Latest / Identity at the Center / #266 - Identity Wallets with Nick Mothershaw of The Open Identity Exchange

Transcript

#266 - Identity Wallets with Nick Mothershaw of The Open Identity Exchange · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity at the
0:23
Center podcast. I'm Jeff and that's Jim.
0:25
Hey, Jim. Hey, Jeff, how are you?
0:27
Oh, not so bad yourself. Good, good.
0:29
You know, for today I thought I'd talk about a question that's
0:33
come to me a couple ways. You know, one of the things that
0:36
I want to point out first is that there's a lot of ways to
0:38
get in contact with us, right. We have the voicemail feature on
0:41
our website idacpodcast.com. We have a listener questions and
0:47
then of course we're both very reachable on LinkedIn in terms
0:51
of sending DMS or whatever. But I've been getting the
0:55
question get this about remember we had Ryan Galuzzo on from NIST
1:01
a few weeks back and he talked about 800-63 and everything
1:05
that's going on with that. I had the same question twice,
1:08
which was, does this only apply to humans or can I also apply
1:13
800-63 to service accounts? Well, I guess the question
1:19
whether or not you can, you can do whatever you want to do,
1:23
right? But I actually forwarded this
1:25
question on to Ryan because he's the expert and he got back to me
1:29
saying that 63 does not cover service accounts, it only covers
1:35
identity and authentication leveraged by human users.
1:38
Then he goes on to explain that essentially the psychology
1:41
behind 63 is that they wanted to get away from some of the
1:46
draconian controls. I'll call them.
1:48
He didn't call them that. I call them that Because what
1:52
you're trying to achieve is avoiding the human psychology
1:56
behavior of, oh, this is hard to do, so I'm going to come up with
2:00
an easy password. When you're dealing with service
2:02
accounts, you're not. You're not dealing with that
2:05
psychology issue. So do without what you want.
2:10
But 63 was not meant for non human users.
2:14
OK, well, that's good information.
2:15
Kind of share it there. I guess people can take that and
2:18
do whatever they want with it for sure.
2:21
I guess, you know, a lot of organizations they look at in
2:23
this guidelines and that's like gospel.
2:25
It's like the letter of the law. And I think it sounds like
2:28
they're more moving to theory and intention rather than true.
2:33
Like, like you said, Draconian, you know, thou shalt must do
2:37
this, like this. You know, as long as I think
2:39
you're doing the right thing from a security standpoint and
2:41
definitely from an identity standpoint, that's probably more
2:44
important than some arbitrary, you know, if this, than that
2:48
type of statement. Yeah, I mean, look, having like
2:53
black and white guidelines sure makes things easier.
2:56
Unfortunately, in the identity space there's not very many
2:59
black and white guidelines. Only interesting on absolutes,
3:02
Jim. Only the Sith deal on absolutes.
3:04
That's right. And you know, on the ID Pro
3:08
Slack channel, Ian Glazer put out a question or a topic.
3:13
He's like, this is going to get things going, and it was about
3:16
moving from least privilege to 0 standing privilege.
3:20
And I'd looked at it like I I caught up with the thread a few
3:25
days after he posted there, already over 60 comments, and it
3:29
was like it really got people thinking.
3:33
And again, there's not one right answer.
3:37
Oh, a shout out to Jim Morton too.
3:38
We had him on from Britt of way back when and that's I think
3:41
when I first kind of started to think about the 0 standing
3:44
privileges as he brought it up. That was like in the hundreds.
3:47
Fergus says it were like 260. I think this will end up being
3:50
266. So it's been a while, but I like
3:54
the idea. I'm I'm still a fan of 0
3:56
standing privileges. I think it's great.
3:57
I really kind of classified under some sort of attribute
4:00
base access control and having a dynamic switch based on whatever
4:04
attribute says that you need this privilege the 2nd and then
4:07
removing it when you no longer need that privilege.
4:09
But I still think it's a very long hard goal to get to for
4:13
organizations if they don't have technology.
4:17
Because I think the key part of 0 standing privileges is
4:19
automation. I think the 0 standing
4:21
privileges idea makes a ton of sense, but I don't think it
4:26
means you don't use loose privilege.
4:28
I don't think they're exclusionary right?
4:30
The you should have 0 standing privileges and then when you get
4:34
those privileges just in time that you need them, they should
4:37
only be the amount that you need to get the job done.
4:41
And so it's like you need both. And then the other thing is, I
4:46
don't think 0 standing privileges ever gets you to the
4:48
point where it's like you know all of your 10,000 accounts or
4:52
whatever you have. None of them have any privileges
4:55
on them, right? You need to have some point
4:58
where it's like, OK, that's just not important enough to use zero
5:01
sending privileges because there is administrative overhead to
5:05
it. The good thing about talking
5:06
about this in a podcast form is that we get to go back and forth
5:10
and nobody gets to comment in real time and argue with us so.
5:16
And why welcome it? Argue.
5:17
Bring it back. Like if there's something we say
5:19
that's you don't agree with, let us know on LinkedIn.
5:21
We're happy to have a discussion.
5:22
I think that's a great thing about opinions is they can
5:25
change over time, right? It's OK to get smarter.
5:27
Here's what I think right now. You know, I'm like that that
5:30
that meme or that, you know, that image.
5:32
Feel free to, you know, change my mind.
5:34
Let me know what you think. Yeah, definitely true.
5:38
So I I really wanted to send this weekend productively.
5:41
Instead I went down to YouTube rabbit hole on Las Vegas buffets
5:46
because I was like, OK, I'm going to have a free day there.
5:50
I want to go to a buffet. Normally I go to the bacchanal,
5:54
which is at Caesars, right, Just like.
5:56
But I've been there so many times.
5:57
I'm like, OK, well, I wouldn't mind reliving that experience,
6:01
but I wonder what else is out there?
6:03
What are the insiders really want?
6:05
And so I just watched a ton of videos and I'm not going to the
6:08
bacchanal, by the way. I'm going to the Wynn, which is,
6:11
you know, a lot of people say that's like the number one
6:15
buffet on the strip. That's way north, too.
6:17
That's the, I mean, you're going to have to.
6:19
That's either a long walk or you're going to hop in an Uber
6:21
or Lyft or something. Yeah, but I also got tickets for
6:25
the sphere, so the men and the sphere are right next to each
6:29
other. So it's going to be the sphere
6:30
experience, which what I didn't realize when I booked it, it's
6:33
like $80.00 for not that great of seats that off to the end,
6:38
but it's only a 15 minute show. Oh, that's it.
6:44
Like the the Postcard from Earth is only a 15 minute show.
6:47
Again, that was in my my rabbit hole of Vegas.
6:50
Things to do and buffets etcetera.
6:52
It was, you know, I watched a few videos of, like, what that
6:55
experience was like. So you watch videos about food,
6:58
and then you watch videos about watching other videos in a giant
7:00
sphere. Yeah, it was an exciting
7:03
weekend, man. Really exciting weekend.
7:05
But I am looking forward to Vegas.
7:06
We are going to Vegas at the end of May.
7:09
Yeah, we're going to be there for Ideniverse.
7:10
So looking forward to that. Ideniverse, if you haven't
7:13
heard, May 28th to the 31st. It's at the Aria Resort and
7:17
Casino in Las Vegas. We've got a discount code for
7:20
our listeners and anyone else who wants to use it.
7:23
That code is IDV 2, four dash, IDAC 25.
7:27
Don't worry, we'll have a link in our show notes.
7:28
You can just click on it and it'll give you 25% off of your
7:32
registration. It does stack with early birds.
7:34
So I think there's still early bird discounts going on right
7:37
now. Feel free to use and abuse it.
7:39
It's a good way to show support for the show.
7:41
But yeah, looking forward to that Cool thing too is you get
7:44
20 CPS by showing up, which is awesome.
7:47
You and I have to worry about CPS for the firm that we work
7:49
for. So it's always good, right?
7:51
You get kind of credit for being there, things like that.
7:53
So if that's interesting to you, definitely check it out.
7:57
But yeah, Identiverse. And again, we'll have a link in
7:58
our show notes. And then the other conference
8:01
that we're going to be at is Identity Week.
8:03
We'll be at the Identity Week, America.
8:05
There's also Europe in Amsterdam, which is June 11th to
8:08
the 12th. The America ones in Washington
8:10
DC, September 11th and 12th, that's where you and I will be,
8:12
Jim. And then Asia, Singapore, that's
8:15
October 22nd, 23rd, yet another discount code.
8:18
So thanks to the organizers for helping us out with that.
8:21
That one is easier to remember. IDAC 30, you got 30% off.
8:26
Again, we'll have a link in our show note for that one as well
8:28
for people to check out. But looking forward to both
8:31
those conferences. I know that we're going back and
8:33
forth with each, trying to figure out, you know, what kind
8:36
of presence we'll have and where, but we'll be doing our
8:38
thing regardless. Podcasty things, as I like to
8:40
say, recording episodes and stuff like that, and looking
8:44
forward to seeing familiar and new faces who have discovered us
8:47
within the last year since we've been there.
8:49
So we'll get forward to that for sure.
8:50
Anything that I missed there, Jim?
8:53
No, I think you know the only thing that you mentioned like
8:56
we're we're still trying to iron out plans, but we'll we'll be
8:59
there and we'll have opportunities for people to
9:02
engage and you know view a podcast in in like real life or
9:08
maybe even much more than that. What's more, what's more than
9:11
real life? Well, we might be on stage like
9:15
we were on stage at a few conferences last year, right.
9:17
So that's the the full on experience.
9:22
Yeah. And we're talking like, I'm
9:23
talking like a Las Vegas thing. It's a full on experience.
9:27
We at the sphere, so we need identity at the center at the
9:30
sphere, and there you go. I tend to get the sphere, you
9:33
know, I don't think we get $80.00 for.
9:37
Yeah, we have to pay people to show up for that one, that's for
9:38
sure. No, it's exciting.
9:40
It's it's good times. We'll we'll figure something
9:42
out. We'll we'll be at those
9:43
conferences. We'll be at Authenticate later
9:45
this year as well. So those are things a lot of
9:47
fun, lot of, a lot of touch points to people and be able to
9:50
kind of meet and talk and just, you know, hang out and have a
9:52
good time in a good casual conferency way, that sort of.
9:56
Thing. No, it's it's my, it's my
9:58
favorite part of work is like getting out there and going to
10:02
conferences and and meeting people and socializing and like
10:06
I said, I've got a a new jacket. I'm going to play it for the
10:10
first time at a dinner verse. And you know, a lot of times I
10:14
wear these jackets a few times and I don't have to retire them
10:16
because I feel like I already did that.
10:20
Well, I'm looking forward to it. So you're definitely the
10:23
flashier dresser. I tend to fly a little bit on
10:24
the radar, look kind of normal in quotation marks.
10:27
We're going to have a conversation today about
10:33
wallets. And I was thinking about like
10:35
what we would call this show. And I was thinking it was like
10:37
kind of the old riff on, you know, what's in your wallet.
10:39
But we actually have an episode already called that, like way
10:42
back in the day, we talked a little bit about that a long
10:46
time. He think it was like episode two
10:48
or three or something like that. So we're going to talk about
10:51
wallets. More of the digital identity
10:53
wallet type of thing is what I'm thinking.
10:54
So digital wallets, smart wallets, roaming wallets.
10:58
Very happy to announce that we have on our show today Nick
11:01
Mothershaw, He's the chief identity strategist at Open
11:04
Identity Exchange. Welcome to the show, Nick.
11:07
Hello. Hi, Jeff.
11:08
Hi, Jim. Thank you for advising me on
11:10
today. Pleased to be here.
11:11
Yeah. Thanks so much for joining us.
11:13
And you're joining us from, I'm imagining the UK it sounds like
11:16
from from that accent and from the time zones that we're
11:18
dealing with. Where in the UK are you and am
11:20
I? Am I correct or are you
11:21
traveling at the moment? You are correct.
11:23
So I'm in the Uki live in the UK.
11:25
I'm in a place called Derbyshire, which is in the
11:27
middle of the UK. It's mostly a National Park.
11:29
It's a beautiful place to live. That sounds awesome.
11:31
I was there last year. We watched the Chicago Cubs play
11:34
the Saint Louis Cardinals at London Stadium, got to partake
11:37
in the city first time. I've actually been in London and
11:40
it was awesome. I loved it.
11:41
I will go back in a second. But we're not here to talk about
11:44
London and UK. We're here to talk about
11:46
identity and one of the things that we like to do is when we
11:48
have someone on the show for the first time is to really kind of
11:51
understand what their identity origin story is.
11:54
So I'll ask you this, Nick, how did you get into the world of
11:57
identity? Is it something that you chose
11:59
or did it choose you? I guess it chose me in the late
12:03
90s. I find my myself working with
12:05
law enforcement and what I was doing was what we'd now call
12:10
identity resolution and identity graphs.
12:13
So we were looking across intelligence reports, crime
12:16
reports, trying to make links just around the ID element, but
12:20
around location. So we were doing a lot of smart
12:23
routines to try and, you know, make connections for the police
12:27
to help them solve crime. So that's where I started and
12:30
there's part of that journey as well.
12:31
I came across biometrics, so we were using biometrics way back
12:35
in 2000. We were using them to monitor
12:37
football crowds, to look for hooligans in the Netherlands
12:41
when during EUR 2000. So that was always law
12:45
enforcement. I I moved from there to look
12:48
more, narrowed my focus to look at fraud.
12:51
And so I did a lot of work on fraud detection, fraud
12:54
prevention. So they did the Hunter 2 system
12:59
from Experian that she was all around the globe to detect
13:01
fraud. That was one of my creations.
13:04
Apologize to anyone who's still using.
13:06
It's up to nearly 20 years ago now but it's still out there and
13:11
from there moved into identity. So you know fraud and identity,
13:14
two sides of the same coin really.
13:16
So you know with to mitigate fraud, we started looking at
13:20
positively identifying the individual rather than looking
13:23
for the anomalies that indicated fraud.
13:24
And then you put the two things together, you've got a much more
13:27
robust set of fraud control. So that's how I ended up in
13:29
identity and by the kind of late 20 tens, 2015, sixteen, I
13:35
started to get involved with the open identity exchange.
13:37
I was running and operating EU KS only interoperable digital
13:42
identity ecosystem where you could use the ID to run log into
13:46
government and to private sector as well.
13:48
And around 2020 kind of left my corporate existence and moved
13:54
into work with the open identity exchange.
13:56
But for most of my time to help, you know, drive the forward,
13:59
this this cause of digital identity.
14:02
I guess, hey, that's a great back story.
14:05
I I guess I'm not for for people who aren't as familiar with open
14:08
identity exchange and we might refer to it as OIX.
14:11
You know, throughout the show here you kind of talked about
14:14
the interoperability, but can you just tell us a little bit
14:16
more about what the open identity exchange is, you know,
14:18
what's the purpose? Yeah.
14:20
Who are members? Is it, is it firms, is it
14:23
technology kind of side of things?
14:25
Is it normal people in quotation marks?
14:28
Tell me a bit about the organization.
14:30
Yeah, we're a members organization.
14:32
We're not-for-profit. Our vision is that we can all
14:35
have a an identity, importantly A reusable identity, reusable
14:39
digital ID is what we focus on and then we can use that
14:42
anywhere around the globe so that I can have an identity as I
14:46
travel around that is trusted, which is interoperable all over
14:50
the world. And that's our, that's our lofty
14:52
vision. That's a vision we set out
14:53
around five years ago and you know we're making good progress
14:56
towards achieving that. It's a bit like when Microsoft
14:59
said a computer in every home was their vision.
15:01
There was no, no, you're never, you're never going to achieve
15:03
that. We know we're going to achieve
15:06
ours, but it's going to take a little time.
15:08
But we're we're making good progress on that.
15:10
So who are the members? And so we have Microsoft, we're
15:14
a big member, Visa, MasterCard, people like Lexus, Nexus,
15:19
Barclays Bank. So they are the corporations who
15:26
are have a stakeholding in the evolution of identity.
15:29
We have a lot of identity component suppliers who are
15:32
supplying authentication services or proofing services,
15:36
digital identity providers who are now starting to emerge in
15:39
the market. So we've got around 70 members,
15:42
all of whom are subscribing to that vision of creating reusable
15:46
digital identities and ultimately that can be used all
15:49
around the globe. Nick, I think one of the the
15:52
biggest challenges that we face as technologists is explaining
15:55
to non technology people like our parents or other folks who
16:00
are not in the industry what we do, right.
16:02
And I think the idea of digital wallets or wallets, you got kind
16:08
of everybody knows what a wallet is in, in the traditional world.
16:11
So do you ever wind up comparing and contrasting the two of
16:16
those? Oh yeah, yeah.
16:17
It's very difficult to explain here what's the concept of a
16:20
digital identity. And it's hardly the most
16:23
scintillating subject for for most people.
16:25
I mean, no, nobody, nobody woke up this morning anywhere in the
16:28
world and thought, hey, I'm going to go get me additional
16:30
identity today. That's not what people do.
16:33
Using the Wallace analogy helps explain what we're trying to
16:36
achieve to not just to end users but also to corporations as
16:42
well. So what we're trying to do is
16:43
enable people to digitally prove who they are and what they're
16:47
eligible to do. So it's not just about the
16:49
identity proofs, but it's about, you know, can can they be
16:52
employed, can they get on this plane.
16:54
So the the wallet analogy is, is a good way for people to
16:56
understand that. It might just be an analogy as
17:00
we move, as we move forward. We're using the word wallet
17:02
today. It works well.
17:05
The end users can get their head around that.
17:08
It's it's got a good analogy to what they're doing in the real
17:11
world. So for now it's it's a great way
17:14
to explain what we're doing. Yeah, I kind of think it's funny
17:17
like you still see the image of a floppy disk.
17:21
That means you want to save a document.
17:23
But a lot of people have grown up in a world where they never
17:27
use sloppy disks. So the idea of like the term
17:30
wallet, at some point maybe some folks will never have had a
17:35
wallet. Very possible, because I think
17:38
most people, if you interview them, would you rather go, would
17:41
you rather leave the house without your wallet or without
17:44
your phone? They probably would choose the
17:47
wallet. They'd probably rather have the
17:48
phone. Most, most young people don't
17:50
don't have a wallet, you know, So my kid, I've got three kids
17:53
in their 20s. None of them would leave home
17:55
with a wallet. They have their phone and on
17:57
their phone they've got their payment device and as long as
18:01
they've got that, they're fine. They don't carry anything else.
18:03
They don't think they need feel, they need to carry anything
18:05
else. So, So I think you're right.
18:09
In 20 years time we'll have a whole generation of people who
18:13
are, who are my age, who have never actually carried a wallet.
18:16
Yeah. And the whole idea around
18:20
credentials and the wallet, I mean, those are two different
18:24
concepts as well. Can you kind of explain the
18:26
difference between those two? Yeah, sure.
18:29
And let's use the real world example of the wallet that's
18:33
that's in our pockets or purses. So inside there we have payment
18:37
cards, we have driving licenses, we have loyalty cards, tickets,
18:43
those are the credentials and they sit inside the wallet.
18:46
The credential proves something about me with a payment
18:50
credential, it proves I I hold this account and I have the
18:54
ability to initiate a payment from it with a driving license.
18:57
It's really there to prove that I am able to drive and these are
19:00
my driving capabilities. The passport it's, you know I
19:04
have the capability to travel that my government has, has
19:06
granted me through issuing me that passport.
19:09
And so if we think about the credentials that you know, I
19:13
wanted usually that our physical wallets today but are somewhere
19:17
in our homes. We've got education
19:19
certificates, we've got records of employment.
19:22
All of these can be digital credentials as well.
19:24
So it's not just constrained to watch in our the wallets we
19:27
carry around. It's the credentials that
19:29
explain who we are and what we can do.
19:33
Yes. So kind of in this traditional
19:34
world, we have these wallets that by themselves don't have
19:38
any functionality, they don't have any features, right.
19:41
They just hold the credentials. And I think we're going to talk
19:44
about that upcoming. But I think one of the things
19:48
when you talk about, well, maybe we just hit on that point, so
19:52
the wallets in the real world don't have any features or
19:55
functionality, right? They just are used to hold the
19:58
credentials. Does that analogy carry over?
20:02
Is is the digital wallet essentially the same kind of
20:05
thing, just holding your credentials?
20:08
I think right now it is. So if you think of the the Apple
20:12
Wallet on my phone, other wallets are available that you
20:17
know where I put credentials in there.
20:19
It's it's very analogous to the real world, putting a credential
20:24
in my wallet and lets me store it.
20:27
So I can put it in the wallet and it lets me present it.
20:29
I can take it out of the wallet and show it to someone.
20:31
So it's just it's a storage device that enables me to
20:34
present. It's not actually great at
20:36
presenting things. If you've ever tried to do it,
20:38
it's, you know, you I'd like to generate AQR code or you're
20:43
going to do it through NFC. So the presentation needs a
20:46
little work, but yes, essentially a way to store the
20:49
credentials as we do today. We think that that basic wallet
20:56
model definitely needs to evolve if these things are going to be
20:59
useful to to end users going forward.
21:02
Yeah, and you guys wrote a a paper recently and we'll put a
21:04
link to it in the show notes talking about wallets and
21:09
whether or not governments should be the responsible for
21:13
issuing wallets. I mean, like today your phone
21:16
has a wallet built in. I mean, I have a a wallet on my
21:20
Apple iPhone and it's mostly holding things like my Panera
21:26
customer loyalty number, like 100 ticket stubs from, you know,
21:32
Delta flights and things like that.
21:34
So I don't care who issues the wallet.
21:36
I pretty much just think of it as a feature of my phone.
21:39
But you guys wrote a paper about this, right?
21:41
Should governments issue wallets?
21:43
And what was the conclusion you drew?
21:46
Yeah, we did. And yeah, my, my Apple Wallet is
21:49
very much the same as yours. It's got my, it's got a payment
21:52
card in it, couple of payment cards.
21:54
It's for the rail tickets for me because I travel on the train a
21:56
lot here in the UK. It's got a few flight boarding
21:59
cards, so you know, I'm using them today to collect this, this
22:02
information. And that wallet is coming from
22:05
Apple. The wallet in my pocket today
22:09
comes from a craft shop, you know, here in the Pete district
22:12
where I live in Derbyshire. And I use that to store my my
22:17
wallet. It's interesting, it has, it has
22:19
some security features. So it, you know, it says you're
22:22
not supposed to be able to read my NFC chips through the the
22:24
side of the wallet. So even our physical wallets
22:27
have started to get digital security features built into
22:30
them. Today we were looking at who's
22:34
going to deliver wallets and one of the things we'll come on to
22:38
talk about is we also talk about small wallets.
22:42
So the wallet, this basic wallet we we see today needs to evolve.
22:46
We see governments like the EU embarking on the UD Wallet
22:50
programme. That's a hugely ambitious
22:52
programme which demands each member state deliver to its
22:56
citizens either directly or through private sector partners.
23:01
AUD wallet that can be used to present the cord identity
23:06
information that they're calling the PID and the heart of that,
23:09
and then other information to open bank accounts, to access
23:14
health care services, to access government services all across
23:17
Europe. So it's a brilliantly ambitious
23:20
programme, but it involves the government's delivering wallets
23:24
and it involves the EU specifying heavily what those
23:27
wallets should look like. So we started to explore this
23:30
and contrasting that to the real world analogy today and that the
23:35
government doesn't deliver the wallet that's in my pocket
23:37
today. It's something that I personally
23:39
go out and sort. There are lots of different
23:41
designs, lots of different features and you know, that
23:45
enables users to have choice. And it's independent from the
23:49
government. And what our paper explored was
23:53
the pros and cons of government issuing wallets themselves.
23:57
Wallets are pieces of technology and as they can become smart,
24:01
they're going to become more and more complicated.
24:03
Governments are not great deliveries of technology.
24:07
Yeah, they don't have a great history in terms of delivering
24:10
IT projects, you know, internally, let alone directly
24:13
to their citizens for something as critical as a wallet.
24:19
So it's not in their core competence to do it.
24:21
They won't evolve. So if they say you're right, you
24:24
know, what we fear with the EU is they've set out a kind of
24:26
minimum set of requirements and that's all that will be
24:28
delivered. And then it'll be a fairly great
24:30
wallet. It won't evolve, It won't be.
24:32
Innovative private sector is a much better place to deliver the
24:36
wallets and also private sector then provides a level of
24:39
independence from the government in terms of me having choice of
24:43
where I store my credentials and also some confidence that the
24:48
government isn't watching what I'm doing.
24:50
So if you imagine if you know the US federal government issued
24:54
me a wallet and it sits on my phone and all my credentials are
24:59
in it and every time I prove who who I am, how old I am, share
25:05
any credential that's done from my government wallet.
25:10
People are going to think the government's monitoring
25:11
everything they're doing as much as government will say no, no no
25:15
we're not we're not doing that no, no.
25:17
People will have that privacy fear as well.
25:19
So that was that was another reason that we concluded that
25:22
that governments are not blessed placed to deliver wallets
25:25
themselves. So it's it's it's not about,
25:27
it's not a really long paper. I think you'll provide a link to
25:30
it, you know, in the associated information with this podcast.
25:34
But my conclusion was that you know governments, but they can
25:38
issue wallets. Many of them will issue wallets,
25:40
but they're not best placed to do so.
25:43
Private sector will be more renovative, It will provide
25:46
better privacy concepts to the end user and will be more
25:51
innovative in the long term. Yeah.
25:54
I think the first part of your argument was about the ability
25:58
to deliver, which I can. I can see that point for sure.
26:03
My concern is that I think that the privacy concerns could
26:08
exist, whether it's government or private organization doing it
26:13
on behalf of the government, especially if there's not a
26:17
competitive landscape where, you know, essentially the government
26:20
could just force the private companies to turn over its
26:23
records. Yes, and this is where trust
26:26
frameworks come in. So a lot of the work we do at OX
26:29
is around the trust framework that makes identity be able to
26:34
be trusted by relying parties and by users.
26:38
So part of that framework is the privacy rules that sit around
26:42
it. And we, you know, if we look to
26:44
the framework we publish on our our website and guide to
26:47
frameworks, we look, we've been doing an analysis of frameworks
26:50
all over the globe. And you know, we what we want to
26:52
see in frameworks from a privacy perspective is that the user is
26:57
in control. Yeah, we've heard a lot about
27:00
self sovereign IDs which you know where the user is in
27:02
control. That term self sovereign is not
27:04
very popular in most of the world.
27:06
It implies too much user control.
27:09
You know, we are sovereign citizens of nations and you know
27:14
are afforded a lot of rights and benefits as a result.
27:17
But what the government should be doing is giving users control
27:20
of their data. You know GDPR in Europe supports
27:24
this. The frameworks that have been
27:26
written around the globe, the one in the UK in particular, is
27:30
putting in place user control and user agreement and user
27:33
tracing of everything that happens.
27:35
So the user can clearly see what data they have, where it's gone
27:40
and they can choose to change provider if they wish.
27:41
Portability is a key element to this.
27:44
Now your point though, you know, can the government enact other
27:47
laws to go and pull the data from corporations in many parts
27:51
of the world? Yes, they can.
27:53
That's a separate layer really that sits above what we're doing
27:55
in identity. It's a law enforcement feature
27:58
that countries have put in place to to protect themselves and
28:01
their citizens. Yeah, it's a very complex issue,
28:04
right. So, Nick, you previously talked
28:06
about smart wallets and so smart wallet contracts itself.
28:12
Obviously there there would be a wide difference between a smart
28:16
wallet and a leather wallet, which you and I have in our
28:20
pockets. But in terms of digital wallets
28:24
and smart wallets, what's the differentiation factor?
28:27
Yeah, so the wallets we're seeing today are not smart.
28:31
So the one I find in my phone let's me store credentials and
28:34
let's me present credentials, and usually in a fairly clumsy
28:36
way. If we consider some simple what
28:42
sound like simple use cases, we can expound the need for a smart
28:47
wallet. So MDL was starting to appear in
28:52
wallets around the US mobile driving licenses.
28:57
Two major use cases for that I guess.
28:59
One is you know it's a mobile version of your wallet for law
29:02
enforcement to read. The other one is, can I prove
29:07
I'm over 21 to to buy liquor? That question of over 21 in the
29:14
current mobile driving license implementation uses a data
29:19
minimization principle so that it will only present the fact
29:22
that you're over 21 doesn't present any other information
29:25
about your or at least no more than is needed for that
29:27
particular transaction. So we can go from a credential
29:31
and minimize some of the information from it.
29:34
But if we consider these rules again to get somewhat more
29:36
complicated, let's say I have not just MDL was in circulation,
29:40
but I have digital travel credential passports, I have
29:43
other identity forms of identity, I have bank current
29:47
identity credentials that have come out of my bank associated
29:50
with my bank account. So all of those things could be
29:53
used to prove that I'm over 21 because all of those things, all
29:57
of those providers know I'm over 21 and have checked I'm over 21.
30:00
So the rules for the requests and the wallet start to become
30:04
not I want a driving license and it starts to become, I want to
30:08
know you're over 21. The wallet then needs to know
30:11
how to interpret those rules and know that, well, actually that
30:14
could come from any of these four credentials, but they have
30:18
to have been issued within, say, in the last three months.
30:20
They have to be bound to the user with the right kind of
30:23
authenticators. So you know for face to face
30:26
liquor sales in order to stop me giving my device to someone else
30:30
with my MDL on it, I yeah. One of the rules, and this is
30:34
the rule that's been put in place in the UK, is that you
30:36
must use a biometric authenticator there.
30:38
And then part of the theatre of the presentation is looking at
30:41
the phone, generating the the proof and then showing that to
30:45
the the person who's reading it. And that only lasts for seconds.
30:49
So you can't pass your phone from one person to another.
30:52
So all of these rules then are something that sounds like a
30:56
very simple question. Are you over 21 starts to become
30:59
complicated? If you consider the rules, then
31:02
for for travel the other rules, but we used to use COVID quite a
31:06
bit. How do you prove your COVID safe
31:08
as opposed to you have a vaccine or you have a certificate.
31:12
So the need for a wallet to be able to take these rules,
31:15
interpret them on behalf of the user and then return what is
31:18
being asked by the relying party is critical and that's why and
31:23
where they need to become smart. So it seems like the credentials
31:28
could have dozens, maybe more attributes about you.
31:34
It's the wallet, then, that would have the responsibility
31:38
for which of those attributes to make available and which ones to
31:42
keep private. Those the rules and so this is
31:47
the wrapped around the wallet. There needs to be a rule
31:50
ecosystem. Again, this is where the trust
31:52
framework comes in. So the rules for asking for over
31:56
21 and stating that when you ask for over 21, all you get back is
32:00
an over 21 statement, but it's backed up by biometric
32:03
authenticator need to be defined and then the wallet needs to
32:06
behave in accordance with those rules.
32:10
But we can't allow your wallet providers to define those rules.
32:14
For a start, if there's multiple providers in the ecosystem, it
32:16
will be inconsistent. So a lot of what we do is
32:18
looking at standardization of these approaches for
32:21
interoperability, but also it's setting the rules for good
32:24
practice. I'm glad you mentioned the word
32:27
standardization because I could see us going down this rabbit
32:30
hole again of, you know, blue text versus green text, Android
32:34
versus iPhone and this whole ecosystem play where right now
32:38
people may be stuck in one ecosystem or another and there
32:41
isn't a lot of transportability for some of these things.
32:44
I have Apple Wallet, right, has my, you know, boarding passes
32:48
and credit cards and things like that.
32:50
But if I want to move things to a different wallet, I have to
32:52
set it all up again and things don't talk to each other.
32:56
I think that's to me one of the most critical things to solve
32:59
for is that interoperability, which is why I'm glad things
33:03
like standards are being developed around that to try and
33:06
solve for that. Because what I could quickly see
33:08
is, well, who has the best rule set around their wallet?
33:12
Do the rules themselves need to be abstracted away from the
33:15
actual wallet container that these things might exist?
33:20
Otherwise you end up in the scenarios over here.
33:21
Well, here's the best wallet because it has the rules that I
33:24
like. Well, how is that wallet going
33:26
to talk to another wallet or maybe even another reader or
33:28
things like that? So I'm I'm concerned, but I'm
33:32
happy to hear that it's at least being considered how this is
33:34
going to work together. And what you just on there,
33:37
Jeff, is precisely what we're looking at in one of our working
33:40
groups at the moment. So we were starting to explore
33:43
whether there's actually 2 layers here, whether there is
33:46
the the more storage wallet element, which could be my Apple
33:50
or Google Wallet. And this is where I keep my
33:52
credentials. And you're right, credential
33:54
portability is then really important.
33:55
I can easily move them from one wallet, storage, wallet to
33:58
another. And then we're starting to
34:00
separate out this. That is the smart element of
34:02
this, actually done by some kind of agent, because these rules
34:06
are going to be very complicated.
34:08
They're going to vary by country, They're going to vary
34:10
by sector by country. So it's actually this, this age,
34:14
the specialist agent role in terms of interpreting the rules,
34:18
working out what the user has in their wallet, working out what's
34:21
missing, helping the user get that and helping them to bring
34:23
all that information together to satisfy the requirements for a
34:26
particular transaction. We're starting to think of it,
34:29
you know is that actually such a smart agents alongside the
34:32
wallet and the two things could come together into a smart
34:35
wallet. But that's precisely the kind of
34:37
work OX does and is doing that's we'll be publishing on that in
34:41
May in time for some of the conferences she talked about
34:44
earlier in the in the program. Yeah, one of the things that
34:48
comes to my mind is there's certainly that that use case
34:52
like kind of the simple common use case of RE21.
34:57
Then there seems to be all these different use cases where you
35:00
have to present a credential like your driver's license.
35:04
So a scenario might be I want to go buy a car and I do that once
35:08
in a blue moon, but I have to present my driver's license and
35:13
they pull certain information off of it.
35:15
So are the is there just that blanket scenario where
35:20
everything becomes available or so Is is the rule set by the use
35:24
case? I'm trying to understand the
35:26
rule set and how it applies and how we would deal with these
35:31
infrequent use cases that probably not everything is
35:34
designed around. Yes, the rule.
35:39
The rules are set per use case. So you know, to buy a car, I
35:43
need to prove you know things about who I am, my ability to
35:48
drive that kind of car for instance.
35:49
Then that's the only information that's needed.
35:52
If any convictions or endorsements I've got, they're
35:55
probably irrelevant when I buy a car about my ability to drive.
35:59
So each use case needs to be able to have a set of rules
36:05
written and the wallet needs to be able to interpret those
36:07
rules. So one of the things we've been
36:09
doing is we've analyzed a trust frameworks around the globe.
36:15
We've found that they have a common DNA and we call this the
36:18
DNA of digital identity. They all do things in the same
36:21
way but with different values because frankly countries right
36:26
frameworks have different values that have different views on
36:28
privacy, different views on technology.
36:31
But we found they all do it in the same way.
36:32
And we're now working on something called the Open
36:34
Criteria Exchange tool that would enable a set of rules,
36:39
policy rules and technical rules to be expressed by a reliant
36:43
party to a wallet for the wallet to then interpret.
36:46
So we think this can all be a machine readable format that in
36:51
future the wallet will be able to interpret as it goes from
36:56
place to place. So in addition to smart wallets,
36:59
you also talk about a concept of roaming wallets.
37:05
What are what's the difference now we go from regular digital
37:08
wallets to smart wallets to roaming wallets?
37:11
What's the? What's the difference there?
37:16
And and they're building on on each other.
37:18
So a wallet, a smart wallet that we just talked about is able to
37:21
to read and interpret a set of rules with roaming wallets,
37:24
we're talking about wallets that go from framework to framework,
37:28
essentially country to country. So I could have a a wallet that
37:33
is issued to me here in the UK under UK rules.
37:37
It contains credentials that are to international standards, So
37:40
my passport and my driving license.
37:42
And there's already international standards there
37:45
For MDLS and digital travel credentials emerging, I would
37:48
say they're complete. They're emerging.
37:51
So if I come over to the US, what I would want is that my
37:55
wallet will roam in the same way as my phone roams today and the
37:58
same way as my payments instruments work today.
38:02
And my additional identity should be no different.
38:03
I don't expect to have to get another wallet because I'm in
38:07
the USI expect the wallet I've already got to roam and to adapt
38:11
to the US rules. So we've been doing a lot of
38:13
work around with some core credentials.
38:18
We call them golden credentials of passport, driving license,
38:22
bank account, information about my telco account is quite often
38:25
used and national ID cards where they exist.
38:28
Now they don't exist in the US or UK for US, but in most places
38:31
around the world they do exist. Those are the five golden
38:34
credentials. If I've got those in my wallet
38:37
and they are to international standards, when I move from
38:41
place to place they should still be recognized.
38:43
So if in the USI want to now formulate a NIST IAL two and you
38:49
know 863, if I've got a driving license and a bank account in my
38:55
wallets that are to recognize international standards, that
38:59
should be able to be done instantly.
39:00
As you know, as I open my wallet in the in the US, it can be for
39:03
me like oh, you've managed to get to an IAL two.
39:06
If you want to get to an IAL Three, you're going to have to
39:07
do this. So that's what we mean by
39:10
roaming wallet. So the same rule description
39:15
language, if then used on an international basis, will enable
39:18
wallets, will enable wallets to roam from place to place.
39:21
Yeah, I mean this, this is the really interesting part to me.
39:25
So now we're starting to get into, you know, the real world.
39:28
You're carrying these credentials and it brings up two
39:32
things in mind. So let me go to the first one
39:35
first, which is around like readers.
39:39
That's what I'll the way I'll put it, because let's just say
39:43
we're talking about a driver's license issued by my state and
39:47
say they did that next year. Now, if I wanted to use my
39:51
driver's license at a store to buy alcohol, they need to be 21.
39:58
They it seems to me that I can't just show them like, hey, look,
40:01
I've got this, I've got my driver's license on my phone,
40:05
you see, and I could potentially just screenshot it and.
40:09
Change the date on it or something like that.
40:12
It seems to me that they'd have to have some kind of reader that
40:15
maybe did near field communication.
40:17
The other scenario is I get pulled over by a police officer
40:23
and I want to like unlock my phone and hand my unlock phone
40:27
to a police officer. Now, he could go searching
40:29
through and figure out whether or not he wants to arrest me
40:32
based on things he finds in my phone.
40:35
He just like what I do. He doesn't like that I like the
40:38
New York Yankees when he's a Boston Red Sox fan or something
40:41
like that. So to me it seems like there
40:43
have to be some kind of electronic exchange of
40:47
communication. That would be like a reader type
40:51
thing. Yeah, absolutely.
40:52
In face to face environments, we're going to need readers.
40:55
So a lot of what we're doing with wallets will enable the
41:00
wallet to be used online as well.
41:01
So that all And so they're all that's fine.
41:03
And the the the relying party and as we call it, there is an
41:07
electronic read of the wallet and all of that is done.
41:11
Yeah, over the web and done securely in face to face
41:15
situations as you've described, yeah, we're going to need
41:18
readers for two reasons. Both parties need to know that
41:23
they can trust each other and that the information they're
41:25
presenting is genuine. So if we consider the example
41:29
that you know the law enforcement officer wanting to
41:31
see your driving license, the MDL standard is is designed to
41:35
be able to do that without winding your window down.
41:39
So you know the officer should be able to actually I I want to
41:42
read your driving license and put their reader to the window.
41:45
You should be able to touch that reader on your side and what it
41:49
should say to you is yet this your your device should say yes
41:53
this is a genuine law enforcement officer and I know
41:56
that because the signature in there did their reader.
41:59
I've checked back to a trust server somewhere and it and it
42:02
and it's you know on the list. So this this is a genuine
42:05
officer and what they're asking for now is this information from
42:10
your driving license do you consent to share it?
42:12
Yes I do. And then that information goes
42:14
back to the the officer. Part of that though is the other
42:19
way around to consider the officer, how does he know that's
42:23
the person. So you know that's done today
42:25
with the photograph that is on the device.
42:29
What we're moving to in those kind of presentation is it is a
42:32
photograph, but the device is doing the the face of the person
42:36
that is presenting it back to the stored photograph from the
42:40
driving license hermetic issue. So we'll only present the
42:44
information if those two things have been done.
42:46
So the officer really doesn't have to do the face match, The
42:52
presenting users device is doing that for them as part of the
42:55
ecosystem. And in the UK we're working on a
42:58
you know alcohol based change to the law at the moment it's a
43:02
consultation out and that will involve readers and you know the
43:06
readers will simply get back a statement of over 18.
43:09
In our case they don't get the picture back.
43:13
That will all be done on the on the presenters phone.
43:16
Yeah, I think that that whole scenario is very interesting
43:20
because I brought up like those edge use cases earlier, which
43:24
you can't even come up with a whole list of edge use cases.
43:28
But if you had a reader that you said, OK, I'm going to transmit
43:31
some info and he came back and said, do you want to share this
43:34
information? You could accept or decline or
43:38
maybe uncheck certain things, things like that because, you
43:41
know, buying a card, maybe they want your, your address, I don't
43:46
know, maybe they're doing a $50 off discount for blood for organ
43:50
donors because you know, the the owner of that dealership really
43:53
believes in that. But you don't have to show that
43:56
information or maybe you do want to, I don't know.
43:59
I'm getting off topic a little bit there.
44:03
The other thing that that came to mind though in this whole
44:05
area was that, you know, you talked about all these different
44:09
countries and that there's national IDs and then in the
44:12
United States, we've got 50 states that issue credentials.
44:16
The other thing is I could see credentials being like
44:18
universities issuing credentials like you know, that that way.
44:22
It's like you want to know that I I have a degree from that
44:25
university, I can transmit that or that's in my wallet.
44:28
There's so many different scenarios.
44:30
So it seems to me that there's this transition period that
44:34
needs to take place where you need some time where you know
44:38
you're going to need the physical in hand credential like
44:42
a driver's license or a passport.
44:44
While not only governments and organizations transition, the
44:53
timeline that they transition, but also people, not everybody
44:57
in the world has a smartphone, right.
44:59
So you know if it's kind of relies on smartphone, there's
45:02
going to have to be some transition period as well.
45:04
Your thoughts on that? Yeah, I think, well the first
45:08
let's talk about the phone to start with.
45:09
So for several years now we've been talking about wallets being
45:16
more of a virtual concept than a a device based physical wallet.
45:23
So we want to see that, you know, I I can have a wallet, I
45:26
can use it on my iPhone, on my Mac, I can use it, you know,
45:30
easily transfer it from 1 device to another.
45:33
The device becomes an important key storage device and an
45:36
important part of the security of the whole ecosystem.
45:38
But it shouldn't be at the centre of it.
45:40
So we need to make sure that, you know, we're we're not bound
45:43
to a single device. For those who haven't got
45:46
devices, we need to then enable them to present digital
45:51
information in the device. This manner we have one member
45:54
who is doing a lot of work, two members actually now around
46:00
digitally or proofing someone and then issuing them with, you
46:03
know, very sophisticated QR codes physically that they can
46:07
use them to present digital information that's stored in the
46:10
QR code, which is a a good compromise for people who don't
46:14
want to carry a digital device. They can carry a piece of
46:17
plastic or even a piece of paper that enables them to do that.
46:20
If you look at what they're doing in the Philippines with
46:22
Filsis, you could have your ID there again in so in AQR code,
46:27
essentially printed cheaply on a piece of paper.
46:31
And one of the things they've been doing is rolling out
46:33
laminators to town halls so people can laminate these things
46:35
so that they last longer. But they've got now their
46:38
digital digitally presentable ID in AQR code.
46:42
So yeah, we we need to plan this transition.
46:44
Not everyone has or should be compelled to have a smartphone
46:49
to make this work, but this is going to take time.
46:53
I mentioned the five golden credentials earlier on.
46:56
We're already seeing progress for digital travel credentials
46:59
and mobile driving licenses. We're seeing both of those
47:03
specifications saying they could also support national IDs.
47:06
So you know they can be solved therefore in two different ways
47:08
through a different standard. Telco accounts and bank accounts
47:13
is an area we're going to be pushing for standards on and we
47:16
think they're given that those those ecosystems are highly
47:20
standardized anyway because of the way payments and telco roam.
47:23
We think that should be rather simply simple to do.
47:27
Those 5 golden credentials I can see being covered in the next
47:30
five years. But then things like
47:32
standardization of university university credentials, health
47:35
credentials, proof of proof of employment, that's going to take
47:39
longer. And one of the things we're
47:41
pushing on governments around the globe to do is to start
47:44
thinking about that and put a program in place that moves
47:49
their whole country to digital issuing.
47:52
If it's not going to happen without a plan, there are
47:55
massive economic benefits to moving to digital issuance of
47:58
these things. But in isolation saying to the
48:01
individual university, are you going to be the first to move to
48:03
this. You know unless it's a bit of an
48:06
academic project, it's not going to happen.
48:08
It needs some some serious planning on on a countrywide
48:11
basis. So we're one of the things we're
48:14
going to be highlighting in another paper we're doing really
48:17
aimed at the UK government regular to our election is
48:19
highlighting that it needs to plan for that issuance of things
48:24
digitally over the digital idea is great, but it needs to be
48:27
able to collect these are the digital credentials as well.
48:30
I find it interesting that you talk about the non digital
48:34
credential here, right, AQR coded with that I I immediately
48:37
start to think of sci-fi movies that I've seen right where you
48:39
have like a bar code or something that you scan on your
48:41
wrist. It's set up when you're bored or
48:44
whatever and right that points back to some sort of central
48:47
repository. I don't think we're there yet
48:50
and certainly not advocating mandate.
48:53
I'm having a tattoo put on you but you know this idea of a of
48:56
AQR code that's plastic right or you carry around for the for for
48:59
people who don't have a digital device I find pretty
49:01
interesting. Do you find that, is that, is
49:05
that a real thing or is that more just kind of conjecture
49:08
right now and kind of thinking about, yeah, we do need to solve
49:11
for people who don't have a, you know, appropriately advanced
49:15
enough technology device to support a wallet in this case.
49:20
It's absolutely real. I mean I mentioned the example
49:23
of the Philippines with with Phil Sis that is one of the
49:27
options and one of the most popular options there.
49:29
I'm trying to remember the stats from when I met with them back
49:32
in November. It's about 5050 issue between
49:35
having a device based version and having the QR code version I
49:38
think. So, you know, a lot of people in
49:41
in there, yeah, Which is very much an emerging nation, don't
49:44
have smartphones. So they're going to need that,
49:47
that capability. And the middle ground here is
49:51
feature phones. So, you know, feature phones are
49:53
getting smarter. Yeah, they're not.
49:55
They're not getting as far as smartphones, but, you know, they
49:58
are. Their ability to carry a
49:59
credential and present AQR code for many of them is already
50:02
there. So you get to this point where
50:06
you say, well, yeah, well, I just don't want to be digital.
50:09
That's fine. You still need a way to do all
50:11
of the spaniel if you wish. You know, we're not, we're not
50:14
saying and we're not advocating that everybody must move to
50:17
digital means, but within the digital domain, we need to case
50:21
it for different options and not assume everybody couldn't get to
50:24
a full-featured smartphone. How do biometrics play into this
50:27
when we're talking about a mix of you know digital methods and
50:32
what if I am a non digital method or is biometric purely
50:36
for digital authentication? Forge is there.
50:39
You know the example you mentioned in the Philippines,
50:41
like I mean you literally are the person holding your card,
50:44
right? How do you prove that in a
50:45
digital world? Yeah, I mean in that area you
50:48
know that card has a as high resolution as possible image of
50:52
you in the QR code that is then revealed to a reader and that's
50:55
cross checked. So that so that that biometric
50:58
comparison then becomes a manual comparison to the person you
51:02
presented it to or if it's a machine, it needs to capture the
51:05
picture and it needs to capture the other credential.
51:08
So if you think about what I said earlier about moving away
51:12
from devices, this is where biometrics are key because
51:16
actually if this whole thing around my identity is triggered
51:18
from my biometric and is held in the cloud and all of that
51:22
secure, I don't need a device in in play.
51:25
It can all be done with the device of the person who's
51:28
reading it, because if I can present my biometric to that and
51:31
then within that interaction use their device to consent to share
51:35
my information with them, I don't need the device to do
51:38
that. Now we're way off that and we
51:41
need a lot more trust in biometrics before we can do
51:43
that. With biometrics, yeah, there's
51:47
been quite a lot around the fact that, you know, they've had some
51:51
some challenges dealing with ethnicities, which I think now
51:55
has really gone back to, well, if you train them the AIS
51:58
correctly, if they don't have a problem with different
52:01
ethnicities, you just need to make sure you've got a proper
52:03
training sample that's available to avoid that problem.
52:08
But because of issues around biometrics and particularly
52:11
fears about how good deep fakes are getting and how how they
52:15
fall, biometrics, some of the frameworks we're working with
52:19
are starting to put rules in saying that biometrics must not
52:22
be the only option. So you can't.
52:24
So you can't go into a situation where you have to have a
52:26
biometric. You must have other choices
52:28
around knowledge and possession of authenticators in order to
52:31
prove who you are, and in proofing as well.
52:33
You can't use biometrics as the only option.
52:35
In the UK, it's just putting a policy change through at the
52:38
moment that says when you're proofing someone into a digital
52:40
ID, as a proofing identity service provider, you can't
52:46
offer biometrics as your only option.
52:48
You've got to have alternatives. We think that's important.
52:52
We don't think individual companies should be compelled to
52:54
offer alternatives. The consumers of identity, the
52:57
relying parties should make sure they are adopting alternatives,
53:00
is our view there? They must be available in the
53:02
market. So we made it 53 minutes before
53:05
the mention of deep fakes in AI, which I think is a record for
53:08
us. It's recently on this show.
53:11
I mean, it's certainly something that we've got to all account
53:13
for, right? Is I can immediately think of
53:16
like that picture, right? If I if I have AQR code and it's
53:18
an image of me, what happens if that image of me changes?
53:21
Or what if someone alters it and right in some way to be someone
53:24
else? I hey, I I want to give us a pat
53:27
on the back for going 53 minutes.
53:29
We'll talk about AI in any in any substantive force, but it's
53:33
definitely interesting to hear that that's that's already part
53:36
of the discussion. If I'm in this space and I care,
53:40
how do I follow along with what's happening?
53:43
Is this something where I go to the open identityexchange.org
53:46
website? Are there other resources that I
53:49
should be looking at? Like how do I keep up with this
53:51
stuff? Yeah, it's hard on our website,
53:56
we publish our own papers, which yeah, but once a quarter we
54:01
publish some of the consultation responses.
54:03
We we push back to government as well openly so people can see
54:06
what we're saying. So yeah, our website is a good
54:08
source of that for members. We do a weekly or biweekly
54:13
update on market views and views what's going on.
54:17
We have a lot more resources for members as well in terms of what
54:19
they you can see online to find out what's going on in the
54:23
identity industry. So you know it would be great
54:26
for your listeners to become members if they want to find out
54:29
more. And you know, but it is, there's
54:32
so much going on in this space at the moment, it's it's really
54:35
fascinating for us to be at the heart of this and then be
54:38
influencing its direction where where it's a challenge, but
54:41
we're absolutely not loving work.
54:43
Well, I'm glad there's somebody thinking about this and there's
54:45
smart, smarter people than me trying to work through that.
54:49
There's only so much we can cover in like an hour, right,
54:51
For a podcast. I would definitely encourage
54:53
people and we'll have a link in our show notes for people to
54:55
check out the website so they can kind of get more information
54:57
on that and and hopefully get involved.
54:59
I think more people involved as always a better, a better thing,
55:02
right? More viewpoints and more points
55:03
of data, right, to accumulate things.
55:06
I do want to close the conversation on a different type
55:08
of identity. One of the things that was
55:11
discussed prior to coming to show was the fact that you do
55:15
theater work and that you're performing things like that.
55:19
So you're already assuming an alter identity.
55:22
So let's keep in that same. In that same vein, if you could
55:25
perform in any theatre, show any character, or whatever it may
55:29
be, which one would it be and why?
55:31
So I've I've performed in many shows over the years.
55:34
I've done, I've done Shakespeare, I do probably
55:37
called pantomime. So I was dressed as a panto Dame
55:40
a few weeks ago, which is essentially a kind of to drag
55:44
act that we do as part of the comedy as part of that genre in
55:48
the UK. What what I would love to do is
55:52
to play the part of Frankenfurter in The Rocky
55:54
Horror Show that that would be my ultimate, ultimate dream.
55:59
I'm. Probably getting a little old
56:01
now. So, you know, somebody needs to
56:03
be offer me that part pretty soon, But you know, I'm
56:05
available if anyone's interested.
56:07
All right. So, so if I want to hire you
56:10
right, I think we could probably get get, get you involved with
56:12
like acting. Jim, what about you?
56:15
If you could play the role of any?
56:17
I I don't know. I don't know how much theater
56:19
you watch or what's we can expand if we need to.
56:23
No, you know, like so history based dramas are kind of like my
56:29
one of my favourites. So I'd like to just be a double.
56:34
No, not double. Like somebody who doesn't really
56:37
have a part or that you don't notice.
56:39
But if it was you, like, here's the part.
56:41
I walk in the door and I walk across the room and like
56:44
therefore like you would be etched in history as like part
56:50
of that movie. Wait, so you want to be an extra
56:53
in? A That's the I want to be an
56:54
extra. Yeah, that was the word I was
56:55
searching for. Thank you.
56:56
I want to be an extra in a movie that's like Timeless that people
57:02
will watch forever. And like, oh, there goes that
57:06
guy. There goes, well, you know, even
57:08
though people don't notice me, they they consciously notice me.
57:13
They'll notice me. OK, that's interesting.
57:16
I don't know. I I, I feel like Jim, dream
57:19
bigger man. Don't you want to be?
57:21
Like just I don't see myself being an actor, so like, but I
57:27
think I could be an extra. OK.
57:30
All right. I mean, I, I, I play the role of
57:33
Jeff podcast host at least once a week.
57:37
So that normal functioning human relatively speaking, I feel like
57:40
that's the role that I'm designed for.
57:44
I haven't done any any acting at all other than like school plays
57:47
I did in. So I was in a Christmas play,
57:50
must have been like fifth grade, so it's probably like 10 or 11
57:55
or something like that. And it was the 12 days of
57:58
Christmas and I there was a solo.
58:01
So I actually we were it was everyone was singing and I was 5
58:05
bales of hay and so I had to sneeze and that was like my big
58:09
thing was like I had the best sneeze.
58:11
So I did 5 bales of hay as like a 10 year old and that is the
58:16
peak of my performance on a stage anywhere.
58:21
So Nick, you've got me like beat by like 10,000% if, if, if, then
58:26
and then some. So you use the five bells of
58:29
hay, and you're telling me to dream beggar?
58:32
What's that? You're telling me to dream
58:34
beggar? Hey, that was fifth grade, man.
58:36
At least I was, you know, I was. I had a solo part of it because
58:40
the whole sneeze and stuff like that.
58:42
Like, come on, man, you wear the jackets, you go to these
58:44
conferences. You could be.
58:45
You could be a leading, a leading person.
58:48
Maybe I have a friend. I have a friend who, you know,
58:52
he's part of the, there's like a like a quasi Hollywood scene in
58:57
Atlanta. So they're doing a lot of
59:00
production of TV shows and movies in Georgia now.
59:04
Anyway, he has busted his ass to kind of rise up.
59:08
And I will say he got like a not a speaking role in the movie
59:12
Black Adam. And there's a scene where he
59:15
takes his his sword or something and like busts over the head of
59:19
Dwayne Johnson. And then it like, bends, it
59:23
shapes the bit to Dwayne Johnson's head.
59:26
And then he gets punched by Dwayne Johnson, like, flies off
59:29
the screen, like. And you know, he's put.
59:34
But The thing is, like people see him at the gym and they're
59:37
like, hey, were you in that movie Black Adam?
59:40
He's kind of like that small scene.
59:42
So I'd be good with that. I know how much work he's put
59:45
into it to get roles like that. He's put a lot of work into it.
59:49
I'm just not willing to put that much time into it personally.
59:53
Well, let's go the expert. Here be an extra.
59:55
We've got an expert on the show, Nick.
59:56
If you had to cast Jim in something, what do you think Jim
1:00:00
would like? What's a role, that of the hour
1:00:02
that we've been talking here that you think Jim would be a
1:00:04
good fit for? And myself too, if you feel like
1:00:06
it. Oh, fantastic.
1:00:09
Well, I I think if we're going to do like a sequel to, say,
1:00:12
Wayne's World, we could get you two in it.
1:00:14
There you go, that'd be. That'd be a good place for both
1:00:16
of you there. I could do that.
1:00:20
I'm a fan of. World I.
1:00:22
Would definitely be Karth, that's for sure.
1:00:27
Fell on my keys. All right, terrible Garth
1:00:32
impression. We're going to go ahead and
1:00:34
wrap, wrap it up there for this week.
1:00:36
I don't think we can top that. So thanks Nick, for for saving
1:00:38
us there in that last minute. We'll go ahead and leave it.
1:00:42
We'll have links in our show notes for people to connect with
1:00:45
Nick on LinkedIn, check out Open Identity Exchange that's open
1:00:48
identityexchange.org. Follow all the great work that's
1:00:51
there, help keep us connected and moving together and that and
1:00:56
interoperability. So thanks Nick for being on top
1:00:59
of that. You can visit us on the web,
1:01:01
idacpodcast.com, on Twitter, at IDAC podcast or whatever Twitter
1:01:06
is called by the time you listen to this, whether it's tomorrow
1:01:08
or 10 years from now, if it still exists.
1:01:10
We have a YouTube channel. Jim is very proud of making sure
1:01:13
that we get people over there. So we started to post like
1:01:16
shorts and all of our episodes are up there as well.
1:01:18
So another way to check us out, We're on Mastodon, at IDAC
1:01:22
Podcast, at Infosec, dot exchange and of course you can
1:01:26
always connect with Jim and I at LinkedIn.
1:01:27
So thanks everyone for listening and we'll talk with everyone in
1:01:30
the next one. You've been listening to
1:01:34
Identity at the Center. We hope you've enjoyed the show.
1:01:38
Make sure to like, rate and review and we'll be back soon.
1:01:42
But in the meantime, hit the website at
1:01:44
identity@thecenter.com and find us on Twitter at IDAC Podcast.
1:01:52
See you next time on Identity at the Center.