Latest / Identity at the Center / #262 - Identity Metasystems and Fabrics with Eve Maler of Venn Factory

Transcript

#262 - Identity Metasystems and Fabrics with Eve Maler of Venn Factory · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity at the
0:23
Center podcast. I'm Jeff and that's Jim.
0:25
Hey, Jim. Hey, Jeff, how are you?
0:27
Oh, not so bad yourself. I'm good.
0:29
I'm good. Excited about today's episode.
0:32
We're getting through the remainder of the voicemails that
0:35
came prior to the episode where we had the five questions where
0:41
we gave a copy of the book Learning Digital Identity by
0:46
Phil Windley. And I just wanted to to mention
0:49
that like we these voicemails don't go to waste, right?
0:53
So even though not all of them made the cut for that episode,
0:56
we are using them. We're going to go through them
1:00
the remainder of them today. But we love the voicemails.
1:03
We have a talk to us feature on our website, idacpodcast.com.
1:08
Go there, click, talk to us, leave a voicemail and we'll use
1:11
it for a future episode. Yeah, even if we don't play it
1:14
like the chip chipperson one, I got a kick out of it.
1:16
I knew exactly what it was. So I think you mentioned our
1:18
friend Mike West was the person who put that out there.
1:22
So Mike, if you're listening, I got you, man.
1:24
I I, I I picked up on that one. Yeah, he was quite proud of
1:28
that. He he texted me like low key was
1:31
like, I can't believe you guys didn't use my voicemail.
1:34
I was like, I didn't even know you left the voicemail.
1:36
He's like, yeah, it was a chip chip person voicemail.
1:39
I was like, oh, I got you, man, playing games with us.
1:42
Yeah, I knew exactly what it was.
1:44
I thought it was a good I I couldn't understand the the the
1:46
message at 1st and then it was the the lame.
1:49
You know, is your refrigerator running well?
1:51
You better go catch it. And I'm such a fan of of Jim
1:55
Norton and his alter ego Chip Jefferson that that was that was
1:59
an obscure reference, but I still caught it.
2:02
So I don't know, I I hate the court disaster.
2:05
But you know, good luck next time.
2:08
It was good. No?
2:09
I mean anyway, reminder for everyone.
2:12
If you can get out there, leave voicemails.
2:14
And of course the best way that people can support the podcast
2:18
is by, you know, leaving a rating on their podcast platform
2:22
that they they choose of their choosing.
2:24
And five stars is appreciated of course.
2:27
And any kind of comments, we do read them and the the ones that
2:31
are more complimentary we usually read on the air.
2:35
I print them out, put them on my refrigerator, kind of like, you
2:37
know, a child showing their work for the rest of the household,
2:40
that kind of thing. Exactly, exactly.
2:42
But we got a couple conferences coming up this summer.
2:45
You want to kind of get us kicked off the first one?
2:48
Yeah, so very excited. We've been kind of teasing this
2:50
for the last few weeks, if you like.
2:52
But Identiverse, it's official. We are going to be there and we
2:55
have a discount code that we can share with folks.
2:57
So if you're going to be at Identiverse, it's in Las Vegas
3:00
again this year, which is fantastic at the Aria.
3:02
Very cool spot to get from last year as well, May 28th to the
3:06
31st. And if you're listening to this,
3:09
or I guess if you're not listening to this but happen to
3:10
get a hell of the code, IDV 2 four dash, IDAC 25.
3:15
And don't worry, we'll have this in our show notes so people can
3:17
check that out. But if you're registered with
3:19
that, you get 25% off whatever the going rate is.
3:22
And yes, it does stack with early bird rates.
3:24
So save a lot of money by doing the early bird.
3:27
Save another 25% by using our code and go to identiverse.com.
3:31
Find the link to register for Identiverse 2024.
3:34
Use our code, help support the show.
3:36
I know Jim and I are doing podcasty things there.
3:39
We haven't quite figured out all the details on it, but we'll
3:42
definitely be there and definitely want to encourage
3:45
people to register for that. The exciting thing for people
3:48
who are into the whole CPE continuing education thing is
3:53
they actually have 20 credits up for grabs.
3:55
And so if your organization. Yeah, it is, It's like an
3:57
organization like the one that Jim and I work for RSM.
4:00
We have requirements for CPES that we have to get every year.
4:03
I think it's like 40 or something like that going to one
4:05
like this conference knocks out half of that.
4:07
So it's fantastic for us. Hopefully other people can take
4:10
advantage of that. But it's it's a great
4:12
conference. I I think we've talked about it
4:13
on a verse in the past, you know multiple times We'll be doing a
4:16
show with Andy Hindel I believe probably in a few weeks kind of
4:19
leading up to the OR leading up to the conference.
4:22
But yeah, we'll have a a link in our show notes, use our code,
4:25
show support for the podcast, that's another way Freeway that
4:29
you can help us out as well. Anything you want to add to
4:31
that, Jim? No, you know there's a lot of
4:35
things that reasons why to attend.
4:38
I mean there's a this is a four day conference, right.
4:41
So I think it's really well priced for getting the four days
4:45
plus using the discount code save even more money.
4:49
But it's over 70 hours of sessions, top notch names like
4:54
if you go out to their website, look at kind of the the speakers
4:59
that they have lined up for the for the conference, it's pretty
5:02
impressive as well as hands on master classes and training.
5:07
So a lot of good coming out of this conference.
5:11
Yeah, buses in Vegas, which is always a good time.
5:13
I just love the conferences in Vegas.
5:15
It's so easy. Got the airport right there.
5:17
Plenty of hotel rooms, plenty of places to eat, drink, do things
5:21
that are of your own volition, right?
5:24
Things like that. Yeah, control yourself though.
5:28
The other. Feels like we we always talk
5:30
about that like every year like OK, it's a great place to be as
5:33
long as you can control yourself.
5:35
Oh yeah, 100%. And and I can control myself.
5:37
I have that. My, my, I am not, you know, a
5:40
gambler or really much of A drinker, but people watching
5:43
food and like experiences. Yeah, sign me up.
5:45
I'm all, I'm all for it. I think the only thing missing
5:48
from Vegas right now is a Portillo's.
5:49
And that would be a very happy person because they've got a
5:51
Hattie Bee's chicken in in in the Cosmo.
5:55
You know, there's plenty of other places to eat, but I I
5:56
need a Portillo's in Vegas, just so I can, you know, complete the
6:00
trifecta when I'm there from a food perspective.
6:03
Yeah. I've never gone to Vegas though
6:04
and complained about the food options.
6:06
So I think it's all right. You were about to mention, and
6:10
I'll take it over from here, is the Identity Week conference
6:13
circuit. So we sometimes call it Identity
6:16
Week America, but it's on the European continent as well as in
6:20
Asia as well as in North America.
6:22
So we've got your Identity Week Europe in Amsterdam, June 11th
6:27
and 12th, Identity Week America in Washington DC September 11th
6:31
and 12th, and Identity Week Asia which is in Singapore October
6:35
22nd through 23rd. And our listeners get 30% off by
6:40
using the discount code IDAC 30, IDAC 30 in the show.
6:48
Note we have a link to the conference where you can go and
6:52
register and all that great stuff.
6:54
Yeah, another discount code, another partnership we've got
6:57
with that conference. We'll be at the Identity Week
6:59
America, September 11th and 12th.
7:02
I think right now I'm going to host a panel on stage with some
7:05
people to talk about identity, things I would imagine wouldn't
7:07
make sense for me to talk about anything else.
7:09
And then you and I are going to be doing more Podcast Y things
7:13
somewhere there. So still kind of figure out the
7:14
details on it, but excited to partner up with those guys
7:17
again. It was a fun conference last
7:18
year. It was, it was interesting my
7:20
first time going there and I think there's definitely a lot
7:23
of opportunity to, you know, catch up with people some some
7:26
pretty good names that were there and it was in a good spot.
7:30
So I'm looking forward to that one again.
7:31
And I think if you've never been to Washington, DC too, it's one
7:34
of those cities that, you know, there's there's certain cities
7:37
in the United States that are distinct, San Francisco, There's
7:40
no other city in the United States or probably in the world
7:44
like San Francisco, New York City and Washington, DC Those
7:49
are three that really stick out in my mind that are just like,
7:52
you know, very unique places. But I think with Washington DC,
7:56
you've got a lot of things that are kind of low key stuff to do,
8:00
a lot of museums and things like that.
8:02
So if you're into that, you can certainly find it.
8:06
Well, here's the most important thing about that is it's at the
8:09
Convention Center and just about across the street is a yardbird
8:14
which has the best chicken and waffles I've ever had.
8:16
There's a few of them around the US ones in Vegas that's the one
8:20
where I first discovered it. But the best chicken and waffles
8:23
Yardbird. It's right next to the
8:24
Convention Center. So you know, I'm going to be
8:27
there at some point for chicken waffles.
8:30
The one thing I will say, I feel like you're interested in going
8:32
even if you're not sure you don't have the approval or
8:35
whatever, get out there early to book your hotel.
8:39
Usually I get one with a cancellation policy.
8:42
Hotels in DC are extremely. Expensive.
8:46
Yeah. But don't forget chicken and
8:48
waffles. All right, let's talk about our
8:52
episode today. So you mentioned we have some
8:54
more listener voicemails that we're going to bring on here.
8:57
And we have a guest. She's going to help us answer
9:01
some of these voicemails and maybe give perspectives.
9:04
We've got Eve Mailer again. This is her 4 1/2 appearance on
9:08
the show. She was with us for number 48116
9:12
one 51, which is sort of our famous what is the difference
9:16
between digital identity and and identity and access management.
9:19
She's was with us for 202 and this is should be episode #262.
9:25
So welcome back to the show, Eve.
9:27
It's great to be back. You're making me hungry with all
9:30
this talk about chicken and waffles.
9:32
That's part of the goal here, right?
9:33
You know, little food talk, little identity talk.
9:36
You know, we've covered your background in the past.
9:38
Your former CTO of Ford Rock and now you're the founder of Ven
9:41
Factory. I guess catch us up, you know,
9:43
since 60 episodes ago, which sounds like a very long time.
9:47
What are you working on now? And tell us a little bit about
9:49
Ven Factory. Yeah, I have launched a
9:52
consultancy and it exists to help both identity related tech
9:58
vendors as well as enterprises craft irresistible identity
10:03
strategies. That's the kind of thing that I
10:06
helped to do when I was at Ford Rock most recently and something
10:10
I love to do with my very weird collection of experience.
10:15
So now I get to help others do it.
10:18
So where does the name come from?
10:19
Ven. Factory.
10:21
Ven Factory, Yeah, so some folks will know.
10:26
Being in the industry, if you've been in the industry for any
10:28
length of time, you might remember a set of three bubble
10:32
Venn diagrams that I started doing in like 2005.
10:35
Originally it was to compare SAML and Open ID.
10:38
The original open ID and way back when, info card before it
10:42
was card space before it was an info card standard.
10:45
And then I kept up that series kind of maintaining this, this
10:50
analysis, this Venn analysis of these standards.
10:53
And I've sort of kept that up over the years.
10:55
And somebody at some point called me the queen of Venn.
10:58
And you know, and anytime I give a talk and don't include a Venn
11:01
diagram, there's a certain level of disappointment.
11:03
I thought why not lean into it. So for those in the know, it's a
11:07
little in joke. I'm having some fun.
11:09
And if you don't know the in joke, well, who doesn't love a
11:13
Venn diagram? You know, they, they help you
11:15
analyze. I I firmly believe you can
11:17
analyze anything and put it into Venn diagram form.
11:20
So there you go. I firmly believe that as well.
11:23
I think that's a great name and I always think of you as the
11:25
Queen of Venn diagrams. I wanted to say something.
11:28
So Jeff kind of went over all the episodes that you sat with
11:33
us and what I appreciate most was episode 48, not because of
11:38
anything you said, but we had like 10 listeners at that point.
11:42
And here we are, Episode 262, and I think we've eclipsed, You
11:48
know, we're. We have a lot of 10s of.
11:50
Thousands. We'll be on 10.
11:52
Yeah, we keep growing every year.
11:53
And yeah, you were with us the very beginning when we were,
11:56
when we were nobody. And you guess what?
11:58
You're still with us when we're still nobody.
12:00
Oh, listen, it is an honor. It was an honor then.
12:03
And listen, it's an honor now. And and just you guys influence
12:05
a lot of people's thinking and you teach people a lot of
12:08
things. So that's why it's so exciting
12:10
to be here yet again. So thank you.
12:13
Well, one thing that really helps us teach people is having,
12:16
you know, guests such as yourself on the podcast.
12:19
And that's what I think we'll get a lot out of today.
12:25
So we have these voicemails. I I don't know if you were kind
12:28
of tuned into this whole thing, but we did a contest.
12:31
We had Phil Windley on the podcast couple months now,
12:36
couple months ago now. And he was very generous and
12:40
offered us some book codes so people would get free copies of
12:43
the book. And with the way we decided to
12:46
distribute those was ask people to leave voicemails and we would
12:49
pick five of them and we played those and Jeff and I answered
12:52
them and we gave book code. So we couldn't use all the
12:55
voicemails, but we had a few extras left over and two of them
12:59
we wanted to play today and have you help us answer those
13:03
questions. So Jeff, would you cue up the
13:07
first question which came from David Stromer, friend of the
13:10
show, friend of ours. Spent a lot of time with him,
13:13
last identiverse and he asked a question and I'll let you play
13:17
it. Hey Jeff and Jim.
13:19
In Philip Windley's book Learning Digital Identity, Phil
13:22
describes the benefits of an identity meta system.
13:25
My question is, what are your thoughts on the identity meta
13:28
system? How practical is it, and what is
13:31
the best way for broad adoption? Is it more government
13:35
regulation, economic incentives, or a combination of both?
13:40
So Eve, I'm going to bounce that to you first, but I'd love to
13:43
then follow up with comments. Yeah, it's it's a really good
13:48
set of questions. So thanks Dave.
13:52
I find it really interesting the way Phil lays out the
13:57
possibilities of an identity meta system that respect all of
14:01
the seven laws of identity that you know were proposed by by Kim
14:05
Cameron. And he contrasts in his book a
14:09
meta system that we have today, which is like social login,
14:14
social sign in, social identity with decentralized self,
14:19
sovereign identity and how many more benefits there could be in
14:23
that vision. I think that's where this
14:24
question is going, right? It's like how can we have that?
14:26
Where, where would we go to get that and what does it look like?
14:30
And it's it's tough because the notion of a meta system of any
14:36
stripe is interoperability and a willingness to work together.
14:43
And so one of the things that I think is a feature of this
14:47
social login meta system that we live with now is it's got super
14:54
glue stickiness because of data monetization.
14:59
And this is something that's super hard to overcome because
15:01
now we're in the realm of business models, right.
15:05
And even when I think about there's another meta system that
15:08
we kind of have a more loosely coupled meta system, which is
15:12
just kind of the Oauth Open ID Connect stack writ large in
15:17
usage in enterprises. You know, there's a lot of Phil
15:21
introduces this word generativity, which I just love
15:23
the notion of something generative where you get
15:25
unexpected uses out of it and and Oauth and Open ID Connect
15:29
certainly have that as well. New flows, new token formats and
15:33
so on. That meta system too, even
15:37
though it's a lighter weight, it's, it's extremely generative
15:42
and it's extremely hard to dislodge, not because of
15:44
business models so much, but because of some indirect
15:47
features. Like you know that there's going
15:51
to be tools available. You know that products are going
15:53
to support it because we've got standards, you've got developer
15:57
knowledge that you can assume a certain level of, you have this
16:00
ability to sort of string together the pieces and you have
16:03
the ability to customize it. So meta systems that are in
16:06
place, I think are demonstrating a lot of stickiness for
16:09
different reasons. And so to Dave's question about,
16:13
you know, how practical is it to imagine this new meta system
16:17
coming into place, what's needed for broad adoption?
16:20
To me, I'm, I'm going to say it rests on softening the value of
16:28
data monetization, maybe recognizing the liability risk
16:33
in in identity data in a new way before we can sort of change
16:38
behaviors more wholesale. What do you think?
16:42
Yeah, I I mean, I went back to this chapter.
16:46
It's Chapter 4 in Phil's book and calls it the laws of
16:50
identity, right? So he talks about the idea of
16:52
the identity meta system, but titles the chapter Laws of
16:55
Identity, which was infamously developed by Kim, what was it
17:01
like 20 years ago? And so the one compare and
17:05
contrast that he used that really struck A chord with me
17:09
was you know using the example of the Internet is a
17:14
communications meta system like a telephone is point to point
17:18
communication. The Internet is a way to
17:21
communicate and there's or or medium to communicate and
17:26
there's all these different ways you could do that with FTP or
17:30
websites or you name it right you can do all these things and
17:34
it all rides over this and and so the identity meta system has
17:38
to be the same thing. It's you had mentioned Open ID
17:41
and really that's like some organization who wants to have a
17:48
set of identities and then there could be governments that want
17:53
to have sets of identities. So it could be all and all these
17:57
different ways that you have to, you know, communicate with
18:03
different organizations through your identity.
18:05
And also as a person, I'd like to think that I have one
18:08
identity, which is Jim McDonald. But that's not really how it
18:13
works in the real world. According to in the state of
18:16
Georgia, where I live, I'm this person that has a driver's
18:19
license, according to the United States government, on this
18:23
Social Security number. And I've got like, you know,
18:27
hundreds of identities on the Internet.
18:29
I've got a corporate identity. And so this meta system has to
18:34
encompass all these things, right?
18:36
It's kind of like the underlying concept.
18:40
And this is what's tough about meta system plays because you
18:45
need such a level of interoperability between
18:48
disparate systems that somehow have a contract with each other
18:51
to you know interact on the on the basis of these rules.
18:56
And it's a harder play than these sort of massive big tech
19:00
plays that we're familiar with where you know it's not it's,
19:03
it's pretty centralized, right. There's kind of a pull towards
19:06
centralization. I my Aunt Jennifer's talk last
19:10
year, I was talking about insidious centralization.
19:13
You know despite best efforts to sort of pull pieces apart and to
19:18
empower people thereby, we still experience sort of honey pots.
19:25
You know things like you just as they experience in in the world
19:28
of cryptocurrency. You know exchanges are a way of
19:30
sort of re centralizing that sort of scotches some of the
19:34
value of the decentralized platform.
19:38
This is, this is one of the things that makes it extra tough
19:41
to kind of sign up to to have everything work with each other
19:45
out-of-the-box without having to have you know laborious business
19:48
agreements. One of the things I appreciated
19:51
in the in Phil's book is talking about administrative identity
19:55
versus user centered which is starting to get into the more
19:58
you know giving people more of an ability to use the rights
20:02
that they should have and then kind of going all the way to to
20:05
self sovereign I think was the sort of third level that was the
20:08
phrase he was using for the third level pretty much all the.
20:13
Identity accounts that we have today really are administrative
20:18
and they're and he did a nice job of identifying
20:21
administrative elements that live that lurk beneath the
20:24
surface of even user centered and even better ecosystems.
20:31
Yeah. And that's probably the the
20:34
world that many of our listeners, the practitioners of
20:37
the world are living in right as the administrative identity or
20:43
working for some organization or we're developing products that
20:47
that focus on that. But now this new I I say it's
20:52
the new world decentralized identity because it's kind of
20:55
entered my conscious within the last few years that's breaking
21:00
in, but it's still probably a smaller percentage.
21:02
So I think a lot of folks are still trying to wrap their heads
21:06
around it. My my follow up question was
21:08
going to be I've heard people make the statement many times.
21:12
I would like to get your take on this.
21:15
That the Internet was created without an identity layer.
21:18
Like that was like the big mistake like have we just
21:22
created this identity layer when the Internet was launched we
21:26
wouldn't be having these problems.
21:28
But I think that misses the whole nuance that really what
21:32
Kim's laying out with the laws of identity, which you know,
21:35
believe that identity meta system I think is inevitable,
21:38
right? It's really like the law of the
21:40
universe almost. What do you think?
21:42
Yeah, I, you know, I don't know that if the the Internet had
21:46
been built with something that we could really identify as an
21:49
identity layer, if it would have satisfied us according to these
21:52
modern requirements, right, 'cause I think Kim's
21:56
requirements are kind of they they represent a look back at
21:59
what's been happening and going. I'm not so pleased with that
22:02
direction. So would it have looked the way
22:05
we expect? I mean adding mobile devices and
22:11
the API economy and sort of the modern world of blockchain even
22:16
to the picture. They've given us new ways of
22:19
conceiving of whether we can even pull this kind of thing
22:21
off. And way back when, when browsers
22:24
were fantastic and new and, you know everybody was making a
22:27
homepage by viewing source and like, would it have been the
22:32
same identity layer that we know we want now?
22:35
I don't. I'm not so sure.
22:37
That's right. I mean it would be we'd be
22:40
running America Online and wouldn't somebody figure out how
22:43
to subvert that? I had one other question about
22:48
identities is, you know, it seems like we talk about
22:52
Internet of Things, identity of things, and now like you can't
22:56
get away from the discussion around machine identities.
22:59
Rightfully so. But I wonder is, are we misusing
23:03
that term? Can a machine really have an
23:05
identity or is it just accounts and the identities go back to
23:09
people? Oh my goodness, that's so
23:13
philosophical. Let's see how many machines can
23:18
dance on the head of a pin. No, I honestly, I think, I think
23:22
it's well stated actually. It's it's, you know, lots of us,
23:28
if Phil included in the book, sort of say, you know, talking
23:31
about an identity kind of isn't really very helpful unless
23:34
you're talking about the, the personal conception component.
23:38
And in which case, you know, there's no God in the machine.
23:42
The machine can't, you know, act on behalf of itself.
23:45
It needs to be a proxy for somebody.
23:47
And so you could say it doesn't have an identity, but in
23:50
practice, day-to-day, it's it's going to be talked about.
23:53
The machines have IDs and identifiers aren't identities,
23:56
but let's just roll with it, you know.
23:59
So I'm going to say, yeah, there's machine identity.
24:01
And the thing to be cognizant of though is it's something I care
24:07
about a lot is like who delegated that machine, the
24:11
ability to act on their behalf? Because there's always going to
24:16
be a somebody who's actually legally responsible, who has
24:19
that, that kind of legal duty liability, fiduciary duty.
24:23
And so machines kind of well, to date, they can't have it.
24:26
You know, maybe if the singularity shows up, we can
24:28
worry about that. But you know, to date, machines
24:30
act on behalf of other parties and that's the piece that we
24:34
tend to forget. And I like to remember it
24:37
because I'm such a big fan of delegation, semantics and and
24:41
that driving authorization. Jeff, wondering what you think
24:44
about this topic? You know, Eve, the word that
24:48
comes to mind with your last statement, there is
24:50
accountability. Who is accountable for this
24:53
account? Yes, yes.
24:56
I think we get into the semantics a little bit.
24:57
OK, well, define identity. Like, what do you mean?
24:59
Like, do you mean identity? Identity like human right?
25:02
Or are we talking about in the in the context of identity and
25:05
access management, which encompasses everything.
25:08
But the word that always comes back to me is accountability.
25:12
And I absolutely agree with you. It's like these accounts are
25:14
acting on behalf of something and who is accountable for
25:19
whatever that transaction is. So I think about it from like a
25:22
racy perspective for fans who like the racy model,
25:25
recountable, recountable, responsible, accountable,
25:28
consulted and informed, who is accountable?
25:32
And the thing that I always run into is a lot of people think
25:35
that they are accountable when they're actually responsible for
25:38
something. In my mind, Accountable is kind
25:40
of like a Highlander. There could only be one.
25:44
Right, because. If you have too many A's,
25:47
nothing's getting, you know, nothing's happening.
25:48
There's really no decision making, taking place.
25:51
Doesn't necessarily have to be binary one or, you know, one or
25:53
none. But I think about that
25:55
accountability. So you have those machine
25:57
identities that are out there. Who is accountable for it?
26:00
Is it IT? Is it the business?
26:02
Is it Jim? Is it me?
26:05
You know, I think there is still someone who's still accountable
26:08
for those identities. And you know this is, this is
26:10
really important. I I Love Actually, I think there
26:13
needs to be a a new version of a Jane Austen novel that we can
26:16
ask AI to write called Accounts and accountability because that
26:21
is really the crux of the matter.
26:23
Like, you know, we don't document those things very well.
26:26
In fact, we don't document responsibility now.
26:29
I'm going to say accountability from now on for individual
26:33
pieces of what today we call identity data, like who said to
26:37
collect it and why did they want it and what is the value of it
26:43
and what is the cost of it. Like if we actually had that
26:46
much clarity, there's a whole bunch of things that would be
26:48
clarified, including something that would get swept into the
26:51
mix is workload, identity, workload, account workload,
26:55
identifiers, service identifiers, thing identifiers.
27:00
Those are those are part of a bigger picture where I don't
27:02
think we're even doing people identity information
27:05
particularly well on the score. Who is accountable for
27:08
collecting this information? Who is accountable for using it?
27:11
That's one of my favorite questions asked when I walk
27:12
into, you know, any client conversation is all right, so
27:15
who's who's accountable for identity?
27:17
Does that person know it? So that's the other thing too.
27:21
It's like, oh, I didn't realize that was me.
27:23
I was like my, my favorite answer like is I asked that
27:26
question and then, you know, a bunch of us are sitting around a
27:29
conference room and everybody's pointing at different people or
27:32
everybody's pointing out one person and that one person is
27:34
pointing to someone else. Like, OK, clearly there's
27:36
disconnect here. We got to figure out like you
27:38
know, what are the roles, you know, from a identity
27:41
perspective, you know, if it's just people and process right,
27:43
the program itself. So I'm right there with you, if
27:45
that. One person is giving the shrug
27:46
emoji. You know, there's something
27:48
seriously wrong. And that's OK, right.
27:51
I guess it's, you know, it's OK to ask those questions because
27:53
if you don't ask the questions and there's not clarity on it,
27:56
how else are you going to get clarity on it?
27:57
I think sometimes it's helpful to go into those conversations
28:00
with like, yeah, we don't have all the answers, but let's
28:02
figure it out together. And then and then we'll nominate
28:05
someone as Highlander of identity and that person will
28:07
have the sword and can only chop, you know, heads off.
28:10
And that's it. I feel like this is a good segue
28:13
into our second voicemail 'cause it was a round identity fabric
28:16
and this one came from Satish. So I'm going to play that now
28:19
and then we'll, we'll talk about it.
28:21
Hi, Jim and Jeff. Good day.
28:23
This is Satish from Melbourne, Australia.
28:25
I'm a regular listener of your podcast.
28:27
I appreciate the efforts that you guys are putting in to
28:30
discuss on different topics related to digital Identity
28:33
domain. It will be great if you can
28:35
cover a session on what is Identity fabric and the reasons
28:39
why we need them. Thank you.
28:41
All right, so thanks Attish and I love it when we get questions
28:43
around the world. So I've never been to Australia.
28:45
It's definitely on my bucket list.
28:46
I'd love to go there at least once, but thanks for sending
28:49
that our way. Let's start with the first part
28:52
of the question of what is an identity fabric, And then we'll
28:56
get into why it might be important to consider as part of
28:59
the of the evolution of someone's identity program or
29:03
maybe a technology stack, whatever it may be.
29:05
Eve, do you want to take a stab at sort of defining what is an
29:09
identity fabric? I see it as having all the
29:14
elements of Identity, Design, time and Runtime as pluggable
29:18
components that speak to each other and are ready to do any
29:22
job for any population, be it human or machine, requiring
29:29
integratability and interoperability.
29:31
And it's very core. Yeah, I think it's important to
29:35
say that this is, I don't see this as a product.
29:38
It is a set of things people process and technology that make
29:43
this framework up to say, OK, here's a bunch of different
29:46
services that we have and they they form this blanket, this
29:50
warm identity blankets, OK, yes, we can do provisioning and we
29:54
can do deprovisioning and authentication and authorization
29:57
and and things like that. And it's, I think it's a
30:00
construct to help people kind of get their head around what are
30:04
the things that we provide what you know, how big is your
30:06
blanket? How warm is it?
30:08
Right. Is it a summer blanket?
30:10
Is a winter blanket? Is it a blanket at all?
30:11
Maybe it's just a sheet. I don't know where I'm going yet
30:15
with a blanket analogy, but I feel like it's it's sort of
30:17
taking hold of my head as we're speaking.
30:20
Jim, how do you see an identity fabric?
30:22
What does it mean to you? Yeah.
30:24
When I see it come up the most is two different scenarios.
30:28
One is the large enterprise where maybe there's been some
30:33
decentralization over time and now so you might have different
30:39
IGA systems or different single sign on systems and a lot of
30:42
legacy technology and you're trying to wrap all that together
30:48
without breaking too many eggs. Honestly, for a long time in my
30:53
head I looked at these this situation I just described and
30:58
my attitude would be fix the underlying problem.
31:01
Don't have multiple single sign on systems, don't have multiple
31:05
IGA systems. But the reality is this is where
31:09
the pragmatism comes in, right? It's like OK, genius, don't you
31:13
think we knew that? Wouldn't we love to just wave
31:17
the magic wand to get rid of these things?
31:19
Each one. You know, you'd love to say
31:22
this, Jeff, and recognize this. There's politics within the
31:25
organization. And a lot of times when it comes
31:28
to things like this, politics includes not just ripping it out
31:31
of people's hands. And it also comes down to what's
31:35
our focus going to be on, right. We can't focus on everything or
31:38
we're not focusing on anything. So you need some kind of ability
31:43
to have all this variety in your environment, new, old, different
31:49
vendor technologies and you have to be able to accommodate that
31:53
and still move forward. The 2nd place where I see this
31:56
is mergers and acquisitions. And again, it's, you know, you
32:01
keep holding on companies, they come in, they've got whatever
32:05
they've got, but it might be different than what the
32:08
acquiring company has. And so again, it's not just a
32:12
snap of the fingers and make it all go away, it's you need some
32:16
kind of transition or maybe your strategy becomes, you know we're
32:21
not going to spend the money on a transition until it naturally
32:24
comes. But they just spent all you know
32:26
a couple $1,000,000 to put these systems in over here.
32:30
We put spent a couple $1,000,000.
32:31
So we're just going to make all this stuff work together or
32:35
we're not even sure that you know which system is better or
32:38
etcetera, etcetera. So to meet the, I am bringing it
32:41
back to kind of a technology like a tool perspective, because
32:45
I think usually tools that are built around the identity fabric
32:49
concept is the underlying is that there's this variety of
32:54
technologies, variety of generations of technology and we
32:59
want to achieve seamlessness. If I know, I know, it's made
33:05
that word up, but you know it. It's not as simple as just
33:08
saying, you know, get rid of your legacy systems, rewrite all
33:12
of them. Or you know, yeah, these header
33:15
based applications that you have, like 250 of them, just
33:18
make them all SAML enabled, you know, It's just not that easy.
33:22
It's not trivial, and actually my husband, you know, I recently
33:25
wrote a LinkedIn post that I loved.
33:26
It was about celebrating your tech debt because it it it
33:29
represents those tough decisions you made so that you could live
33:33
to fight another day. And you know, it's it's not
33:36
really a best practice to go and eliminate all tech debt.
33:39
You know, it's it's like just the same way that, you know,
33:42
taking a loan can sometimes be a good idea.
33:45
It's tech debt, right? So there's reasons why companies
33:48
make those decisions, why people make those decisions and finding
33:52
the right tools that that are fluid and kind of facile with
33:56
that situation, I think should be part of the identity fabric
34:00
story. They're there to serve you.
34:02
I'm a, I'm a recent Notion user and I don't know who among your
34:06
listeners are notion fanatics, but it's easy to become either I
34:11
suppose, a hater or fanatic immediately.
34:12
And it provides kind of a fabric for you know, capturing
34:16
information of whatever form and to be that easily accepting of
34:23
all the different shapes and sizes that identity solutions
34:27
come in for your average enterprise is is I think what we
34:31
need to strive for. And it's funny back in OK this
34:34
is like early 2012 when I was at Forrester.
34:37
I had written some research shamelessly kind of stealing
34:40
from my my then colleague John Kinder Ogg who had published
34:44
kind of the Seminole zero trust research.
34:47
I was like, can I steal this And and for for a concept I have
34:50
called Zero Trust Identity, he's like, yeah sure.
34:52
So yelped out. I was very lucky and what what
34:56
zero trust identity looked like for me.
34:58
So this is not saying use identity to achieve zero trust.
35:01
It was how do you make all of your identity systems loosely
35:06
coupled? And I was recommending that you
35:09
have standards and that you have API facades and when I squinted
35:13
that I'm like, yeah, it kind of looks fabric ish now.
35:17
I love this whole warm blanket thing if I have to think about
35:19
that a little bit. But like, you know, I think
35:22
these concepts have been around for a while and that was the era
35:25
when, you know, Steve Yege had recently written his rant about
35:29
everything should have API interfaces and you know it was
35:33
the full flowering of those days.
35:34
And I think we're starting to see some of the benefits of that
35:37
now. Like I'm excited about shared
35:39
signals as an example, standardized interface for
35:43
basically security event pub, sub around which you could do a
35:46
whole bunch of things. Could that be a sort of tool in
35:49
the in the toolbox for just making it easier to incorporate
35:53
whatever state each system is in?
35:56
So I I think the the keyword here is the fabric part, right?
35:59
It's a flexible thing that covers a certain amount of area
36:04
of different thickness. So I feel like I'm onto
36:06
something here with the blanket idea I got a flesh.
36:08
No more CCYA with your identity blanket.
36:14
Right. I feel like there's a there's an
36:15
identiverse talker or something there around it.
36:19
Or maybe someone else smarter than I am can can take that and
36:21
kind of run with it. And I did find Eli's post on
36:27
LinkedIn, so I'll put that in our show notes as well for
36:28
people. To check it out.
36:30
So you can celebrate your technical debt, which is totally
36:35
the antithesis. So I think of what most people
36:37
are trying to do. Well, exactly.
36:39
It's like just in the way of thinking about what it
36:40
represents as business decisions.
36:42
Like, you know, it can't be too hard on people who made those
36:44
decisions. Yeah, I mean, I say it's 2020,
36:47
right? And and it's OK to get smarter
36:48
over time. You know, maybe there were,
36:50
there's always reasons why things were chosen in the past.
36:54
Sometimes they're good reasons, sometimes they're not good
36:56
reasons. But there are reasons and it's
36:58
OK to get smarter. I want to tackle the second part
37:01
of the question. Why is this important?
37:03
Why should we care about that? Nice, warm, comfy identity
37:08
blanket that is identity fabric. And for me, I think I'll start
37:12
off here is it's really, it's interoperability, it's
37:15
flexibility, it's the ability to pull things together and say,
37:18
yes, this is what these are all the things that we can do.
37:21
But I don't. Eve do you have like a separate
37:25
viewpoint of why this is important?
37:27
To have an identity fabric of some sort?
37:30
I mean kind of like what I was I was saying previously about like
37:34
you know, if you conceive of identity as a login box, then
37:38
you're missing all the things that you need to take care of
37:41
that will benefit you with a more expansive view of identity
37:46
governance, of making authorization decisions better
37:51
of achieving that elusive goal of you know, not just least
37:56
privilege, maybe 0 standing privilege.
37:58
Like if we're really serious about these things, if we're
38:01
really serious about giving customers a great experience
38:05
through, you know, personalization.
38:06
All those things need different parts of identity that are
38:10
definitely they're kind of below the water.
38:11
They're not the part people see every day.
38:14
But but we know how important they are.
38:15
But to do them right and to have all those pieces into working
38:18
together and then into working with the systems that need the
38:22
results, boy it's it's so powerful.
38:25
Last year Liminal had a had a report that I found really
38:29
interesting was about Siam specifically, but it was saying
38:32
that every dollar spent on Siam had a 15.3 times return on
38:38
annual basis. And it's like seriously that
38:40
that sounds like a really good deal.
38:43
Why aren't more people sort of taking that approach?
38:46
Why not do it? Yeah, it pays for itself.
38:48
Or makes you money apparently itself right.
38:50
Yeah exactly so and and because they're they're worried about I
38:54
would say the integrate ability and and a lot of them just don't
38:58
see identity that way. You know we're we're sort of a
39:01
weird breed with you know that that live with this stuff all
39:03
the time and we see all of its possible uses and that makes it
39:07
more valuable. So that's why I think it's
39:09
important to get right, just hook up the systems in a in a
39:12
kind of more of a mesh, you know everything talking to
39:15
everything. Of course, you actually do need
39:16
zero trust if you're going to have these interfaces exposed,
39:19
and you probably got to be protecting them all with Oauth,
39:23
etcetera, etcetera. Yeah, maybe.
39:25
I'm thinking now it's like a quilted type thing where there's
39:28
like different parts of the quilt are the services, but they
39:31
all form like just, you know, one giant thing.
39:34
See, I sounded something here with the blanket thing.
39:36
I'm like, OK, now I'm thinking about you're.
39:37
Not giving up on this blanket. I'm not I I I definitely not.
39:41
Jim, why isn't Identity Fabric important in your mind?
39:43
Well, it goes back to, I guess I'm, it's going to do the same
39:47
thing you did. So I'm going to draw it back to
39:49
my original point, what the identity fabric is, right?
39:52
It's taking all these diverse technologies and making them all
39:56
work together. So I think rather than saying
40:00
looking at your landscape and doing what I said originally,
40:03
which was why not just clean up the mess, why not just get
40:06
everything on to some modern system.
40:09
You do the calculation, you say, oh, that's going to cost us,
40:12
Let's just save a lot of money. I've got an analogy of my own.
40:16
So you're a CIO and you've got one of those.
40:20
You ever do one of those things where it's like there's all
40:22
these jars and you vote by putting your tickets in the
40:26
jars, right? So you put all of your tickets
40:28
in one jar, you can spread them out.
40:30
And so this, the analogy would be you're the CIO with your
40:35
tickets. That's your money you can spend
40:37
on technology. And then you've got all these
40:39
jars and one of the jars is, you know, doing that project, some
40:44
of the other jars are things like I'm going to fix Identity
40:49
for Ciam, right? So it's like a part of that, but
40:52
it's like for my customers. And then I've got another jar
40:56
that's I'm going to do something really strategic with Identity
41:01
relative to our product, like I'm going to bake it in and then
41:04
there's all these other jars, right.
41:06
But that kind of that analogy kind of masks back to a reality,
41:10
which is that maybe it's not a 0 sum game, but there is
41:14
limitation to how much money you have.
41:16
You can't just get everything you want.
41:19
And so maybe by putting 1 ticket or two tickets into that, I'm
41:25
going to solve this fact that through mergers and acquisitions
41:30
I have all these different systems or I'm a big
41:33
corporation. I've got all these different
41:35
legacy systems and different technologies for Identity rather
41:40
than just I am going to do a consolidation of all of my ID PS
41:44
that's going to take a whole bunch of tickets.
41:46
I'm just going to put one or two tickets in there and I'm going
41:49
to integrate everything. So that's why it's important.
41:54
It's fewer tickets to kind of you don't get the same result,
41:58
but you get a lot of the benefits that you would get if
42:03
you throw all your tickets in there and you do a
42:04
consolidation. And plus, by the way, what if
42:07
you do a consolidation and the company you happen to
42:10
consolidate around happens to go away?
42:14
You know, like then you put all your tickets in there, you spend
42:16
a bunch of money. Those projects are high risk to
42:19
begin with, but then what if you'd been on the wrong horse,
42:22
you know? So I think that's the benefit of
42:25
the fabric approach. Yeah, that's where standards can
42:28
actually insulate somewhat from, you know, decisions that might
42:31
otherwise be costly. And that's something that I'm so
42:34
glad that it turned out. Identity needs standards more
42:38
than your average IT situation seems to, you know, to solve
42:43
some really important problems. You know we came up with cross
42:46
domain single sign on and that meant flinging identity
42:49
information and standardized packet format safely and
42:53
securely and like once we managed to do that like a whole
42:56
bunch of things started to unroll and and and those were
43:00
really valuable things. So you know identity has has had
43:03
this tight relationship with standards that I think helps
43:07
that situation. I hope it helps that situation
43:10
well. There's a natural affinity, I
43:11
feel like, for identity and identity standards, it just it
43:14
makes so much sense. It makes things the promise of
43:17
things being easier. It's not always the way in in
43:19
the real world and mergers and acquisitions are always a pain.
43:23
I don't know if many companies that actually have an identity
43:25
strategy for mergers and acquisitions, some do I'm sure.
43:29
But a lot of the ones that I talked to are, yeah, we we
43:32
bought this company and Identity was sort of like it's just going
43:34
to come along and we'll figure it out as we're going along and.
43:38
10 years. Later, they're still figuring it
43:40
out. Yeah, that's where the 14th repo
43:42
and the 15th repo come in. Like, yeah, we fired that many
43:45
companies. Yeah, how many domains do we
43:47
have on our actor? OK, just checking.
43:49
All right, cool. I want to go back in the past
43:53
because I feel like you've got an opportunity here to do sort
43:56
of a, you know, what's changed? A a few months back, June 2022,
44:04
we had an episode where we asked a whole bunch of really smart
44:06
people, yourself included, what's the difference between
44:09
digital identity and identity and access management?
44:11
We got like 10 different responses and 10 different
44:15
answers. Nobody answered it the same way.
44:18
Most people, I think we're sort of on you know generally in kind
44:22
of the same direction and our friend Adam Michael from one of
44:27
the higher education institutions out there had a had
44:30
really the only significantly different answer where he was
44:33
flipping the DI and the IEM kind of components.
44:36
So what I want to do is we've got you here.
44:39
I'm going to play what you said about you know a year and a half
44:43
ago roughly and we'll see you know has has the thoughts
44:46
changed as there are things you want to add or remove to it and
44:49
things like that. So let me play that now and then
44:52
I will get into it. Identity language has been a
44:54
contentious subject for a long time.
44:57
Thinking back to the beginnings of IIW, the Internet Identity
45:01
Workshop, the original effort by that community was to actually
45:05
develop a lexicon, A comprehensive lexicon.
45:08
It was tough going then, and I think it's always tough going in
45:12
this area. How I see digital identity as a
45:15
phrase is that it applies to the users of or the interactors with
45:21
identity technology. And I see I am as being about
45:27
the implementation of identity technology in whatever guys.
45:32
So when it comes to digital identity, the kind of the user
45:34
perspective, you know, most people interact with identity in
45:38
a way that actually isn't all that pleasant.
45:40
Identity theft is probably the first thing that comes to mind
45:43
and a lot of times that interaction is actually in an
45:46
offline fashion versus an online runtime.
45:50
Authentication for example fashion when it comes to IAM,
45:55
that term itself is is a bucket for a lot of other different
45:58
things and sometimes they overlap with IAM and sometimes
46:01
they may be a little bit apart. So identity management kind of
46:04
life cycle considerations, access management, really all
46:08
the runtime considerations and also governance and
46:11
administration which gets into the world of really operational
46:16
things. And there's this phrase that I,
46:17
I really like lately bolts, which is business, operational,
46:21
legal, technical and societal. So that's kind of the game that
46:26
you get into when you talk about both the the above the water
46:30
user considerations and the below the water implementer
46:33
considerations. One of the things that I find
46:36
when I just talk with ordinary people out there who don't do
46:39
what I do about what you could call the jobs to be done of
46:44
digital identity is that all of the the the things people expect
46:49
to get from this sort of technology, it cross cuts what
46:53
things businesses want as well. You don't have a new Venn
46:56
diagram about this where I think in terms of protection and
47:00
personalization and payment and people.
47:03
So there are unique needs among all of those categories and they
47:07
cross cut quite a lot of things like achieving security is
47:11
actually something that's welcomed by people and by
47:15
businesses. It applies across all of the
47:18
identity language. So that was Eve, that was you,
47:21
circa 2022, referencing Venn diagrams.
47:25
We had bolts, a whole bunch of different things, I guess.
47:29
What are your reactions to hearing that now, a year and a
47:31
half later? Do you feel like, yeah, you're
47:33
generally still in the same boat?
47:34
Have things changed? Do you want to create a Venn
47:37
diagram about it? Like what are you what are you
47:38
thinking? Yeah it's always weird other
47:41
than it's always weird to hear myself I don't know in a
47:43
recording. You know, I I think I agree with
47:47
myself. I I I do think it's useful to
47:50
remember who cares about what. And so you know I I don't hear
47:57
anybody out there who doesn't who isn't in IT ever say IAM not
48:02
once. They don't even know what it is.
48:05
And if you say IAM and you know those letters and and that
48:08
order, people are like, oh, you're so technical.
48:11
And that's like not even a half of it, right.
48:13
Whereas practitioners and technologists in the field
48:17
readily know it. And like if you, if you look up
48:19
sort of, I don't know, cybersecurity forums, they're
48:22
starting to sort of recognize I am.
48:24
So it seems like it's specialist terminology and I think it's
48:27
useful to just remember, you know, thinking of machine
48:31
identity. At the end of the day, it's some
48:34
person who's going to be, whose life is going to be impinged on
48:37
because of this stuff and we should keep them in mind.
48:39
I mean, you know, that's kind of where we started this
48:41
conversation talking about Phil's book and meta system,
48:44
things like that. So the one thing that I I guess
48:47
I would sort of add on top is there's all these new acronyms.
48:52
I mean, I am is just the start of it.
48:54
And recently I posted this thing on LinkedIn, which was not a
48:59
Venn diagram, though you know, if you squinted, you might think
49:01
it is. And it was basically the reason
49:03
why I put it together was trying to figure out what the heck do
49:06
people really mean by ITDR and ISPM in particular, which is
49:11
identity, security, posture management.
49:13
And like, all right, let's sort this out because there's been a
49:15
lot of contention about ITDR like, do we need a term for
49:19
this? Like what's the difference?
49:20
And so I plotted them against the NIST Cybersecurity framework
49:23
and came up with a place I was happy to happy to be at.
49:27
But, and so that's kind of a newer thing in the picture.
49:32
In the last year and a half, ITDR was something that went
49:35
from sort of Gartner being kind of put on the spot to defend it
49:39
as a term to people starting to lean into it.
49:43
And then an interesting thing came out of that comment thread
49:46
which was around this whole notion of well recover is the
49:48
last sort of stage in that cybersecurity framework and
49:52
where's the identity acronym for that.
49:55
And we did have a couple of folks saying, hey, I do identity
49:58
resilience and I consider that to be part of the recover
50:00
bucket. Like do you call it IR, Do we
50:03
need a new acronym? We don't have enough acronyms.
50:07
There's one thing the identity industry is good at.
50:10
It's creating acronyms and creating confusion for people
50:14
who are not in the identity space.
50:17
Well, you have to keep link. Call it if you don't know.
50:20
Yeah. That LinkedIn post that you
50:22
talked about Eve was what triggered me to check to say,
50:26
hey Eve, Are you ready to come back on the podcast?
50:30
Yeah, it was a really no, it was a really good post.
50:33
I kind of feel like, you know I keep going back and forth on
50:37
this topic of digital identity versus identity access
50:41
management and I find myself using the term based more on the
50:47
audience that I'm speaking to. If their point of reference is I
50:51
am, I use the term I am. If their point of reference is
50:55
digital identity, I use that. I think you're right that I
51:00
think people who are more technical or more close to
51:03
technology, they're going to say I am, unless I think if they're
51:11
outside of what we, what we think of as like identity
51:14
governance, access management or even just cybersecurity.
51:19
If they're thinking in this bigger picture like we talked
51:22
about with the identity meta system, they're probably
51:25
starting to think more digital identity.
51:27
They're thinking kind of like big time strategy of like how do
51:31
we take the identity and make it you know like an enabler for us
51:38
and our products and our approach to our customers,
51:41
they're more likely to reference digital identity.
51:44
I I still think we're though dealing with goes to one of the
51:49
comments I made earlier I still think we're going going back
51:52
where some people were like oh identity, identity.
51:55
People love to throw in terms like zero trust identity and
51:59
like I, you know this person can have 15 identities in in our
52:04
directory it's like no that that's not 15 direct 15
52:07
identities there's one identity it's the person we got 15
52:10
accounts. And so I still think we can get
52:14
dragged back into the mess of like, that's not an identity.
52:18
You know Jim, I think I'm going to accept your friendly
52:22
amendment here because when I was doing the work when I was at
52:27
Ford, rock around what we called embrace the future of identity
52:30
there is that just the I word plain, it really was about
52:34
business strategy and about this nice formulation that I really
52:40
believe in this. You're protecting, you're
52:42
connecting, you got to respect individuals as well.
52:46
So protect, connect, respect. So once you're at that level
52:49
you're really talking business strategy and values.
52:52
And at that level I think identity, digital identity is
52:55
absolutely the right word or phrase to use.
52:59
And it does seem like that is much more a a topic of
53:02
conversation lately among folks who can make a difference.
53:05
So that's good. I think context matters.
53:09
My position really hasn't changed over the last year and a
53:12
half. I think it is context.
53:14
Who are you talking to? How do you, you know, resonate
53:17
with them and help them understand whatever is you're
53:19
trying to articulate? If it's I am great.
53:21
If there's no identity, great. If it's identity, great.
53:24
I mean I think there's there's a lot of border lines there who
53:27
you're talking to. I think you need to make sure
53:29
you tailor your communications to make sure that it's
53:32
understood. Because then there's a
53:34
difference between, you know, talking to someone and actually
53:37
having a conversation where it's actually being understood and
53:40
recognized. And there's a two way St. there
53:42
where there is actual communication being shared
53:45
rather than just throwing up on a billboard that you may or may
53:47
not consume or you remember after you drive past it.
53:52
This has been a great conversation and I and I'm I'm
53:55
always happy to connect you to Eve.
53:56
I know your time is precious, so I want to shift over to a
54:00
lighter note and start to wrap things up.
54:02
And I gave you AI gave you a few choices before we hit record and
54:07
the consensus in the room was to go down the route of aliens.
54:10
So just for the record, that's how it started.
54:13
Do you believe in aliens? Why or why not?
54:17
You know, until you posed the question, I hadn't really
54:22
seriously given a thought. So they're not.
54:24
Top of mind all the time for let.
54:28
Me show you my whiteboard and all the.
54:29
All the strings of the Venn diagram.
54:34
I I think I believe in aliens because of the law of large
54:38
numbers. And to somebody else, we're the
54:41
aliens and they're probably wondering, but do they deserve
54:44
to be considered to have identities?
54:47
Are they, You know, they're not us.
54:49
We don't even know if they're sentient, so.
54:53
Yeah, they might not be human. Like, what does human mean?
54:56
Maybe they're robots. I once I I mentioned this to
54:59
somebody once I had the good fortune to happen to sit next to
55:03
Esther Dyson on a plane ride and we got to talking.
55:05
I was reading some science fiction thing which as I
55:08
mentioned to her explored the classic science fiction question
55:12
what does it mean to be human? She's like that's also the
55:14
classic philosophical question. So that was quite the
55:18
conversation. I could tell you that that is
55:21
that is the question. So yes, I I believe.
55:25
Jim, how about yourself? Do you believe in aliens?
55:29
I don't have a black and white answer to this, but have you
55:32
guys heard of the Fermi principle?
55:35
Educate us. OK.
55:37
Or the Fermi doctrine or whatever is called.
55:39
But the question becomes, if there are aliens, why haven't
55:44
they shown themselves to us before?
55:46
And so I think that's an interesting question.
55:50
I also think the size of the universe, if our laws of the
55:55
universe are actually correct. So we believe that speed of
55:58
light is the fastest that you can travel, right?
56:02
And we have a pretty high confidence that there's not
56:05
intelligent life like within a couple of light years of us.
56:10
You know, you're talking like thousands of light years.
56:13
Someone would have to travel to get to us.
56:16
Now, if you could travel faster than the speed of light,
56:19
potentially you could come from a different Galaxy and find us.
56:24
There could be other life in the rest of the Galaxy.
56:28
I mean we're tiny, tiny speck in our own Galaxy and there are
56:34
thousands of galaxies. So I mean law of large numbers,
56:39
he's probably right. There probably is life out
56:41
there. But the the Fermi principle is
56:45
like, OK, well, if there were, then why haven't they shown
56:49
themselves to us? And I think that is a good
56:51
question. So I don't know.
56:54
I'm with Eve on this one. I I think the universe is so
56:58
large and so vast. It's a sheer numbers thing.
57:01
There has to be just something out there now how you define it
57:05
I think is over interpretation right.
57:07
I think it could be anything. If you watch a Star Wars movie
57:11
any of those things could be in there or not or others.
57:15
You know Fifth Element has a ton of them you know maybe they look
57:18
like Li Lu and she's just yelling multi pass across the
57:20
universe and no one understands it.
57:23
But I do think it's the number game.
57:25
It is look like like we're just this insignificant speck of dust
57:30
in this enormous space. The odds are I feel like there
57:35
is there has to be something out there.
57:38
Now Jim you put out this idea of a law.
57:40
Haven't they shown themselves to us what if we are the most
57:44
advanced living thing in the whatever We haven't even escaped
57:51
our own really, you know our own solar system really.
57:55
You know, we sent probes and things like that, but we're
57:57
still trying to figure out how to get to the moon and Mars on a
58:00
consistent basis. So maybe there are is other life
58:03
out there, but we are the most advanced and we just haven't
58:06
gotten you know, we haven't got to that point yet and the other
58:09
potential, you know entities out there haven't gotten there or
58:13
maybe we're so insignificant we don't register for a super
58:17
advanced race, right. We're like ants to them.
58:19
It's like that's not living. Those are just insects.
58:23
This conversation is putting I am into so much perspective for
58:26
me right now. Right.
58:28
We'll need to come up with different personas.
58:30
I volunteer we either use the, you know, Star Trek, Star Wars
58:34
or some other, you know, key, key sci-fi film.
58:37
I love The Fifth Element. So maybe we could do something
58:39
on that, Like what are the elements of identity and try to
58:42
do like some cross intergalactic species, Persona, Venn diagram,
58:49
there we go. Like something like that.
58:51
I don't know but. You're on A roll today.
58:53
I know I am. It's probably it's it's probably
58:56
because it's the middle day and I still have energy rather than
58:58
trying to record at night. And I and I've been home for two
59:01
whole days, so that's also helpful.
59:04
But I do think it is I I to me it's a numbers game.
59:06
I think there just has to be something out there.
59:09
Whether or not we could even recognize it as life in quotes
59:14
is a totally different question. But I feel like it is a numbers
59:16
game. So I think we're all in the same
59:19
kind of picture here. I think even I are closest.
59:22
Jim is maybe a step behind in the Yes, there is, but there's
59:27
some caveats. I don't know, Jim.
59:28
You're shaking your head a little bit.
59:29
I haven't even ruled out simulation theory, OK?
59:32
Oh my gosh. Yeah.
59:34
Which? Means we're living in a big
59:36
video game in AI from some previous civilization.
59:42
So. Yeah, I mean, yeah, I I'll put
59:44
it, you know, we're all on our phones.
59:46
We're in. Our Apple visions.
59:48
Our meta quests were in realities inside of other
59:51
realities. There's a whole Inception thing
59:53
going on. I don't know.
59:54
I feel like this is definitely heading in a direction that I
59:58
don't know if I want to take it conversations, but I'm not
1:00:00
prepared for it. Let's go ahead and wrap it up
1:00:03
there. Eve, thank you so much for
1:00:05
being, you know, part of the show over the years and coming
1:00:07
back and continually talking to us even though we get into weird
1:00:10
topics like this. That's.
1:00:13
Why I keep coming back? I'll have links in our show
1:00:17
notes for people to catch up with EVE on LinkedIn.
1:00:20
Learn more about Ven Factory Ven factory.com.
1:00:24
I'll find that link for Eli's Celebrate your Technical Debt.
1:00:28
Throw that into our show notes, and then yeah, we'll have links
1:00:31
to our discounts for both Identiverse and Identity Week.
1:00:34
America hope to see people at both of those.
1:00:37
By the way, that discount code for Identity Week works across
1:00:41
the world. So the same code works for both
1:00:43
Europe, America and the Asia conferences, not just America.
1:00:47
So we're most likely not going to be at the international ones
1:00:50
for us. But you can still take advantage
1:00:52
of that discount code IDAC 30, and then we'll definitely be an
1:00:55
Identiverse IDV 2 four dash. IDAC 25 just rolls off the tip
1:00:59
of the tongue super easy. That's why we'll have a link in
1:01:02
our show notes and you can check it out there.
1:01:05
So yeah, we'll have links for that.
1:01:07
Follow us on the web, idacpodcast.com, Twitter, X,
1:01:12
whatever it's called. By the time you listen to this
1:01:14
at IDAC Podcast and Mastodon at IDAC Podcast at Infosec, dot
1:01:19
exchange, connect with Jim and I like subscribe all those fun,
1:01:24
you know, social things that helps us out and send us
1:01:27
voicemails so we can do more shows just like this.
1:01:29
If it's not something Jim and I are qualified to answer, we will
1:01:32
bring in someone who is. So that's how that'll work.
1:01:35
So appreciate everyone for listening and we'll talk with
1:01:38
everyone in the next one. You've been listening to
1:01:42
Identity at the Center. We hope you've enjoyed the show.
1:01:46
Make sure to like, rate and review and we'll be back soon.
1:01:50
But in the meantime, hit the website at
1:01:52
identity@thecenter.com and find us on Twitter at IDAC Podcast.
1:02:00
See you next time on Identity at the Center.