I mean, that was like 3 or 4 months ago.
44:00
So it's, you know, since then we've had Chachi PT-5, Gemini
44:05
2.5, Claude just came off a new version and just keeps getting
44:08
crazier and crazier. Yeah.
44:09
And as soon as we get model context protocol, we won't be so
44:12
siloed. So have you played around with
44:15
any of the music AIS like Suno or I think other ones like Udio?
44:20
Anything. I have some MIT friends of mine
44:24
that are actually musicians that have been using the AI to help
44:28
inspire, help give them feedback and even use that when you sort
44:32
of play an an instrument in it coming back with giving you
44:36
personalized feedback. At this point it is wrong too
44:40
many times. So you have to have at least
44:43
some knowledge otherwise you won't know that it's giving you
44:46
kind of blatantly incorrect feedback.
44:49
So think there's a a little bit of of a journey, but as we just
44:52
discussed, hate that that evolution could happen quickly
44:55
and we might see the usefulness of these tools turning around
44:58
pretty fast. So what is it that drives you to
45:01
get up in front of, you know, the hundreds of people of here
45:05
at Authenticate or the thousands at Identoverse to do karaoke?
45:09
Because that sounds frightening to me.
45:11
And I say this knowing it sounds on the Internet, right?
45:13
Right. And billions on the Internet.
45:14
I say that as a podcaster who, you know, we've got a million
45:17
downloads at this point. There's no way you would catch
45:19
me singing in front of me. No, first of all, nobody wants
45:21
that. But I just, I don't have that
45:23
guts. So take me into your mindset.
45:26
It's just like, and you're you're, you're a very good
45:28
singer. So that probably helps as well.
45:30
But like, you look like you're having such a good time with it.
45:33
How do you let go like that? I didn't always do public
45:39
speaking, but one time when I was undergraduate at MIT and I'm
45:46
in aerospace engineering, I was asked to speak at an Amelia
45:49
Earhart event. And this was one of the first
45:52
times I was on stage. But it was for a bunch of middle
45:55
school girls and it was to inspire kids and aviation and
46:00
just talking to these kids afterwards, they, they, it, it
46:05
worked. They wanted to become pilots.
46:08
They wanted to become skydivers, aerospace engineers.
46:12
And seeing that something that I said could make a difference
46:17
really motivated me to kind of get over it and be excited
46:22
because being excited about what I was passionate about made an
46:25
impact on others. And that's how I got into
46:28
teaching. I'm in my 10th year of teaching
46:32
the MIT class 16687 on aerodynamics.
46:36
And yeah, as you mentioned, we now have three and a half
46:39
million views on YouTube of that course.
46:42
And I don't think I ever even imagined that I was just
46:46
speaking to to my class of students in the classroom and
46:49
not really thinking about the the reach that it would have.
46:53
And it's something that when I hear students come tell me, hey,
46:57
I've become a pilot, I flew a plane, I got my commercial
47:01
license. And then sharing that feedback
47:03
with me, it really makes me happy that it, that it made a
47:07
difference. So even this afternoon when I'm
47:10
going to be going on stage and, and talking about pass keys in
47:14
the financial industry, how to overcome account recovery, I'm
47:18
thinking about how maybe this could make an impact to others.
47:21
And I try to put the the whatever the nervousness is and
47:25
the stage lights that you see when you get up on stage, try
47:28
and put that to the back of my head and focus on why I'm
47:31
excited to share what I'm there to share.
47:34
When you're up on stage, you can't see anything, especially
47:37
the mainstage here, like the lights are very bright, you can
47:39
really only see the first row and that's it.
47:41
So I think that helps a little bit, but I still find it nerve
47:44
racking getting up there in front of anybody.
47:46
You make it look so easy. Lighter notes for you Sweating
47:50
is what is the first public speaking experience that you can
47:55
remember. I think this is the one that you
47:59
ditched me for. So this would have been I think
48:03
it was authenticate. Authenticated.
48:05
Seat It was in Seattle and. You ditched me there.
48:08
You made us out. So I was sick.
48:10
It was, like in the middle of COVID.
48:12
Yeah. Yeah.
48:13
Could you imagine getting on a plane just, like, packing up a
48:16
line? Yeah.
48:17
That would not be in public. Everyone was like is what's
48:19
going on there? But that I think, I think that
48:22
was probably the first one that I can recall at like that level,
48:26
like where there was, you know, more than maybe 10 people in the
48:29
room, that kind of thing. But yeah, I remember that I was
48:32
getting ready to fly from Chicago to Seattle and you
48:35
called me, said you're sick. And I didn't even want to go to
48:38
this lake. I was going just to support you.
48:41
You're like, hey, I'm going to go speak.
48:42
I'm like, all right, I'll go and I'll help you with like the
48:43
presentation, right. But I don't want to like get up
48:45
there and then you call me. Is that all right?
48:48
And I guess I'm getting on a plane and did the presentation
48:51
and that was it. I remember it being very out of
48:54
place for the other content because this would have been.
48:58
It was like how to run an IM program, yeah.
49:01
And it was like in the middle of an authenticate conference,
49:03
like, OK, like one of these things is not like the other.
49:05
And it was definitely the the oddball out.
49:07
But yeah, that was it. But that's that's my first one.
49:10
What about you? So my first one was I was an
49:12
undergrad and I was helping with the new art.
49:16
Let's see, like the perspective student orientation.
49:20
So people show for a Saturday. They get to walk around the
49:23
campus with people like me. And I was sitting up at the
49:26
front and the person who's doing the speaking was a guy named Doc
49:30
Rock. He was one of the, yeah, that
49:33
was his name because he ran the radio station.
49:36
I forgot what his real last name was.
49:38
But he started taking questions from the parents that were
49:43
there, parents and potential students.
49:46
And they're asking things like, what are the dorms like?
49:49
What is the the food in the in the cafeteria like?
49:52
And then he's like, girl asked me like, how is the food in the
49:56
cafeteria? And so I answered.
49:58
And then it was like, do you ever see that new commercial?
50:01
It's like the Capital One commercial.
50:03
There's the Capital One bank guy, and there's Derek Jeter,
50:06
and there's an astronaut. And people all want to ask
50:09
questions of the bank guy. Well, I was the bank guy.
50:13
So Doc Rock just gave me the microphone and walked away.
50:17
And then I was talking to like hundreds of people.
50:20
That's pretty cool. It was good because I don't have
50:22
time to be nervous. It's just it's happened.
50:24
Yeah, I just got thrown into it. Thrown into it.
50:27
That's kind of how I felt too, when when you ditched me, I'll
50:29
say it again was I didn't have time to think about it.
50:32
So I guess I'm getting. On a plane.
50:33
Get my COVID on, you know. Yeah, that's true.
50:35
But I think you did put a question into the chat.
50:37
It was like, what is IA or something like that, which is an
50:40
internal joke for like Jim and I've been working there for like
50:42
a decade now and whenever we have like an internal meeting,
50:44
it's like, you know, we're all identity people consulting,
50:47
etcetera. And I'll, I'll generally will
50:48
throw in a question like I keep hearing about this thing.
50:50
I am. What is that?
50:51
What does society? Just you're just being an idiot.
50:54
So sorry. I think that's a good spot to
50:56
end is me being an idiot. So we'll go ahead and leave it
50:59
there for this week. Thank you so much for being part
51:01
of this, Tina. Great to be here again.
51:03
Looking forward to that to hearing you maybe later tonight
51:06
at the at the at the party ID pro.org.
51:09
So people check that out. Hands down the best community I
51:13
will say, and I will die on that hill.
51:15
So feel free to come at me, but ID pro.org, be a member, join
51:19
the slack, you know, just be part of the community.
51:21
And with that, we'll go and leave it for this week.
51:23
IDC, podcast.com, idcpodcast.tv for the YouTube channel, like
51:28
subscribe and do all that fun stuff, you know, share, share
51:31
the gospel of I am with others. So thanks everyone for watching
51:34
and or listening and we'll talk with y'all in the next one.
51:39
You've been listening to Identity at the Center.
51:42
We hope you've enjoyed the show. Make sure to like, rate and
51:46
review, and we'll be back soon. But in the meantime, hit the
51:50
website at identity@thecenter.com.
51:54
See you next time on Identity at the Center.