Latest / Identity at the Center / #180 - Authenticate 2022 - The FIDO Authentication User Experience with Kevin Goldman

Transcript

#180 - Authenticate 2022 - The FIDO Authentication User Experience with Kevin Goldman · Identity at the Center

0:09
You're listening to the identity of the center podcast, this is
0:13
the show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:25
sender podcast, I'm Jeff and that's Jim.
0:27
Hm. Hey Jeff how are you?
0:28
Not too bad yourself? Don't fantastic here at the
0:31
authenticate conference 2022 in Seattle.
0:35
I give the conference in a has been a really good conference
0:39
and a fourth etiquette. Yes.
0:41
And it and next year, I think it could a plus with it moving to
0:46
San Diego. Which by the way that news was
0:49
broken on it, did it start a podcast?
0:51
It was thank you very much and you're shaky are for joining us.
0:54
Week is sort of like a preview that we rolled out this Monday,
0:57
the first day of the conference and he was kind enough to give
0:59
idac listeners sneak preview of where authenticate will be next
1:05
year. So hopefully we'll see people in
1:07
Carlsbad California, which is just North of San Diego.
1:11
So, it's definitely a destination spot for people who
1:14
like to plan, you know, vacations around conferences.
1:17
Or if they have family things that they can send the family do
1:20
fun things while they sit. You don't talk identity with a
1:23
bunch of Denny nerds like And I, yeah, well that's that's true.
1:27
And you know, I met so many people here at the conference
1:30
from all over the world. All different stages of their
1:33
career doing all different things, but guess what?
1:36
I did not meet a single person who likes the password, not one
1:41
at a password list. Basically thing that's that's we
1:44
go. Imagine.
1:47
Well, why do we kind of pivot into our conversations tape up
1:50
before I get too far along? I do want to again.
1:51
Thank and Russia are in the Fido team.
1:54
For hosting us this week and giving us a spot to record and
1:58
just the support that they've given us a true friends of the
2:00
show. So we hopefully are paid it back
2:02
there with some exposure on the podcast.
2:04
And also thanks to our SM for sponsoring our trip out here.
2:08
They are our day job, and the podcast is our night and weekend
2:12
job. So they've been very supportive
2:13
of that. So thanks to both Andrew and our
2:16
SM and let's go ahead and introduce Our Guest.
2:19
His name is Kevin Goldman, he's a chief design officer, a true
2:22
Sona and chair of the user. Experience committee and a board
2:25
member for the fight Alliance. Welcome, Kevin thanks for having
2:28
me. Yeah.
2:28
Glad to be here, that sounds like a real mouthful.
2:30
So we want to get into that a little bit here, so I second
2:33
that. Yeah.
2:35
So before we get too far along its first time you were on the
2:37
show. We like to find out more about
2:39
the identity origin story for people.
2:42
How did you get into the identity space itself?
2:44
Is it something that you chose or did it choose you or maybe
2:47
something else? Yeah, a little bit of both.
2:48
You know, most of my career was spent in Consulting as user
2:51
experience Consulting and I met the founder of the company that
2:56
I'm at now and was just intrigued and eight months
3:02
later. I joined the company.
3:04
So that was about seven years ago.
3:05
So I've been in the authentication cyber identity
3:10
space for about seven years. And you know, the funny thing is
3:13
I I really feel at this point. I'm going to be in this industry
3:17
for the rest of my career. There's just so room so much
3:20
room for design to make impact in.
3:24
This space another way to say it is there's just a really low bar
3:29
design and say we have something like crappy design, you know, I
3:33
am space that he worked on which I would agree with.
3:36
Yeah, lots of room for impact. So I was also thinking there's
3:40
also a difference between user experience and user interface,
3:44
right? I mean it's the the user
3:47
interface is kind of the thing that we can all think of but
3:50
it's everything that goes into it, right?
3:52
That's it. Yeah expert.
3:54
You have in your you bring to the table?
3:56
Yeah, thanks for pointing that out.
3:57
You know, it can be an alphabet soup of, you know, ux/ui HCI all
4:02
these different, human-computer interaction?
4:04
All these different things that the design space calls it.
4:08
But you made a important distinction.
4:10
Yes, there is the digital stuff you interact with on screen
4:15
which is the user interface. But the user the user experience
4:18
is more broad. It's it takes into account all
4:21
the different contexts that somebody might be in and the
4:24
full Journey that they might go through.
4:26
So let's it might be some of it might be in the digital space.
4:29
Some of it might be in the physical space and it
4:32
incorporates all of that. So yeah, you hit the nail on the
4:35
head, it's both. So I know that true Sona has
4:40
been here for years really, part of the alliance.
4:42
And I remember hearing I think was already speak last year, for
4:46
those who aren't familiar Tristana, which is where you're
4:48
at right now. Tell us a little bit about that.
4:50
Give us a like, a 30 second elevator pitch.
4:52
Yeah. Keep it very, very simple.
4:55
So to Sona is in this space of identity and access management.
4:59
We provide a password list solution that allows people
5:05
brands that to deploy passkeys and and Fido based credential
5:11
authentication for their consumers.
5:14
In a very, very simple way so that they're don't require a lot
5:17
of Technical know-how and they don't they get all this stuff
5:22
that I bring with user experience.
5:24
It's and they get all the goodness of the security that
5:28
Fido has allowed and put that together into a SAS base Cloud
5:32
solution. Interesting.
5:34
So, I got to ask, how did, how did, how did you get engaged
5:38
with Fido? And, you know, become part of
5:41
this user experience committees. It something that you got you
5:44
sought out on your own. Did they come to you just tell
5:46
me about the origin there? Yeah, you know, there's actually
5:49
it's been many, many years. So we've Fido has been our true.
5:54
Owner has been a member of Phi, do want to save four five six
5:59
years. But in the early days, we
6:03
weren't we weren't really involved.
6:06
Very closely. It was started about three years
6:09
ago. We said, hey, we want to get
6:12
involved more, you know, we did look at some of the usability
6:16
issues of Fido and we went to one of the plenaries and were
6:20
welcomed in and and really well Embrace it to be heard of what
6:25
our, what our thoughts were you fast forward a little bit and it
6:28
would really was you mentioned, and Russia, are is really and
6:31
Russia care that took time and reconnected with, with me and
6:35
said, hey, you know what are these, some of these usability
6:37
issues you're seeing, we started talking about about what they
6:41
are and we sort of both thought. Hey, it could be great for Fido
6:46
to sponsor. Some user experience research,
6:50
and the output of that research could help relying.
6:54
In parties Brands ensure that there are phyto, deployment is
6:58
usable. So, that's really when I started
7:02
to become quite involved, and this was just nights and
7:05
weekends work, you know, we were thinking about what's the scope
7:09
of This ux research? Who do we get involved?
7:12
Andrew formalize that into a ux task force.
7:15
That was about, I don't know, is two or two and a half years ago
7:19
or so through that ux, task force Fido published its first
7:23
user experience guidelines and they were for platform
7:26
authenticators for regulated Industries.
7:30
If you're an RP, a brand that matches that Persona, then you
7:34
can use these guidelines to kind of Ensure good usability for
7:38
your end users. And, you know, it's the first
7:42
time that fight has done something like this and a lot of
7:45
magical things happen one, we got participation from a lot of
7:51
different vital companies designers within companies that
7:57
are on the final board or other parts of Fido and it was a
8:00
really diverse group global. So designers from around the
8:04
world that were giving their expertise to help create this
8:08
used to this research for the first time.
8:11
Another interesting thing happened which was, you know,
8:15
people read the guidelines and found something helpful in them,
8:19
you know. So you don't know the first time
8:21
out of the gate, a new if it's really going to resonate.
8:26
But we found that RPS like, hey, we really like this.
8:30
We want more, we want more ux. We want me to produce more ux
8:34
guidelines, so we did it again. We did a second round of ux
8:39
research this time. Focus on Hardware security Keys
8:43
again for regulated Industries. And by the way, the research
8:50
it's called research, the ux research, the listeners may or
8:53
may not have ever participated in a ux research project.
8:59
The outcome is what's important not necessarily that it was just
9:01
research, the outcome is are just best practices that are
9:05
easy to use. So that's really the outcome.
9:09
If you don't have ux designers on your team, you're a project
9:12
manager, you're an engineer, you're an IT admin.
9:16
Are looking for ux guidance, you might not have those people on
9:19
your team, you can go to these guidelines and get some good
9:23
advice. We published that second set of
9:27
ux guidelines at identifiers just a few months ago and a
9:31
couple of other things happened. Late last year, I became a board
9:35
member of Fido Alliance and then really work with the board to
9:42
figure out how do we do more around.
9:46
Ux at Fido and we looked at a lot of different ways to fit in
9:51
with the governance structure of Fido, ultimately, we created a
9:55
ux committee, so that committee now has the numbers grew
10:01
significantly this week. We added maybe six or seven
10:04
people, but I think it's about 28 people now that are part of
10:09
the ux committee. That are providing their
10:13
expertise to create more and more of this content that people
10:18
are saying they find helpful. And that committee has been
10:23
established about six months, we had some big goals for this
10:28
year, three big goals and one of those was launched just a few
10:34
days ago here at authenticate, we created a Fido Alliance
10:39
design system. So, if you're again, if you're
10:43
not a designer, if you're not a product manager, you might not
10:46
know what a design system is, but there really are the
10:50
essential building blocks of the user experience design.
10:54
Most companies have designed systems already Problem is
10:59
there's a big gap, they don't have design system components
11:03
for authentication, for password, less authentication,
11:06
and Fido authentication. They have design component
11:09
design system, components for username password, but not for
11:12
the password list, so stop right there.
11:15
So you see user design components.
11:17
What is that? So component could be as simple
11:22
as a button or an input field or a Piece of Copy Text.
11:29
That's a sentence long. That describes.
11:32
What an experience might be this new password, this experience,
11:36
but a component could also be the holding my hands out.
11:42
Those listening could be the end-to-end Journey of an
11:47
authentication identity authentication experience.
11:50
So, you're talking about like when you're like, mocking this
11:52
up with your mocking up the screens and what that flow
11:57
looks. Is it that?
11:59
They're sure companies, their tool does even has been created.
12:03
It doesn't even understand a world where Fido exists.
12:06
It's just yes, username password and a submit button.
12:09
Yes as yeah. Funny the person who is on day
12:13
one keynote from Google. Starting about Eric Schmidt
12:16
introduced. This idea that we're going to
12:19
have a page with just the username and then put the passer
12:23
on the second page of people freaked out I was thinking of
12:26
the exact same. Same thing.
12:28
It's like you just broke the system, right?
12:31
Yeah, for what people are used to.
12:33
Yeah, actually, one dash is quite.
12:35
I hope it's a good question, but it's around, you know, the the
12:43
idea around user experience. So when I think of Fido and
12:47
phyto to traditionally, like the first thing that came to my mind
12:50
was security break getting away from the password and a password
12:54
sucks, but the pastor sucks because it's so insecure.
12:58
But there's also, of course, the user experience components of
13:01
that witch and, you know, in some ways drives, the secure,
13:07
the lack of security around the pasture.
13:08
Right? Is that the user experience is
13:10
so hard that people take short cuts, etc, etc.
13:15
But still so, so that take that in context because they think
13:18
user experiences like a major Focus this week but I don't know
13:24
that it's always been a strong as of a focus as it is now.
13:28
And then I had this other realization or sense that when
13:34
you're sitting in these conferences like we're right in
13:39
the middle like Fighters. Come now 10 years.
13:42
Fighting Alliance has been around for 10 years. and, you
13:47
know, we're probably like, halfway through the Journey, you
13:50
know. It's like the the password is
13:52
still ubiquitous, but you feel like it's almost at the
13:57
inflection point when you start hearing about these major
13:59
rollouts. And it's got a ways to go.
14:03
So, so that was my realization. So now, here's my question is,
14:07
where are we at in terms of the user experience?
14:10
Are we also halfway in terms of taking this concept that the
14:14
user experience is just as Important as security or we
14:18
halfway or we just in the kind of the early infancy of that and
14:22
you know it's got its still yet to reach its inflection point.
14:26
And I'm also doing a budget arm movements that nobody seeing
14:31
hard to quantify if we let you know 50% or but.
14:35
But it's similar to that, you know, in some ways designs never
14:39
done. So it's always going to be
14:40
iterated upon and and improved, but there is a growing
14:45
awareness. In the ux and design Community
14:49
around the importance of security and privacy and that
14:55
there are other authentication modalities available.
15:00
I think that's just a big step to just that there is an
15:03
alternative for the people that are designing these systems.
15:09
What you what you mentioned earlier in in as you were
15:12
describing the question, you're mentioning, the relationship
15:15
between Usability and security and they actually affect each
15:19
other. So this is a very, very well
15:23
known very well respected person in the ux community.
15:26
His name is Jared spool and he corn sort of he, what he says
15:32
is. If it's not usable, it's not
15:34
secure. And he does what he does a very
15:37
long talk on this 60. 90 minutes are.
15:41
In fact, your son hired him one year to talk at our Summit but
15:47
it's it goes like this. If you have a security
15:52
experience that's hard to use. Regular people will find ways to
15:58
work around that security. They just will in ways that you
16:03
would not imagine. So when you work around the
16:05
security just makes the system less secure.
16:08
So there's a there's a symbiotic relationship between usability
16:12
and security and I think that's becoming more well understood
16:18
that when we talk about usability it's not just oh make
16:22
it simple for the e-commerce check out you know make it For
16:25
the lowest recurrence use cases. It's also for the most secure
16:31
use cases. You also need security, because
16:35
I knew you'd need usability because otherwise people are
16:38
going to work around it. The way that I've always heard,
16:41
it described to me, that always paid sense.
16:43
Of my feeble brain is, you've got a river, which is a security
16:47
or it is the people die. Haven't heard this one.
16:49
So yeah, drop a rock in the middle of it and if it's bad
16:53
security, the river just flows around it.
16:55
So you need to design it in a way that people can't flow
16:59
around that rock, whatever that gate is right.
17:02
Whatever that checkpoint is that you want to pass people through,
17:05
and it was thought that, that was made sense to me, but it's
17:09
clear and style in the desert is how I've heard at how to her to
17:12
call. That's another go ahead.
17:13
Yeah. Exactly.
17:13
Or like, you know, you see the images where it's like, you
17:15
know, the gate is here and yes. So it's just like a pet walk
17:18
around. Get you just walk around the
17:19
cake. Yeah.
17:20
And and that usability is a direct impact.
17:25
Until how secure system has because people will find a way
17:28
around it. I am guilty of that myself.
17:29
I don't look for ways to make my life easier.
17:32
If that means that I'm circumventing security, my
17:35
non-security Personnel, Ona will go ahead and do it.
17:38
Yeah. I'm taking a risk in doing that
17:41
and I feel like you know maybe that's a good rest maybe it's
17:44
not a good risk, not saying that I'm doing that in a particular
17:46
circumstance but people will find a way to make their life
17:49
easier and insecurity. Puts these owners burdens on top
17:52
of people they will find a way around it or they A just won't
17:56
use it. I'll give you a real pragmatic.
17:59
Example of the idioms are awesome, the river and The Rock
18:02
and the turnstile. So in the context of the hotel
18:07
are not a hotel but a hospital HIPPA laws privacy.
18:13
Lot of secure data, there's a system where it will log you out
18:20
of the system if they don't see mouth movements activity on that
18:25
machine. Within 90 seconds.
18:29
So well got documented case, where the staff.
18:33
You know from 9 p.m. until 5 a.m. had somebody whose job it
18:40
was to wake up, not wake up but not let that computer fall
18:43
asleep and even if they weren't using it would constantly keep
18:47
that machine open because it was so difficult.
18:50
It's a log into that machine with the multi-factor
18:53
authentication that they use. They would rather have Somebody
18:56
dedicated to walk over to it and make sure that they tap them
18:59
out, push the mouth. Oh, every minute, you know, or
19:03
every couple minutes to make sure that it didn't fall asleep.
19:06
Now did that make the system less secure?
19:08
Probably, because anybody walking by that computer can be
19:13
that admin on that computer. It's clear, they didn't watch
19:17
The Simpsons and see the opening intro, where they have the, you
19:20
know, the they call a little water thing with like the you
19:22
know, the beak that presses the keys for Homer when he's doing
19:25
the auto to been good. The automation right could have.
19:27
Yeah, yeah. So what I've also had some
19:33
conversation some hallway conversations this week and I
19:36
found myself talking about, you know, my dad because I think we
19:42
as security people. Like I yeah, you just popped
19:45
open and And boom, you're on your way and I think about my
19:50
dad or people like him, who is it?
19:53
Probably just getting caught up to how getting a one-time
19:56
password over SMS works and they're like, you know, it's
19:59
ubiquitous now I know that's where we have to get, but I also
20:03
thought to myself about how differently some of the
20:07
authenticators work from user experience perspective.
20:10
So for example, you know, the Microsoft authenticator made Do
20:16
something worse. Has I'm going to pop up a
20:18
number, then you're going to get an authenticator message to your
20:21
phone and just say what number you, see, for you.
20:24
Pick a number from a from a list, the Google Authenticator
20:27
doesn't work that way. So what I got to wondering was,
20:34
is part of what you're driving with this ux committee, and
20:39
maybe we can talk about the ux committee a little bit and what
20:41
your goals are, is it try to get some ubiquity there because I
20:45
feel like you Korea's is what's going to make or break the
20:49
success of more advanced authentication.
20:53
It's like when people kind of get it and do it and it's simple
20:57
and they understand it used to do it all the time, but I can
21:01
never see my dad downloading. The Google Authenticator and
21:04
scanning a QR code. It's just like he probably does
21:08
the stuff on the computer when he has to do it.
21:10
Mmm. Yeah, I think you hit the nail
21:13
on the head and Mitch galavan was He's talking about this very
21:17
eloquently just a half hour ago on the main stage and he's one
21:20
of the lead ux designer at Google and he was talking about
21:26
how the move of authentication to the device to their mobile
21:32
phones is an important inflection point for
21:35
authentication. And it really is, I'm trying to
21:38
paraphrase a little bit of what Mitch was saying, just a few
21:40
minutes ago. You know, when, when you have
21:45
billions of people that are used to unlocking their phone every
21:50
day, a hundred times a day, that's a behavior.
21:54
That becomes comfortable and well-known and well-understood.
21:58
So, your dad and you in the example that you gave can likely
22:02
unlock his phone and he has no problem with that.
22:06
And he understands it's a security step understands how to
22:11
perform I'm that task and gets through that task pretty
22:15
frictionlessly by moving our authentication with passkey with
22:19
Fido of moving, that user interaction to be the same way
22:26
that you unlock your phone that you can now unlock.
22:28
A website is very, very powerful.
22:31
So it's not as if there are some new behaviors that were seeking
22:36
to to make with Fido, but we're really piggybacking on a It
22:42
already exists and that's the key.
22:44
It's well known well understood. It's it's it just works and even
22:50
with passkey I don't know how much how deep we want to get
22:53
into it is that there's other there's other parts of the UI
22:58
with passkey that do the same thing they piggyback on an
23:02
existing you x pattern that's tried and true.
23:06
I think that's one of the things that I like to give the Apple
23:10
credit where credit is due is they have popularized and made
23:15
it very simple to take advantage of Biometrics.
23:18
Absolutely touch Matrix been around for a lot longer than
23:20
Apple was doing exactly, but they are the ones that that made
23:24
it ubiquitous. And the way that I think about
23:25
it too is, you were subtly trained to use these things.
23:31
Sure it was like, oh, here's how you log in, right?
23:33
You've got the prompts on your phone itself and kind of Shows
23:36
you how to do it but you also see in the commercials oh look
23:39
how easy it is and you see the face ID and the fun logos and
23:43
how easy it is and stuff like that.
23:44
And I think not only is it marketing obviously for the
23:46
product, but I think subtly somewhere, there is a look how
23:49
easy this is and you're starting to see these patterns and you
23:53
just pick up on, right? You see the same Apple
23:56
commercial with the Funky Music and whatever it might be, right?
23:59
And then you see it and I'm starting to see the same thing
24:01
with Google, right and their pixel phones, and then doing the
24:03
marketing around, you know, them.
24:05
I'm launching their various authentication schemes were
24:07
Biometrics and things like that. Mmm, in my is that tinfoil hat
24:12
of me, is it my thinking too hard about it or do you think
24:15
that actually is a conscious decision as part of marketing, a
24:18
product to show some of these features in a way that is, is
24:22
more of a subliminal training to the people who might be
24:25
interested in it? I mean, I can't speak for.
24:28
I can't speak for them too but I see it the same way.
24:31
Okay, great minds. Think alike.
24:32
Ha, ha ha, ha, ha. I wonder if You know, some
24:36
companies are looking at having a different process, helps them
24:42
lock in their customers. And so what I'd love to see like
24:46
the, you know, the way like, like streaming TV apps
24:51
authenticated and everything is kind of the the same, whether
24:54
it's Google, Microsoft, Apple. So don't feel like, I'm getting
25:00
locked in or don't know what to do, things like that.
25:05
Because I think that really Maps back to what is a good user
25:10
experience is that people don't have to read instructions in
25:14
order to authenticate, right? I think the other thing that a
25:17
good user experience is like, if I lose, or I get my get a new
25:22
device, I could end the unhappy path is that it's not insecure
25:30
and it's not like rocket science to figure it out.
25:33
It's not different. The way everybody does it, but
25:37
I'll throw the question back to you, Kevin, like in your mind if
25:40
somebody wants to know what is a good user experience, how do you
25:44
explain it and broadly Beyond authentication?
25:52
First thing that comes to mind is the solves a real neat?
25:55
You know? And you know, does so in a way
26:04
that allows somebody to focus on what really matters
26:11
Authentication, Isn't the tasks that anybody has?
26:17
It's not what really matters? In other words, if I need to
26:22
sign in to deliver a piece of work at work, the authentication
26:28
isn't the end gold. So what that case is just never
26:30
the end goal if we can allow to be secure.
26:35
It's a great experience. If that Fades away and just lets
26:37
you get to that thing that you want to do, you know?
26:42
And doesn't get in the way with with all these other hurdles you
26:46
have to go through. Yeah, because to me the I don't
26:49
know, some ways I think the authentication part is the easy
26:52
part. It's I got a new phone.
26:56
Oh you're talking about the edge cases is the unhappy PLM?
26:59
Happy Valley. Yeah, well that's that's
27:02
frankly. I'll just say I think that's
27:04
been the you know, it's been a real challenge.
27:08
Yeah. And that's what past passkey
27:10
Sol's for a lot of that. No, because if I the whole
27:14
definition of a passkey, is it survives device loss.
27:18
So, if I lose my device, I get a new device.
27:22
And I, and when I get that new device with that same platform,
27:25
provider that, that passkey will then be on that new device.
27:30
That wasn't the case until passkey there had to be other
27:33
recovery mechanisms. So, you know, account recovery
27:37
is is the hard is the hard The hard thing to solve for even
27:44
within passkey, I'm not going to say that.
27:47
Passkeys like that, you know, the ultimate Silver Bullet
27:49
because they're still edge cases with passkey, where you can't
27:55
recover the keyer, you know, there could there can and will
27:58
be cases that Brands need to solve for around that.
28:02
So yeah, account recovery is a big one.
28:07
Finally went to ask, like, do we cover pretty much what you
28:12
covered in your sessions during the conference and then were you
28:17
sitting through other sessions and did you either hear anything
28:21
that that challenge your way of thinking or they, you know, it's
28:26
great. Confirm, your way of thinking or
28:28
was the new education out there that you picked up a lot.
28:33
And I'll just answer the letter question first, which is You
28:35
know, you know, income in person conference like this, you know,
28:41
the meetings, the meetings after the meeting is where I've
28:43
learned the most. So it has literally been in the
28:46
lunchroom, you know, at launch and hearing a conversation and
28:50
saying is it okay if I listen in and that's where I've learned
28:53
some of the most important you know pieces of advice that I'll
28:58
take back you know to my work next week and and in some of
29:04
those larger Keynote speaking tracks.
29:10
I've learned a lot there as well.
29:12
One thing we didn't talk about. I do want to let your audience
29:15
know about this. Another thing that we launched
29:18
is the the phyto design system, I might have mentioned it.
29:23
There were several ux talks one of them at authenticate.
29:28
This year was launching of the Fido Alliance design system, you
29:34
can find it. Just tell you where you get it
29:37
Fido Alliance dot org slash design Dash system.
29:41
So there's a whole presentation on it, we had about a dozen
29:45
designers, accessibility specialist ux researchers from
29:51
around the world that help put that together.
29:53
If you're in the authentication space, you're creating new
29:57
experiences around authentication, you know to go.
30:00
So go check that out. It's the first version and I
30:04
will say, the first version does not.
30:05
Not include passkey, but we're doing passkey ux research now,
30:09
and that'll be published in the next.
30:11
We'll say, ER, Q early next year and that will be incorporated
30:16
into that design system, and I'll drop a link to that in our
30:19
show notes about. Thank you, hopefully find it.
30:20
Yeah, that'd be great. You know, I was just thinking
30:23
this conversation back and forth, you and Jimmy just
30:25
happened just now and remember how I said I give Apple credit,
30:28
and when it's due, I'm so going to dump on Apple, whatever it
30:32
needs it. Because it got me thinking about
30:35
this About passkeys, right? And and sharing them, and
30:40
sinking them between devices and things like that.
30:42
And for those who aren't familiar, the new iPhone 14 in
30:46
the u.s. now uses Isom instead of a physical Sim For someone
30:53
like me that sucks because I like to change devices all the
30:57
time and it's very easy for me to pop out my physical SIM card
31:01
and throw it to New Device. I could no longer do that.
31:04
Because now I'm on a nice M because I'm using the new
31:06
iPhone. If I want to switch to a new
31:08
device, there's no easy way for me to transfer from an Apple
31:13
device to a Android device, which I am prone to do is Jim
31:16
wouldn't, Jim will tell you. For that to work.
31:22
I actually have to call somebody get on with customer service and
31:27
say here's what I need to do and then at some point during that
31:31
call I'm going to get dropped because they're going to
31:33
transfer my service or not finish it.
31:35
You know provisioning the new sim on the on the new lease
31:38
amount of advice and I think about that usability and all the
31:42
credit that what into like oh yeah made things very easy.
31:45
They went ahead and launch this knowing I'm assuming that that
31:49
gaps. Still exists and it's basically
31:51
forcing us to move to the East and least in the u.s. under lock
31:55
in. It's not vendor lock-in, it's
31:57
just a poorly design process because I can Port my phone off,
32:02
an Apple device, whenever I want and I see us very similar to
32:05
sort of, almost like the passkey experience where we talk about
32:08
the unhappy path. There are certainly some gaps
32:11
still in Pass Key implementation.
32:13
You talk about hallway conversations and I had one
32:16
myself and questions of all how do you invalidate a passkey?
32:20
There doesn't seem to be a way right now and I think that's
32:22
probably something is going to come up in a couple days around.
32:25
You know, what does that look like?
32:26
From not only like us back perspective but a design
32:30
perspective because if we're assuming that passkeys are going
32:34
to, you know, be part of the process that we want people to
32:41
authenticate to and they're going to share their passwords
32:44
with somebody else. How are they going to
32:46
invalidate? That are you asking?
32:48
I'm not asking, I can't answer. It.
32:50
Yeah, I'm just thinking, you know, of, you know, those are
32:52
the types of usability diving at what I wherever, I'm aware of
32:55
the discussions, but I am not going to try to answer that
32:58
right now. Yeah, no, I'm not gonna put you
32:59
in a spot for. I'm just thinking out loud,
33:01
right here is what kind of the conversations and, you know, Jim
33:05
asked the question, what makes for a good user experience and
33:09
I'm curious, you know, how do you apply some of those
33:11
principles to the phyto standard?
33:13
For example, I know the US has been a big Focus for the last
33:16
couple of years and I remember Andrew actually talking to us
33:19
about it. Several, Is back, kind of
33:21
mentioning it as well. You know, what are some of the
33:24
principles that are like, you know, Hey Kevin says, we need to
33:27
do this to make this thing usable, right?
33:29
No, such as Kevin, right? There's a whole bunch of people
33:30
doing it. But how much influence does the
33:33
design and the usability? Go into?
33:37
Here's how it's actually going to work in the real world.
33:40
Yeah, well we the way we've laid it out in the u.s. committee and
33:45
Fido is there's kind of three levels for usability of Fido.
33:50
One our best practices that Brands and you know, relying
33:55
parties. I keep on saying Brands relying
33:56
parties because some people don't know what relying party
33:59
means. So that first level of usability
34:03
is is in the control of the relying party.
34:07
They're in control of their website, they're in control of
34:10
how they present the authentication, their control of
34:13
what words they put on screen. There are control of what the
34:16
button looks like, and what the label says on the button there
34:18
control of all that. That there are best practices
34:21
around that, and we provide a lot of those best practices.
34:24
So that's kind of the Baseline, but if we move up from there,
34:28
there's another level a second level and that is ecosystem,
34:33
consistency across browsers across platforms.
34:37
People have lots of different devices on different platforms.
34:41
And if the experience is different from one of the other,
34:43
it creates friction, as how does this work because I, it's not,
34:48
that's not what I saw previously.
34:49
Lee. There's an extra step in here.
34:51
Something's wrong. So, that's the second tier,
34:55
which is that ecosystem consistency.
34:56
The third tier is really usability challenges or
35:00
opportunities that can only be solved with adjustments to the
35:04
spec. Perhaps that's probably the most
35:07
difficult because that requires a tremendous amount of
35:10
collaboration with very technical people and long
35:16
thoughtful conversations about the relationship.
35:19
Between usability and security. We're starting this is, you
35:24
know, this is still new for Fido Alliance to formalize.
35:29
A ux practice or way of way of producing guidelines.
35:36
We're still really focus on that that bottom line of just helping
35:41
our peas, do the right thing that's in their control.
35:46
But I will say, passkey does is A move at that higher level
35:53
where it's not a change in the spec, is really the spec hasn't
35:56
really changed much. There's a some, some, some
36:02
addition not in addition, but like ancillary adjacent options
36:10
that you can have to support passkey, but that fundamentally
36:14
changed changes the usability. So that is an example of where
36:18
we're getting. And across the three platform
36:21
providers to make that needed usability change.
36:26
It seems like usability is a never-ending Journey, when are
36:30
you done? And it's like, okay, we've got a
36:32
ship like we're done. It's too hard to answer.
36:37
There's no there's no there. There really isn't, there's no
36:41
single way to answer that because it all depends on the
36:43
context of what the use case is with the unique business
36:49
environment that you're in. But I think the bigger point is
36:55
that it's not, it's not ever done and that you have to
36:58
iterate. There's one other point.
37:02
I didn't necessarily get back to, you know, your prior
37:04
question. What makes a great user
37:07
experience? There is something else to
37:10
consider that's being more and more spoken about and a and
37:14
accounted for and Fido. And that's accessibility.
37:18
So accessibility making sure that The best practices that we
37:23
provide and even the implementation of these
37:26
Technologies, like passkey, you know, making sure that they're
37:31
accessible the platform providers.
37:33
I say, do the best job at that, as a designer, who's been doing
37:39
this for a long, long time, if you can Base.
37:44
A lot of your ux UI framework on what the platform provides, then
37:52
you have your, you're likely to get the best accessibility out
37:56
of that platform. Meaning.
37:59
Yeah, meaning people who have low vision can use the system.
38:03
People who are blind can use the system people who have cognitive
38:08
disabilities can use the system. So it's that accessibility It is
38:13
a is goes hand in glove with usability.
38:18
That's a fantastic point. No, that was the question.
38:20
I was going to ask this, like, what do you mean about
38:22
accessibility? And I remember working on some
38:27
design documents for, you know, government websites and like
38:33
what they have to go through to be, you know, ad a TA TAA
38:38
compliant, tremendous amount of work and it'd be nice if you
38:43
could just plug into something that makes your experience.
38:48
Whatever that is, you're a poor things like that.
38:51
And like you said, I guess the answer is if you can leverage
38:55
something off of the platform, that's the way to go, it really
38:58
is the amount of it does take a lot of work and we're in a new
39:02
industry Tech in general, is still just new compared to other
39:07
Industries, and we're learning how to build accessibility.
39:12
And from from day one, ultimately, if you make a
39:16
digital product, Accessible. You're helping everybody.
39:20
It does help everybody. The same thing in the physical
39:25
space. It's Ada law that you have to,
39:28
you know, a ramp to be able to get into a public facility,
39:34
that's people in where wheelchairs Etc are, it's
39:37
accessible, right? But it also helps the person
39:40
pushing a baby stroller, you know, it helps everybody and the
39:45
same thing applies to the digital space.
39:47
There's many examples, Designed for accessibility it, makes it
39:50
more usable for everybody and I'm and I should give credit
39:54
where it's due within the ux committee.
39:58
There's a woman from VMware, joist Ishita.
40:01
That is a use of accessibility specialist, that has really
40:07
contributed, so much to Fido and to the ux guidelines around
40:12
accessibility. So I have one final question
40:15
before we start to wrap things up and that is is how much so
40:19
we're moving towards standardization and specs and
40:24
things like that were trying to be consistent with things.
40:28
At what point does. The the I guess the question is
40:33
is the user experience secret sauce?
40:37
For a product, right? If if we're in this space was
40:41
like, oh yeah, everybody's using passkeys.
40:43
What's the differentiator to have 40 different Pat companies
40:45
that provide passkeys is that the user experience or is the
40:50
user experience. Something that does get
40:51
contributed to sort of like the public domain.
40:54
And hey, we were adopting the style of button or image or
40:59
whatever it, maybe I'm just curious from my own.
41:02
It's a really nuanced question that you ask is if you if you're
41:06
asking it of me. Me, I work for a vendor in this
41:08
space and so, you know, it's very real, but yet this same
41:12
vendor is producing all these guidelines that are just
41:15
available for free. So there's there's so much room
41:20
to add value as a vendor in this ecosystem and it's just a matter
41:26
of deeply empathizing with the needs of brands that are seeking
41:31
to deploy deploy them. So we've been mainly talking
41:35
about the end user. Experience.
41:37
But there's also the developer experience, you know, and
41:40
there's all kinds of other. There's the there's the legal
41:45
teams experience. There's this the CFOs experience
41:48
of show me the numbers, show me the data I want to see the data.
41:51
How is this new authentic? You said this new authentication
41:55
was going to affect my bottom line.
41:57
How is it going to? I want to see the numbers.
42:00
So there's there's all kinds of ways in which you can build
42:04
value even If the end user experience has some good
42:09
codified, best practices. Now it's the reason I bring it
42:13
up is because I think Jim earlier was describing, you
42:15
know, here's how Microsoft does their authenticator app does a
42:19
different way, right? Apple does it off the last pass?
42:22
It seems like everybody has just a slightly different version.
42:26
Yeah, sort of doing the same thing and if we're looking to
42:29
make it easy it would seem to me like having a same process and
42:35
having something else be the differential.
42:36
Are would make more sense. Yeah and I'm at the I don't ya
42:41
so you're seeing that in the space, some of the free apps and
42:44
tools, you know, the probably over time not be needed and
42:49
they'll be other areas where we have to innovate and it's
42:52
interesting. It really interested to see
42:55
where the, you know, where the password manager companies go.
43:00
Yeah, I was having a conversation with that too and I
43:02
think it's interesting where those are positioning but that
43:05
is a conversation for a Time. I want to start to wrap things
43:08
up because I know that you're a busy guy.
43:10
You literally stepped off of the stage and into our room and to
43:13
do this. So really appreciate, if I want
43:15
to give your voice a break. But before we go, I was doing
43:19
some osint and notice something that is unique.
43:23
I think to any of the guests that we've ever had on the show
43:27
and that is it appears to me that you are quite the
43:31
bladesmith? Am I in fact correct on that you
43:35
are. Well I wouldn't say.
43:36
Played but but if I do make knives, yes.
43:41
Okay. So tell me about this because
43:43
I'm fascinated about we like to end the show on a lighter note,
43:46
and Sir, get out from the depth of identity.
43:50
And I thought this was really interesting.
43:52
I mean, I was, I was kind of looking at some of the stuff
43:53
that was out there and say, wow, this is really cool stuff.
43:56
And I'm like, how did you get into this like deal, man?
44:00
Yeah, well, here's the deal. So a lot of those probably five,
44:02
six years ago. Jim you mentioned it earlier.
44:05
So, Fortune to fire a show, Go on History Channel if you
44:08
haven't seen it, go check it out, you'll love it.
44:12
But I don't know about every guy had like if I see something that
44:14
looks interesting, like I want to learn how to do it, you know,
44:17
as like going to travel to Italy and have all this gelato.
44:20
It's like when I get home I want to learn how to make gelato, not
44:23
just buy it. So I want to learn how to make
44:25
make these knives myself and it's been quite a journey.
44:30
But most of my hobby, I spend so much time in front of the
44:34
fragile glowing screen is what I like to call it.
44:37
Then I just like my hobbies to be away from the fragile glowing
44:41
screen. So to work with metal, that's up
44:45
at 2200 degrees and be hitting it with a hammer that's away
44:48
from the fragile glowing screen. It's a lot of fun.
44:51
There's craft there's like metal work, obviously, but they're
44:56
woodworking. There's all sorts of Metallurgy
44:59
and Science and how the different steals behave.
45:03
There's a tremendous amount to that and then we like to cook.
45:06
I like to cook with my two boys. My 11 year old, is he loves to
45:10
cook? So, every couple weeks once a
45:13
month, I have a new knife. It's like here, Hudson.
45:16
Here's the knife, be very careful with it because it's
45:19
extraordinarily sharp. And then we like to cook with
45:22
him. Yeah.
45:23
The fortune fire, what I really like is it's kind of like a
45:26
historical angle to it as right. So, yeah, the project that they
45:31
give is usually hey, this was from the Ming Dynasty and it was
45:35
a special kind of Of, you know, there's what's the difference
45:40
between a sword and knife? There's probably very technical
45:42
definition, don't know. There's all these other
45:44
different types of blades or you know weapons, but there's always
45:50
that historical angle so I'm wondering to you.
45:53
What's your favorite will be, what is your favorite knife and
45:57
have you done something like that?
45:59
Like taking a historical bend on any of this?
46:03
Well, I'm only on my maybe 12 knife so it's not Haven't done
46:07
dozens or hundreds of them, I am making a sword.
46:10
I'm on my third, third sword because my son asked me for if I
46:15
could make him a katana for his 13th birthday.
46:19
What kind of Sword? Katana is a Japanese speaks
46:23
Japanese sword. Yeah, so I don't know.
46:27
My favorite, you know, there's something called Damascus, which
46:30
is the pattern steel. It's, when you fold steel, and
46:33
it creates this amazing pattern, you could have thousands of
46:35
layers. Of Steel within a sword.
46:39
And you see that on the edge of the blade.
46:41
It's very, very beautiful. And I've done some of that
46:44
integrating copper in it and stuff, but the thing that I
46:47
really have enjoyed is, it's called Mono steel.
46:49
So a single steel, but doing a differential, this is going to
46:53
get really nerdy quickly. I love it.
46:55
Keep it, you're good at, but you do a differential heart of heat
46:58
treat on the knife to produce what's called a hormone, and it
47:03
is a line that you see on the blade and that It separates the
47:08
hardened steel from the more softer, see of Steel.
47:12
And you do that so that the the steel Edge that you're using all
47:16
the time stays Harden, you don't have to sharpen it every day.
47:19
Every week, every month, like when I make my knives, they stay
47:22
sharp a long time, but then the rest of the blade can be more
47:26
soft and malleable. If you drop it, it's not going
47:29
to shatter like glass, you know? So producing that home alone,
47:33
doing that differential, heat treat is.
47:37
Man, there's so much science craft like materials.
47:42
You have to research. I just love it.
47:44
Yeah she'll be times when I show where someone thinks they've
47:47
created the perfect sword and then they have breaks the guy
47:49
wax it against the you know tree a few times to shatters.
47:54
Yeah. Yeah.
47:56
How long does it take to make something like this?
47:59
Like I should say like I don't know.
48:01
I don't know what an average knife or blade would be.
48:03
But how long does it take to put something together?
48:05
Right well for me I'm you know I'm doing Nights and weekends.
48:07
So, you know, at this point, it's like, 34 weeks to correct
48:11
kitchen knife. I'll make a very large kitchen
48:13
knife this 34 weeks, but, you know, it's kind of like, what
48:17
you just asked earlier, is it ever done?
48:19
I've been trying to force myself, you know, every knife.
48:21
Don't Be Afraid freshness, just finish it.
48:24
And then, all the things I screwed up to take to the next
48:29
one and then try to make that next one better, you know?
48:33
So I try to just just finish them either way.
48:36
Even if the other A bunch of mistakes in them.
48:38
That's so cool. I wish, you know, people could
48:40
see this goes like this. Just a smile on Kevin's face
48:43
right now. He's like a, like a, like a
48:45
passion and, like, just a real Joy from it, which I think is
48:48
fantastic. I mean, it's, it's infectious
48:50
because I got me smiling too. Well, check out Fortune fires.
48:53
It's a really interesting Community is a lot of people
48:55
doing it these days. Yeah.
48:57
And I don't think it's the cheapest hobby either, right?
49:00
Oh my God. So yeah, the friend of mine who
49:04
I use his very large honey. It down power, hammer near where
49:09
I live. He says common phrase and
49:13
blacksmithing is why why buy something for 20 bucks when you
49:18
can make it for two thousand dollars?
49:20
You know, it's the only like that these knives need of it.
49:23
They don't. It's a lot of, a lot of tools.
49:26
Sounds an awful lot like a lot of security.
49:28
Yeah. Like the Fairly Odd.
49:32
Yeah. All right, we're gonna go ahead
49:34
and let you get on to your crafting, your next Project at
49:37
some point here before we go any final thoughts.
49:40
Any takeaways from the conference and I think this is
49:42
really kind of the last recording that we've been doing
49:45
here for, you know, for the authenticate conference.
49:46
But any final thoughts, just from the moment, I walked into
49:50
the conference, I was just really impressed how much it's
49:54
grown since last year and I think if anybody is doing
49:58
anything and authentication, like they need you mentioned, it
50:01
might be in San Diego, or it's going to be in Carlsbad or
50:04
something. They should go next year.
50:07
There's a great sense of community and yeah, I it's been
50:13
a good event. Yeah, definitely hats off to the
50:16
team here, I made it's a fantastic conference.
50:17
Can't can't recommend it enough. And I think there's plenty of
50:21
content where you don't need to necessarily be an expert in.
50:26
Maybe know the Deep guts of Technology of technology or
50:29
authentication, there is something for everyone here and
50:32
I think it's an opportunity to learn stuff like that, which is
50:34
very cool. So Jim, any final It's this is
50:37
our last show here from authenticate, right?
50:38
Yeah I mean final alliances doing a great job pulling.
50:43
I think the organization Fido Alliance taking the photo to
50:47
standard and you know shepherding it through.
50:50
I think it's like the perfect combination because I think
50:54
Fighter 2 is something different than the phyto alliance right.
50:57
The fire lines are so important because it's having conferences
51:01
like this and running the member plenary and you know, taking
51:05
this We've been dogging on the password forever, right?
51:10
I mean we pull that one article Bill Gates at the passwords
51:14
going away like overnight and that was like 15 years ago or
51:18
something and finer lines didn't even exist at that point.
51:22
So how's it going to get there? It's, this is going to be the
51:27
main driver, I think. So, I'll of what is being done
51:31
here. I guess more and more and more.
51:34
Keep moving the ball. Yeah.
51:36
Keep Even and hopefully keep driving adoption and
51:39
organizations things like that. It'll get there over time.
51:41
So we'll go ahead and leave it for for this one.
51:45
I'll have links in our show notes to Kevin to True Sona to
51:49
the design system document or web page.
51:52
You referring to. I found your while we're
51:54
talking. And then for us you can find us
51:57
on the web where identity the center.com.
51:59
We're on Twitter at idac. Podcasts and special thanks to
52:03
the Fido team. And again for our SM, for
52:05
sponsoring our coverage, And will God leave it for this week
52:08
and talk with everyone in the next one.
52:13
Thanks for listening to the identity at the center podcast.
52:16
If you like what you heard, don't forget to subscribe and
52:18
visit us on the web and identity at the center.com.