Latest / Identity at the Center / #254 - Exploring Digital Identity with Phil Windley

Transcript

#254 - Exploring Digital Identity with Phil Windley · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity at the
0:23
Center podcast. I'm Jeff and that's Jim.
0:25
Hey, Jim. Hey, Jeff, how are you?
0:27
Oh, not so bad yourself. Good, man.
0:30
We've been podcasting fools lately.
0:32
I feel like every day we we're on this platform recording or
0:36
meeting with folks. And I mean, I love it, don't get
0:39
me wrong. But yeah, spending a lot of time
0:42
with you lately, Jeff. Oh, the keyword there is fool.
0:46
That's for sure. A couple of fools doing this.
0:49
No, I mean, I think this is, you know, this is how we start the
0:51
year. We end the year.
0:52
It's like this mad rush to kind of get stuff in place before you
0:56
and I disappear for a couple of weeks of, you know, well earned
0:59
time off and then trying to hit the ground running and then, you
1:02
know, all that stuff. But I'll highlight the word
1:05
again. Fools.
1:06
That's what we are. Yeah, well, you know, I one of
1:09
the things that I always like to do is like watch your
1:12
background. So we're an audio only podcast,
1:15
but Jeff has the coolest background at home with his, I
1:19
guess office or studio. You've got like ATV set up and
1:23
you've got, I think it's like screen savers running on it, but
1:27
always very cool. Today you're at a hotel, your
1:30
background is the hotel door and they've got the the fire escape
1:34
placard and usually on that placard is what the nightly rate
1:38
is. If you don't have a, you know, a
1:41
discount code or something like that, it's like Comfort Inn 450
1:45
bucks a night. Yeah, today's show coming to
1:48
live from a Residence Inn in Plymouth, MN up in the frozen
1:52
tundra. And I believe the rate kind of
1:55
for me to see from here is like 349 at night, which actually
1:57
isn't too bad. I've seen absolutely ridiculous
2:00
hotel rates in the cities and things like that where you're
2:03
you're into 4 digits for sure. Yeah, I'll bet it's cold there
2:07
now. It's only going to get colder
2:09
though. Yeah, not so bad 27°.
2:12
Those are rookie numbers. We got a We don't really pump
2:14
those up, right. You want those lower, I guess in
2:16
this case, but not too cold yet. I'm going to go out and hit some
2:20
top Golf tonight. Yes, in freezing weather.
2:23
I'm curious to see how it's going to work.
2:25
I believe we have heat, you know, fans that should should be
2:29
running. So hopefully that would be a
2:30
good time. We're actually going to, I'm
2:32
actually going out to meet our friend Tom Sheffield who's been
2:33
on this show tonight, so that'd be good times.
2:37
Yeah, from Target. That would explain the the
2:40
Minnesota piece. Yes it does.
2:43
Yeah, no, he's a good guy, man. I'd hope that he had him back on
2:46
the show. Yes, maybe.
2:49
That's maybe he will make a wager on golf tonight or
2:52
something. If whoever wins, give me a son
2:56
to come back on. If he loses, he has to come back
2:58
on the show that. What does that tell you about
3:01
the show, Jeff? It?
3:03
Doesn't tell me anything. How about that?
3:05
Actually he and I were talking at Authenticate last year and
3:09
he's working on his new sort of presentation for this year.
3:13
So I think last time I talked I was like, hey, you know, once
3:16
you come on the show and kind of work it out, once you've got
3:18
sort of the framework in place and you know go from there.
3:21
So Tom, true listening, looking forward to get you back on here
3:24
and looking forward to seeing seeing you tonight.
3:27
Yeah, Well, I'm excited about today's episode.
3:29
This is a long time coming and I'm really honored to have this
3:34
guest on our show. You want to go ahead and do your
3:37
normal introduce introduction. Yeah, let's get Phil Windley on
3:42
the on the line here. He's a Senior Software
3:44
Development Manager at AWS Identity.
3:46
He's also a Co founder and organizer of the Internet
3:49
Identity Workshop. Welcome to the show, Phil.
3:53
Hey, thanks. It's great to be here.
3:55
I've listened to a number of episodes and I'm excited to be a
3:58
guest. Yeah.
3:59
Well, thanks for taking the time here and joining us.
4:02
I know you're a very busy guy. You got a lot of different, I
4:05
guess, identity frying pans on the stove that you're probably
4:09
cooking with. One of the things that we like
4:11
to figure out though, is how people get into this world of
4:14
identity. How did you get into the
4:16
identity and access management space?
4:18
Is it something that you chose or did it choose you?
4:22
In the early 2000s, 2001, 2002, I was the CIO for the state of
4:28
Utah under Governor Mike Leavitt.
4:31
And when I was done doing that and was doing some consulting, a
4:37
friend of mine, Doug Kay, had written a book on web services.
4:42
And I thought that was kind of cool.
4:44
So I was just talking to him about, hey, how'd you write a
4:47
book, what you do? And he said, well, you should
4:50
write a book on digital identity.
4:51
The world needs one. And I said, Doug, I don't know
4:55
anything about digital identity. And he said, no, you do just
4:59
think about everything you did as CIO, and it's probably
5:02
Digital Identity. And, you know, as I thought
5:06
about it, sure enough, he was right.
5:08
I ended up writing a book that was published in 2005 called
5:13
Digital Identity from O'Reilly. And if you know anything about
5:20
2005 was a little bit of a watershed year in Identity.
5:23
It's when, well first of all Web 2 dot O was a big thing.
5:29
People were worried about how do we get access to AP is for, you
5:34
know, everybody's stuff. Before that the world had
5:39
primarily been kind of centralized identity systems.
5:42
I built them right. Organizations ran you know
5:46
directories or whatever in order to manage their identities, but
5:51
so, so, so the book is primarily about that.
5:53
It's primarily about his kind of centralized directory based
5:57
identity. You know, how do you do that?
5:59
But, but the world changed in 2005 and people started talking
6:03
about identity in different ways.
6:05
And because I was writing a book, I got included on lots of
6:11
interesting conversations in the January 31st, I mean December
6:18
31st day year's eve, 2004. Steve Gilmore, who is, you know,
6:24
something of a legend and and Podcasting circles had done,
6:28
he's doing a good Gilmore Gang and he's still doing Gilmore
6:31
Gang 20 years later. He did this thing that people
6:35
came to call the Identity Gang. So it was a he had like 30
6:40
people on and you know, his podcast host.
6:42
You can probably imagine the sheer just, you know, cacophony
6:48
it brings. Terror to my eye, my ears.
6:51
Just thinking about 30. Yes, on a single podcast, right?
6:55
But anyway, it was all about identity and after that was
6:59
over, Doc Searles who was also on it and I were talking and we
7:04
were saying, you know, the world needs a conference to talk about
7:06
this kind of new user centric identity Vibe.
7:12
You know what what people are doing.
7:14
I don't think we said vibe in 2004, but that was, you know,
7:17
that was the idea. And so we decided that we would.
7:21
We wanted to do a conference, and so we set out to do
7:28
something called Internet Identity Workshop.
7:33
We failed. We we went to have the first one
7:36
in the spring of 2005. Just couldn't get it together.
7:40
Just wasn't working. But we were still interested.
7:45
Still trying to figure it out. Doc ran into a woman named Kalia
7:50
Young at a Giants game. They were both there as part of
7:53
some conference. I don't know what conference it
7:55
was. And they started talking and Doc
7:59
was mentioning that, oh, we ought to do this.
8:01
We we want to do this workshop. And she said, oh, I could help
8:04
you with that. And that was kind of the, you
8:07
know, the little bit of extra magic sauce that it took to
8:10
actually get it off the ground. So we have the first Internet
8:14
identity workshop in the fall of 2005 at the Hillside Club in
8:19
Berkeley, CA, about 70 people there.
8:23
And what we did was we pulled together people who were doing
8:28
what was called what was Uri based identifiers.
8:33
And there were four of them. There was Dick Hart was doing
8:38
something called Skip. Johannes Ernst was doing
8:41
something called Lid Drummond. Reed had something called XRI
8:48
and the folks at Live Journal, David Ricardon and Brad
8:54
Fitzpatrick, we're doing something called Open ID.
8:59
And we thought, hey, this will solve the identity problem.
9:04
Let's get all these folks together.
9:06
We'll figure out how to create a single protocol for Uri based
9:10
identifiers and then we can all go off and do the other things
9:14
we want to do that are not identity.
9:16
And of course, as you guys know, we just held the 37th Internet
9:22
Identity Workshop kind of last October.
9:25
So we didn't go off and do other things.
9:27
We just kept doing identity over and over and over again.
9:30
And so I've been doing that, you know, since then.
9:33
Digital Identity's kind of been my thing.
9:36
You know, just wrote another book for O'Reilly called
9:39
Learning Digital Identity. And so that's how I got into and
9:43
kind of have been growing through digital identity over
9:46
the years. And Jim's been probably showing
9:48
that book off on on the camera here whenever he possibly gets
9:51
the chance. I gotta so I think you said 37
9:56
different iiws so far and this was in 2005.
10:00
The numbers don't add up unless you're doing more than twice.
10:02
A year? Yeah.
10:03
OK, that's twice a year. Once in the spring, once in the
10:06
fall. Gotcha.
10:06
So I've never been to an IOW. Who's this conference for?
10:11
I guess What do people get out of it?
10:13
Is it a bunch of big brain identity people?
10:15
Can I go as a noob in the identity world?
10:18
Like, what's the show? Any given I, I WI think it's
10:23
probably about 60% people who've been there before and about 40%
10:29
who are new coming for the first time.
10:33
Yeah, And so. So no, you don't.
10:35
You don't have to necessarily be, you know, part of the
10:39
identity as people sometimes call it.
10:44
But who is the conference for? It's for whatever you want to do
10:49
because IIW is what uses what we call open space technology.
10:55
Basically, it's a non conference, so you can come and
10:58
talk about literally anything you want.
11:01
If you want to have a session on the best guitar chords for
11:04
singing Christmas songs, you're welcome to come to IIW and talk
11:09
about that. And whoever's interested in the
11:11
best guitar chords for Christmas songs will come in to your
11:15
session. But what do the sessions
11:18
primarily focus on? They primarily have focused on
11:23
things like protocols, solving new identity problems, product
11:29
and how do we get adoption for these new protocols, how do we
11:33
make things work. So I mentioned that we brought
11:37
the first group together to kind of do these URAURL based
11:43
identifiers and they all became Open ID, right.
11:48
So Open ID as we know it is not the original live journal Open
11:52
ID. They lent the name and some of
11:55
their ideas, skip XRI lid all lit ideas to the whole thing.
12:01
Other people lent ideas and the first version V1 of the Open ID
12:06
specification was kind of what came out of that.
12:09
That happened at IIW. OS is an outgrowth of Iowa Open
12:17
IDV 2 or Open ID Connect. Now, Iowa is not the only place
12:22
people have worked on these, but that's what people do, right, As
12:25
they come to Iowa and have sessions on solving this
12:29
particular problem, right. You'll have sessions on Skim and
12:35
yeah, IGA, I mean you name an identity topic or protocol and
12:40
people will be hosting sessions on that.
12:41
And if they aren't, you can call one.
12:44
You don't even have to be the expert.
12:45
You can just say, hey, I am really interested in knowing how
12:49
we can use Open ID Connect in the Internet of Things and I
12:54
don't know anything about it, Please come and teach me.
12:56
People will come and run your session for you.
12:58
So that's how IW works, and that's the kind of sessions that
13:02
get held. We had Clea Young on the show a
13:05
few episodes back, #248, for those interested.
13:08
And she kind of described this. She's the same word, the UN
13:11
conference, right? And I think I've seen pictures
13:14
on the Internet, of course of, you know, people writing a topic
13:17
and they just stick it up on a board and then people either
13:21
attach themselves to it or they say, you know, it's like go to
13:24
this room if you're interested in this thing.
13:26
Is it really like that where people just?
13:28
Really kind of confront exactly like that.
13:30
So we have. So every day we have a grid,
13:33
right? And the grid is vertical
13:37
columns, different session rooms, rows or different time
13:40
slots. And you literally write your
13:42
title and who you are on a big 8 1/2 by 11 piece of construction
13:47
paper. Stand up an opening circle, say
13:51
hey, I'm Phil Windley and I want to host a session on the best
13:54
guitar chords for Christmas songs.
13:56
And then after opening circle is done, you go up to the wall and
14:00
say I want to be in this in this time slot and in this in this
14:07
room you put a put a sticker on there that say what room you're
14:10
going to be in. And then you go to that room at
14:13
that time and have your session. So yeah, it's exactly like that.
14:18
I wonder if we can put like a card up there, Jim.
14:20
It's like, hey, identity at the center.
14:22
We want to record a podcast, come into the room and get
14:24
interviewed by. Us if you if you guys.
14:26
If you guys come, I will find a room that you could use to make
14:32
to set up and post a podcast and you know, grab as many guests as
14:36
you want. So.
14:36
OK, Well, well, now, now we're cooking.
14:38
I think now you're speaking Gemini's language.
14:41
OK, yeah, let's talk about that. Because I've never been to one
14:44
and I've always been, I'll be honest, intimidated to show up
14:46
to something like that because I feel like there's just these
14:49
geniuses, right? You mentioned so many different
14:52
specs and protocols and frameworks that have come out of
14:54
this. Maybe they weren't created
14:56
there, but I mean you've you've basically named every single
14:59
thing that's used in Identity today has some sort of touch
15:02
point with IW. That's got to be really
15:05
gratifying. Yeah, it is.
15:06
I mean, if I, if I were to point to one thing I've done in my
15:09
life that I think has had a huge impact, it probably be IIW.
15:12
And, you know, I mean, frankly, I can't take tons of credit for
15:16
it, 'cause I don't do much. I mean, you know, I make sure,
15:20
you know, I charge people for their ticket prices, make sure
15:23
the food vendors get paid, you know, rent the venue.
15:26
But the content, right, really comes from all the people.
15:30
We don't even do a program, right?
15:31
We don't even have a program committee who decides what the
15:34
topics are. That's all from the attendees.
15:36
So it's really the attendees who make IOW what it is.
15:39
Wasn't that true? I think that's true for every
15:41
conference, right? The the, the, the more, I don't
15:45
know. Amenable attendees are to having
15:47
those conversations and this is one thing I've really enjoyed
15:49
about the identity space is everybody's just so gosh darn
15:52
friendly. I mean.
15:54
And in fact, that's that's exactly why we do IIW.
15:58
The way we do is because we think the best conversations at
16:03
most conferences are the hallway conversations.
16:06
And so we're trying to do a workshop where every session is
16:10
a hallway conversation. That's brilliant.
16:14
That should be like part of the marketing or logo or something
16:16
like that, Because you're absolutely right.
16:18
I mean, I've had some amazing hallway conversations that were,
16:23
no offense to the conference, way better than the conference
16:26
content, right? It's this, this dynamic
16:28
conversation that takes place. I always pointed back to the
16:30
example of Rodger Grimes spending an hour with me at a
16:34
table at Authenticate In. It would have been Seattle
16:37
talking about quantum computing. I mean, ridiculous conversation.
16:41
And I'm like, OK, this is awesome.
16:43
Seeing that IW you just call a session on that or sit at a
16:46
table. We have lots of tables set out
16:48
and lots of, I mean I suspect that there are probably you know
16:52
10 times the number of interesting conversations that
16:55
happened as there are sessions. The last IW there were 162
17:00
sessions, about 320 participants.
17:04
So, you know, two, you know, two participants per session.
17:08
Obviously it's spread out over time.
17:09
So you know, it's not really just two people in each session.
17:12
But yeah, it's a lot of sessions happen.
17:15
Some of them are small, some of them are big.
17:17
I mean, we have rooms that'll hold, you know, 60 people.
17:19
We have rooms that'll hold 5. So you're also you have a day
17:24
job. It sounds like you're also
17:26
working with AWS Identity. What's your role over at AWSI?
17:30
Guess what do you work on there? What's your day?
17:31
What's your What's your like day-to-day like?
17:34
Yeah, so so I am in AWS Identity and I manage a team of
17:39
developers working in the Identity space.
17:44
The most recent thing my team launched was AI.
17:49
Don't know if you're familiar with Amazon Verified
17:52
permissions. It's a fine grained access
17:54
control system based on the Cedar policy language that
17:57
launched in Gated Preview last June and then was generally
18:01
available, I'm sorry, Gated preview last November at
18:07
reinventing. It was generally available last
18:09
year my team launched a companion service to that that
18:14
allowed people who are also using AWS Cognito to use Cognito
18:19
tokens as part of the authorization context for their
18:24
for their authorization. So.
18:26
So that's the kind of stuff we do.
18:27
I'm very interested in authorization at this point.
18:30
Somebody at IW this last time in Closing Circle said that, you
18:36
know, they thought that the that I'm paraphrasing the
18:41
authentication is mostly a solved problem, right.
18:45
The the Fido and a few other things.
18:48
I mean we're not, I mean we might mess around with Fido at
18:52
the edges, but pretty much it's unfishable.
18:54
It's, you know, challenge response.
18:56
It works great. Yes.
19:00
We don't, we probably aren't going to get a lot better than
19:02
that, right. So what's the new thing?
19:05
What's really interesting, What should people be focusing on
19:08
authorization, right. I mean, when you think about it,
19:12
authentication is really the simple thing in the book, which
19:17
I know we're going to talk about in a bit.
19:19
But in the book I give a definition of identity, which is
19:25
Joe Andrews definition, right. And he says that identity is how
19:29
we recognize, remember, and respond to other people, places,
19:36
things, whatever. So if you think about
19:38
authentication, it's just about that first part recognizing,
19:41
right? So with authentication, we
19:43
recognize people, but you still have to remember who this is.
19:47
What are their attributes? What do I, what do I care about?
19:49
You still have to respond to them, which often means saying
19:52
what they can access, what they can't access.
19:55
So you know the the big part of Identity is really I think in
20:00
the authorization piece and that's where I'm focusing a lot
20:03
of my time right now is, is on authorization.
20:06
And that's a really tough problem.
20:08
I feel like a lot of organizations struggle with
20:11
authorization issues. I remember Sarah Cicchetti had
20:15
announced the Cedar kind of thing out there a while back.
20:18
And this is not a topic that we've actually been able to
20:21
touch on for people who aren't familiar with Cedar.
20:23
And we should probably do a whole episode on this
20:25
separately. You should, yeah.
20:26
What is, I guess, what's cedar in a nutshell?
20:29
Yeah, so Cedar is a policy language, right?
20:34
That allows you to write policies.
20:37
It is principal action, resource condition based.
20:41
Like a lot of policy languages, it doesn't have loops, doesn't
20:46
have recursion. So it's not Tory complete,
20:48
right? You can't write programs in it,
20:50
but you can say things like permit, you know, users who are
20:55
part of the resource owner group to make updates to any resource
21:03
in the photo album, right? And so that's the kind of thing.
21:08
But you also could add conditions to that.
21:10
You could say if it is, if the time is between 8:00 AM in the
21:14
morning and 5:00 PM at night or you know those kinds of things
21:17
so so you get this permission action resource triple.
21:23
And then you also have conditions so that you can do
21:25
attribute based access control as well.
21:28
A Cedar comes with an evaluation engine that is open source on
21:33
GitHub. It's a great tutorial at
21:36
cedarpolicy.com that people can go and play with.
21:41
Amazon Verified Permissions, which I mentioned a minute ago,
21:44
is a hosted service that essentially runs Cedar for you,
21:49
you know, makes it easy so you don't have to manage your own
21:52
policy store and you know, all of the all of the things that
21:57
services do, right. I mean, certain services are
21:59
great at at those kinds of things.
22:01
So, so yeah, that's that's what Cedar is in AVP.
22:04
So, Phil, you've wrote a book called Learning Digital Identity
22:08
under O'Reilly Publishing, O'Reilly Publishing.
22:11
Whenever I think of those books, I think of the animals on the
22:14
cover. Yeah, there's an animal on your
22:16
cover and I'm wondering, what is that animal and how did it get
22:20
there? Yeah, so it's a it's a Nanking
22:23
Night Heron and it's from Australia.
22:28
And one of the things that is true about O'Reilly books is
22:37
authors don't get consulted about which animals go on the
22:40
cover. So you don't get to pick.
22:42
Right. So.
22:42
So it's not like the 9 Nanking Night Heron is my spirit animal
22:48
or anything. However, you know, there's a
22:51
colophone in the back of the book that talks about it.
22:54
And one of the things I think is really interesting is it it says
22:58
that the Night Raven in ancient Greeks, which is what the Greek
23:08
name for the bird is, was used to describe thirds of the ill
23:12
omen. So I'm not sure why A Bird of
23:15
the Hill Omen is on the front of my book, but yeah, there it is.
23:19
There it is. So is this the first book you
23:22
wrote? You mentioned that you wrote a
23:23
book in what was it, 05 or 06, 2005?
23:27
So in 2005, under O'Reilly was the same bird the night.
23:32
Down now at that, at that point they had a different series and
23:36
so digital identity was classified in their security
23:39
series. And so they were doing old I
23:47
guess woodcuts or something from like the medieval time period.
23:51
And so I've got some woman on the front of the book.
23:54
I don't know. I don't remember what the
23:57
significance of that was. And then I wrote, I wrote
24:00
another book in 2012 on event processing.
24:04
So not digital identity. And did that have an animal?
24:09
No, it was not for O'Reilly. It was a sand gauge book.
24:11
So got you. Yeah, I did get to design that
24:15
cover. Actually.
24:15
I had a friend of mine design it, but yeah.
24:18
So I found the I forget how I got turned onto the book, but I
24:23
was like, OK, I'm going to order this and I was expecting it to
24:26
be Digital Identity for Dummies. It's definitely not Digital
24:31
Identity for Dummies. It's it's thick.
24:34
It's it's meaty. The text is not huge.
24:40
There's a lot in there. Who's the book for?
24:42
So our our podcast, I tell you, is for the IAM practitioner.
24:46
People were taking all these great ideas and and putting them
24:49
into work in the real world. And you know, I think that
24:54
describes a lot of us, right? You you do that on your in your
24:57
day job. Who's The Who is the book for?
25:01
Yeah, so, so I think that matches, right?
25:04
I I wrote the book for IAM practitioners.
25:08
My hope was, you know, not not to be an introductory book,
25:12
although I certainly think people do read it as an
25:14
introductory book. But to be a a complete kind of
25:21
almost umbrella over the field of digital identity, 'cause I
25:25
think too often I am practitioners.
25:28
I mean, there's a lot of, there's a lot of books, fine
25:31
books, right? For, for the purpose that they
25:33
that they are trying to to solve for the problems they're trying
25:36
to solve that are kind of aimed at oh, here's how you use Open
25:40
ID Connect to authenticate users in on your application.
25:44
Right. And I mean there'll be a great
25:46
big book about lots of, you know, very meaty, lots of code
25:50
examples that sort of thing. This book does not have specific
25:55
code examples, right. This book is not going to tell
25:56
you how to use Open ID Connect in your, you know, Java
26:00
application to, you know, do whatever.
26:03
It's it's trying to teach you about what the field of digital
26:08
identity is from a holistic standpoint.
26:12
So you know, so it starts off, you know, like we just talked
26:15
about, with a definition of digital identity.
26:17
It talks about why digital identity is hard.
26:21
It introduces Kim Cameron's Laws of Digital Identity, which if
26:26
you're if you're an identity professional and you don't know
26:28
Kim's laws, then you really ought to learn Kim's laws
26:31
because they they tell you why it's So what, why identity
26:36
system so often fall short. That doesn't mean they're bad,
26:39
right? Because often identity systems
26:41
are built for a specific purpose.
26:43
They might not fall short in the terms of the specific purpose,
26:46
but what happens then is somebody says, you know, product
26:49
manager somewhere says, oh, we should, you know, let our users,
26:52
you know, add, you know, yellow buttons to this part or
26:56
whatever. And identity people go, oh, no,
26:59
we can't do that. I mean that that isn't going to
27:01
work. We can't support that or that'll
27:03
take six months of work before we can.
27:05
And that's because, you know, the identity system was built
27:07
for a specific purpose. And like I said, that's fine.
27:10
I mean, that's how that's how things work.
27:11
But yeah, the laws of identity try to get you to.
27:16
Yeah. To to think about identity more
27:19
holistically. And then, you know, the book
27:21
kind of goes into some general topics, things like trust,
27:25
privacy, those kinds of things. And then we get into some
27:30
specific things like how does authentication work, you know,
27:34
and I do talk about Open ID Connect and I do talk about Fido
27:37
and some specific technologies. But like I said, not in a way
27:41
that you know is here's how you use Fido in your application.
27:44
More about why would you think about using Fido instead of Open
27:47
ID connector, Why would Open ID Connect be a good thing to use
27:50
in certain circumstances? And I try to go back as often as
27:54
possible to the laws, right, And talk about why this specific
27:59
technology, which laws is it trying to meet and which laws
28:03
does it not meet? Is that OK for your application?
28:07
Talk about authorization. Talk about Federated ID.
28:11
Yeah. And how Federated identity
28:13
works. And then probably the last third
28:17
of the book or so I get into what I think is the next
28:21
frontier of identity, which is I use the term self sovereign
28:25
identity. Some people say decentralized
28:28
identity. I I am very opinionated about
28:32
this. I I like the term self sovereign
28:35
identity because I can imagine decentralized identity systems
28:39
which don't give the user control over their data and
28:45
identifiers. Self Sovereign very clearly puts
28:48
a stake in the ground and says the user has to have control
28:52
over this and that's that. So that's why I like and so the
28:55
last start of the book really talks about the the, the
28:58
technologies and protocols for doing self sovereign or
29:02
decentralized identity things like did com verifiable
29:06
credentials that sort of thing. You have to follow up on.
29:10
We're talking about the laws of identity.
29:13
So Kim's laws. I remember I was at digital ID
29:16
World in O5, right? And it was like when these
29:20
things were brand new and I was as green as green can be to the
29:26
the industry. Are they, are they still
29:29
relevant? I mean, this is 18 years ago.
29:32
That's that's I think what is so interesting about them and and
29:37
why I think they deserve the word laws.
29:40
But they're not laws in the sense of legal laws.
29:42
They're not laws in the sense of you know, the laws of physics,
29:46
right. But they are laws in the sense
29:48
of they they describe big enough concepts in general enough terms
29:55
to to still be specific enough to be useful but to not go out
29:59
of date. And and I think that's one of
30:02
the things that makes them laws and I I believe they're still
30:06
extremely useful. You know, there's things like
30:10
user control and consent, and Kim makes a stand on what are
30:15
what. How digital identity system
30:17
should enable user control and consent.
30:21
So you can ask yourself a question, does the identity
30:23
system I'm using enable user control and consent or to what?
30:27
What extent does it enable user control and consent and is that
30:32
OK? Minimal disclosure for
30:34
constrained use is another one. I mean that's kind of timeless,
30:37
right? I mean that's the kind of thing.
30:38
I mean identity systems, which haven't respected minimal
30:42
disclosure for constrained use is what's gotten us into the
30:44
whole privacy debacle that we're in that now, right, with people
30:48
worried about AII mean, you know, how does digital identity
30:54
relate to artificial intelligence?
30:56
I think artificial intelligence without a good self sovereign
30:59
identity system is just a disaster waiting to happen.
31:03
All right. So So Kim's laws, I think, are
31:05
still very, very relevant. I think you know as you were
31:09
saying that I'm like one of the things that attracted me to the
31:12
identity space was going to those orally conferences and
31:15
seeing this isn't just technology, ones and zeros and
31:19
how to plug this in to make it work with that it's there's a
31:23
philosophical layer that. There is.
31:26
It's always. Just beneath the surface of
31:29
everything. And maybe AI is like the next
31:33
industry where that can happen because it seems like every
31:36
other kind of industry within IT kind of gets boring and just
31:44
gets commoditized. Like I I originally entered the
31:47
space coming from the network engineering side of the house
31:51
and it's like everything that I used to do got commoditized in
31:55
terms of like data centers all just got outsourced.
31:58
Like nobody run physically run servers anymore.
32:02
I mean, I'm sure some people do, but it's certainly shrunken down
32:06
in terms of the overall population of IT professionals.
32:10
But Oh yeah, yeah. Yeah, back to the book.
32:15
One of the things that that blew me away, like again, I was like
32:17
kind of expecting digital IT, Digital ID for Dummies.
32:23
Not saying that in any kind of insulting way.
32:25
I think those books are fantastic, you know.
32:30
But what I also saw was like this is like an encyclopedia and
32:34
I'm wondering like how does one person know all this?
32:37
So did did you write the whole thing yourself or did you have
32:41
like sub authors or how does that work?
32:44
I wrote the whole thing myself. I mean, that doesn't mean that
32:47
all of the ideas are mine. I mean, you know, I've, I've
32:50
gone to, you know, 37. I I WSI, yeah.
32:53
One of the things I I write A blog at winley.com.
32:57
My name. And one of the reasons I write
33:00
is, you know, I tell people I write for me write it.
33:04
I write so that I can understand ideas and get them in my head.
33:09
You know, if they happen to be useful to other people, that's
33:11
great. But, you know, I like to write
33:13
them down, 'cause it's how I process information and how I
33:17
come to understand things. So, you know, some of the things
33:20
in the book actually came from my blog.
33:22
Obviously, you know, modified, edited, expanded, that sort of
33:25
thing. But yeah, just I just kind of
33:27
collect this stuff. And, you know, I I originally,
33:32
like, like we discussed, I wrote a book in 2005.
33:35
My original idea was to write a second edition and and I've been
33:40
meaning to write a second audition of digital identity for
33:44
probably 12 years now since 2010 or so.
33:48
And you know I've held several sessions at IOW saying hey you
33:53
know if you're if I go to re redo this what should I put in
33:56
it. You know, people always gave me
33:57
ideas and then you know, the whole self sovereign identity
34:02
thing happened. And I I knew I wanted to do a
34:04
book that included that. But I also wanted to not just do
34:09
a book a self sovereign identity, I wanted to do a book
34:11
that was, you know, covered the digital identity from, you know,
34:15
start to finish and kind of had like you mentioned, of kind of a
34:19
philosophical base to it. You know, one of the things I I
34:25
like to say is that digital identity isn't about identity,
34:29
it's about relationships. People build identity systems to
34:33
manage relationships, not to manage identities.
34:36
The identities are just the the things they need to put in them
34:39
in order to create the relationship.
34:41
And so I wanted to include all of that in the book.
34:44
And so I started putting together a table of contents,
34:47
which if you ever in a book, that's like the first thing you
34:49
do, right, is you write a book proposal that includes A
34:52
detailed table of contents. And you know, when I sent it to
34:55
O'Reilly, they said, wow, this is great, but this is way too
34:59
different to be a second edition.
35:01
So it's going to be a new book. I said, OK, so it's a new book.
35:07
How do you suggest someone read the book?
35:09
Like do you attack, attack it from cover to cover or do you
35:14
that maybe I could say here's what I did.
35:16
I decided to attack it from page one.
35:19
I probably read the first three or four chapters, but then I got
35:23
excited about different areas. I was like, I can't wait to get
35:27
to this chapter. So I jumped ahead and read the
35:29
chapters that I wanted. Yeah, Well, I mean I think that
35:36
a lot of the chapters are standalone.
35:38
So for example, you know, like like I said, I lead a team in
35:42
AWS Identity. Not all of them are Identity
35:44
experts, right. They're developers who came from
35:46
different areas. You know, I'll just point them
35:50
at chapter, you know 11 and say hey, you know, you need to go
35:54
read about authentication and how Open ID works.
35:57
You can go, you can just go read Chapter 11 and kind of
36:00
understand authentication. Now it's going to refer back to
36:04
things. It's going to say, oh, you know,
36:05
here's the definition of identity and authentication is
36:08
about recognizing people. It's going to do those things.
36:10
It's going to refer back to the laws of identity.
36:13
So. So you can probably pick out
36:14
almost any chapter and just read it by itself without having read
36:19
anything. That said, I think what you did
36:22
is probably how I'd recommend people read the book because
36:24
you're certainly read probably the 1st 5 chapters.
36:29
They're probably the the chapters that layout kind of my
36:32
overall philosophy of how I approach identity and how I
36:35
think about it. But then after that, you know,
36:37
if you're interested in, you know, how does privacy work,
36:41
Chapter 8 works great. You know Chapter 9 is kind of a
36:47
general developer's intro to cryptography, right?
36:50
I mean, it's not going to teach you to be a cryptographer.
36:52
It's more if you're doing identity cryptography is
36:56
everywhere, what do you have to know about cryptography in order
36:59
to do it? So you know, you might go into
37:01
the, you know, to the authentication chapter and get
37:04
into some section and say, OK, and it says, oh, we use digital
37:08
signatures to validate the token.
37:09
And you're going to say, what's a digital signature?
37:12
Well then go back to Chapter 9 and read about digital
37:14
signatures. I think that's a perfectly valid
37:17
way to read the book. Yeah, and like I said, I'm
37:20
giving my endorsement. Great book.
37:23
How can people get their hands on the book and is there an
37:26
audio version? There is not an audio version
37:31
but you know you should suggest that to O'Reilly on their on
37:34
their website. You know to go in and suggest,
37:36
oh we need an audio version of this.
37:39
Yeah. So I mean obviously Amazon is a
37:42
is a good way to do it. It's it's available on on on
37:48
O'reilly's site. You know, if you're if you're
37:51
part, if you're a member of O'reilly's for what they call a
37:55
Learning Center, you have access to the book.
37:58
Ping Identity actually bonds writes to the book to publish on
38:02
their website and you can go get chapters of the book.
38:07
I think they're serializing and I don't know what they're up to
38:09
now but Ping Identity has it on their website.
38:11
So any of those are great ways to do it.
38:14
Yeah. Go to my blog and click on the
38:16
link and that'll take you to Amazon.
38:18
So. We'll put links in the show
38:20
notes so anybody can, you know, grab a link and hit find the
38:25
exact, you know, place to go and purchase a book if that's what
38:29
they're interested in. You know, I I kind of wonder
38:33
like if you were not the person reading the audio audio book,
38:38
who would you choose to read it? Just well, I pick you, Jim.
38:43
Oh God, it would make it would make it twice as long.
38:47
What else can I say? Yeah, That's a good question.
38:50
Morgan Freeman is who came to my mind.
38:53
Yeah, I I think I'd pick Doc Searles.
38:55
He has a great radio voice. He used to be in radio way back
38:58
in the day. So.
38:59
So yeah, I think he'd he'd do great and I'd pick Doc.
39:02
All right. Plus one for Doc.
39:05
OK. So now I wanted to talk more
39:07
about what was it like to write the book.
39:11
And so kind of broke this into a couple of questions.
39:15
What was the hardest chapter for you to write?
39:17
Probably the intro and the last chapter so so the intro.
39:24
I always wait till the end. So when I started writing I I
39:28
pretty much wrote it in order. I started with chapter 2 and
39:33
went on through, but I didn't write chapter one, partly
39:37
because I think introductions are hard to write, especially
39:41
before you've written the book. You know, 'cause you really want
39:43
the intro to be an intro, right? You wanted to talk about what
39:46
the book's gonna say. And so, you know, I wait till
39:49
I'm done and then I write that. And so chapter one is probably
39:53
one of the hardest chapters. You know, all of them involve a
39:58
little bit of of research. I mean, you know, even now you
40:04
know somebody will talk about Samuel and I'll pick up my book
40:07
and. Go look at the sample section,
40:09
'cause I don't remember all that stuff out of my head, obviously,
40:12
you know, so. So there's a little bit of
40:14
research in all of it though. The last chapter though, I think
40:17
was also not difficult, but it was challenging because I wanted
40:24
to talk about me my my goal right in.
40:30
I think digital identity is foundational to how we live our
40:34
digital lives. In fact, I say that several
40:37
times in the book that without digital identity systems that
40:43
respect individuals and their rights, we cannot expect to live
40:48
effective online lives and have any degree of privacy.
40:53
They'll they'll always. I mean, don't get me wrong, I I
40:56
think the current world of the Internet is actually amazing.
41:00
But it's like living in Disneyland in the sense that
41:03
it's all curated, right? It's all these experiences that
41:07
Google put together for you, or Apple put together for you or
41:10
whatever, and you really aren't having a authentic human
41:15
experience where you connect with people.
41:20
You know, I like to use the example of going to a
41:22
convenience store, right? If we put a convenience store
41:25
online, you would have to actually have relationships with
41:29
like the coffee maker and the people in line with you.
41:32
And you know, you'd have to like exchange identifiers or you
41:36
know, or maybe the convenience store would have a login system.
41:39
You had to log in so that you could even talk to the other
41:42
people in line. I mean, that's what it would be
41:44
like. That's not authentic.
41:45
That's not how humans live. So, so, so I'm, I'm ranting, as
41:50
you can tell, but but if you want to live effective digital
41:53
lives, we have to have identity systems that respect human
41:59
rights, human privacy, give people control over their
42:03
identifiers, over the data that those identifiers are linked to.
42:07
And so I I wanted to end the book in a way that help digital
42:13
identity practitioners understand that they were
42:18
building the future and the future was what they decided it
42:22
was going to be, Right? The future is not preordained.
42:25
It is based on what we build as practitioners.
42:29
What, And you know, we can say, oh, but Google, Apple, blah,
42:33
blah, blah, we all build it, right?
42:36
We go to work for them. We decide what kind of systems
42:39
we're going to build. We decide what kind of systems
42:41
we're going to advocate for. And if we advocate for systems
42:45
that help people live good digital online lives, then then
42:51
we've built something great and we have built a future that is
42:56
worth living in. You know, I said, I think I
42:58
close with a quote by Shoshanna Zubov, who wrote the book on a
43:03
surveillance capitalism. You know, and and I can't
43:07
remember her exact question, but it's something like is is the
43:10
future, is the digital future when we want to live in?
43:13
And you know, my answer is a hearty yes.
43:17
So long as digital identity practitioners built the future
43:21
they want to live in, not the future they want to avoid.
43:26
So anyway, there that, that's my spiel.
43:28
And so I I wanted to write the last chapter in a way that led
43:32
people to that and help them feel a sense of purpose and
43:36
responsibility for the for the digital future.
43:40
And whether it succeeded or not, I don't know, but that's what I
43:43
wanted to do. So it was a challenging chapter
43:45
to write. Yeah, I know that's I think the
43:48
the whole introduction like made a lot of sense to me because
43:53
writing it at the end probably makes the most sense.
43:56
But I also like that you brought up Surveillance Capitalism,
44:00
another great book, right. All of our listings, if you're
44:04
looking for that that reading list for 2024, that's a good one
44:09
to put on the list. I'm wondering Phil, so when I
44:12
again with how much is in here and I'm sure when you sent the
44:17
the outline over to the O'Reilly people they're probably not only
44:21
like is a separate book but this is like a an epic especially if
44:27
you did your day job while you're writing the book.
44:30
So so did you take a hiatus in order to write the book or just?
44:34
Do it at night. I didn't.
44:36
I wrote it mostly at night and on weekends, you know.
44:41
Thanks to my wife Lynn for putting up with all of that.
44:46
But but yeah it was I I wrote it in about a year and you know do
44:51
you have an editor and you know I I try to be nice to my editors
44:55
and give them their chapters when I've promised them and they
44:58
get and they do give you a schedule, right.
45:00
They they say, OK we want half of the chapters turned in by
45:03
this date. We want, you know, another
45:04
quarter turned in by this date, so on.
45:06
So yeah, so I tried to make make their schedule and got it done.
45:12
So did did as you're going it. Did much of what you're working
45:16
on end up on the cutting room floor?
45:18
I mean, it seems like that, you know, you look at something
45:22
that's written it, not just the 20 pages that made it.
45:26
It's all of the editing and everything.
45:28
Yeah, yeah. Well, and I and I mentioned I
45:31
had an editor and actually love working with editors.
45:34
You know, some people don't. They don't like having their
45:36
work criticized. Whatever.
45:38
I I, I love that someone is going to spend their time making
45:41
me look smart. And that's what editors do,
45:44
right? They make they make your writing
45:45
look good. They tell you when things don't
45:47
make sense and you know when you need to clarify something.
45:51
So I I don't know how much ended up on the cutting room floor,
45:54
but I will tell you that lots of stuff changed as we went into
45:58
the editing process moved things around.
46:00
You know she'd asked questions. I'd add a new section.
46:03
I'd move a section. I'd, you know completely redo a
46:05
description and that that kind of thing.
46:08
So yeah, the the editing definitely changed the book, and
46:11
for the better. Oh, that's really cool.
46:14
So what does it feel about the book, or about the experience of
46:17
writing the book, or whatever, that you're most proud of?
46:21
Well, I mean, I feel like I accomplished the goal that I set
46:25
out to which we just discussed, right?
46:27
Getting people to the end of the book with a call to action with
46:30
with a feeling for that they understood the world of digital
46:33
identity. That they knew how important it
46:35
was, that they knew the concepts and the underlying technologies
46:41
and could could then go out and say OK I know that we should be
46:45
doing it this way or we need to work on minimizing, you know the
46:51
the information we ask users for.
46:54
You know, whatever that is that's that's what hope they do.
46:57
And I think the book gets there. What whether people agree with
47:00
me or not on that, I don't know. But that's, you know, I think
47:03
that's where the book got to, and I and I hope that's, you
47:06
know, what people get out of it. Yeah.
47:09
And I think, yeah, it was definitely the opportunity to
47:12
get that and and probably introduce a lot of people to
47:15
some of these concepts who haven't been in the industry as
47:18
long as as you have. Last question about this is you
47:23
talked about the 2nd edition of the first book.
47:25
Will there be a second edition of this one?
47:28
And if if you were to write a second edition, what would be
47:31
different? Yeah.
47:33
So if I were to write a second edition right now, obviously
47:37
it's only, you know, less than a year old.
47:40
So I probably wouldn't change the structure too much.
47:44
But I mean, if you look at my blog, you'll see all of the
47:47
stuff I've written about since the book came out is is stuff
47:51
that likely I would think about adding, you know, so, you know,
47:58
I've got, you know, even just, you know, most recent things, I
48:03
mean things like permissionless and 1:00 to 1:00 computing at
48:08
the edge, you know, those are all topics that I think zero
48:12
data, I mean zero data, zero trust.
48:14
I mean, I don't even mention the word zero trust in the book.
48:17
And yet that's, you know, I think a huge topic that people
48:21
care about. You know, as I've gotten more
48:23
into authorization, that's clearly one of the one of the
48:26
use cases for authorization is zero trust.
48:28
So, so you know those are things that you know, now I go my word,
48:32
why didn't I think about zero trust and put that in the book,
48:35
But you know at the time it wasn't in my radar.
48:38
So. So yeah, there are, there are
48:39
plenty of things I would add, don't know that I'd cut much,
48:44
not yet anyway. But, you know, some of the
48:47
chapters, you know, if you look at the first digital identity
48:51
first book I wrote and look at the chapters, you'll see there
48:54
are chapters that are have essentially the same title.
48:58
And, you know, some of the sections sound similar, but, you
49:04
know, they're, they're largely rewritten.
49:08
You know, like in the chapter on authorization, I do talk about
49:10
mandatory access control and discretionary access control.
49:14
Those are things I just lifted from the first book and rewrote.
49:18
But yeah, so. So yeah, I don't know that I'd
49:21
drop much. But, you know, if you ask me in
49:23
five years, yeah, there's probably stuff that I'd sell.
49:25
Nobody cares about that anymore. I feel like this is the space of
49:28
identity, right? There's always something coming
49:30
and going. Like I mentioned earlier, right?
49:32
I mean, we started IIW literally with the idea.
49:35
We all had things we wanted to work on.
49:37
Doc was interested in, in, you know, personal data.
49:40
I was interested in reputation systems.
49:44
And we thought, oh, we'll solve this identity problem, then
49:46
we'll go off and work on the things that we care about.
49:48
And we're now, you know, in April, we're going to hold the
49:50
38th edition of IIW. And it's always fresh.
49:54
It's always got new topics. Yeah, it's it's like this
49:58
identity is this Evergreen topic because we're constantly
50:01
learning new things about it and, you know, expanding what we
50:05
think is important. Is there a new topic or topic du
50:09
jour that you've seen really kind of take hold and let's say
50:13
the last six months, maybe the last two or three Iiws?
50:17
Is there something that's like wow, this is starting to catch?
50:20
Fire. Well, I mentioned one
50:22
authorization. I think authorization is a is a
50:24
big topic that people are starting to pay much more
50:27
attention to than they have in the past.
50:29
The other one that is clearly been a topic of conversation at
50:34
Iowa for probably the last four years has been self sovereign
50:38
identity, digital identity, you know protocols like did com
50:43
systems like verifiable credentials, how do we make
50:46
those work? What's user uptake, how do we
50:48
get adoption for those? So, so yeah, that's been a huge
50:53
topic. I mean IW has in some ways been
50:56
Ground Zero for that topic over the last few years.
50:59
So yeah, those those are big. I want to pick your brain on
51:05
sort of identity itself and from an innovation standpoint, what
51:09
do you think is the most, I don't know, important identity
51:13
thing that's come into play recently like let's say within
51:18
the last maybe year or two? I would probably pick
51:22
Decentralized Identifiers and Verifiable Credentials.
51:25
They they mean decentralized identifiers.
51:28
Especially the peer DID method change how identifiers work in
51:34
some fundamental ways. And the most important way is
51:38
that decentralized identifiers, like I said, especially peer
51:42
Dids, are meant to be controlled by people in wallets.
51:48
And that is, if you think about, you know what I was saying
51:53
earlier about why what, what it, what's it going to take for us
51:57
to lead effective online lives? That idea, right.
52:02
I think the biggest thing standing in the way and this is
52:07
going to go to Jim's philosophical bet is we are not
52:12
digitally embodied. If and you know I I cause we've
52:18
got video I can see it kind of squinting a little bit what does
52:20
Phil mean by that. Well, what I mean, what I mean
52:23
is if you think about, obviously anybody could stand up a
52:28
website. I mean there's something
52:30
stopping my mom from standing up a website, but the she's not
52:36
going too right. It means so who are the things
52:40
online or what are the things online that we think about as
52:43
being the places we go? Well, they're all, they're all
52:46
things run by companies and most of them are run with what I term
52:51
intervening administrative authorities, meaning that the,
52:55
the identity administrator is sitting between you and whatever
52:59
you want to do, right. They're intervening in this
53:01
interaction. We don't have any place to stand
53:06
in the online world. The browser, isn't it right?
53:09
The browser is client server. It's a client.
53:11
It's on the server. Server is making all the
53:14
decisions. The client is just echoing
53:16
whatever the server tells it to. What do we, what is it going to
53:20
take for us to be embodied, To have something where we are
53:24
online work, where you and I can exchange messages without any
53:28
intervening system? Well, what I think it takes is
53:33
it takes what people are calling digital wallets.
53:36
And so, you know, what do I think is the most exciting,
53:39
interesting digital identity thing right now?
53:42
Digital wallets and how digital wallets allow us to create peer
53:46
identifiers, exchange those peer identifiers, exchange trust
53:51
information with each other, you know, verifiable credentials and
53:55
essentially be the masters of our own system, right.
53:59
And you know phones, the things that we carry around in our
54:02
pocket, give us platforms that we can use those digital like
54:06
digital wallets in. And I think that that is the
54:10
most important and exciting thing that is coming along right
54:13
now. All right.
54:14
Last question before we start to wrap things up with a lighter
54:16
note. Where do you see AI taking
54:19
identity in the next five years? Yeah, yeah.
54:22
So. So I think that I think I said
54:25
earlier, AI without a good self sovereign identity basis is
54:30
pretty scary. What's fake?
54:34
What's not? Who created what?
54:36
Who didn't? Are you really you or are you a
54:40
fake you? How do I know that you're really
54:42
you? How do I know that you're human?
54:44
How do I guarantee that you're human?
54:46
Well, I mean think about, so think, think about just that
54:51
question. How do I guarantee you're human?
54:54
How do I know that you're human? And now think about how we do
54:57
that. This is 2023.
54:59
You go to open up a new bank account.
55:00
How do they do it? They do like a zoom call with
55:03
you and have you hold up your driver's license in the call
55:06
with them. I mean my word talk.
55:10
I mean this is like Stone Age technology compared to.
55:14
Neanderthals, yeah. Yeah, what we could do, right.
55:17
And and so in order for AI, in order for us to coexist with AII
55:22
think we have to be able to prove online that we're human.
55:25
We have to have clear ways of knowing when we're interacting
55:29
with an AI and when we're not. That is all going to be based on
55:34
self sovereign identity systems. Or I mean I don't know that it's
55:37
actually going to be did come in a verifiable credential spec,
55:40
but it's going to be something like them.
55:41
But it's going to be something where I have identifiers that I
55:46
control in my wallet and can prove that I'm human without
55:50
having to hold up my driver's license and a zoom call to you.
55:53
So, so those that's where I think AI takes identity.
55:57
I think it drives this need for self sovereign identity even
56:00
further than it has been. I know we're running long, but I
56:04
I just have to have ask two more questions here.
56:07
We talk about Self Sovereign Identity and I I I put a poll
56:11
out recently on one of our episodes, 'cause we had a
56:14
conversation around blockchain on the identity side of things.
56:17
And basically the poll question was who would you trust to run
56:21
your decentralized identity platform?
56:24
And I think that's going to be a problem for adoption is who does
56:30
run, you know, this decentral platform?
56:32
Is it the government? Is it education?
56:34
Is it healthcare? I mean, given where we're at
56:37
today politically in the US, if the government does it, 50% of
56:40
the population is immediately out.
56:43
Yeah, like, who do we trust first?
56:44
Of all, first of all I would say it doesn't need to be a
56:47
blockchain. And there are lots of ways to
56:52
decentralize identity and create self sovereign identity systems
56:56
that don't necessarily require the the somebody to run
57:03
something. So for example with peer Dids we
57:06
can all create whatever Dids we want, You and I can exchange
57:09
them, we can all, you know, vouch for each other.
57:12
We could create reputation systems.
57:14
None of that requires any kind of platform at all.
57:18
Now, that doesn't mean I don't believe we don't.
57:21
We won't get benefit out of a platform.
57:24
So for example, if I want my driver's license as a credential
57:30
that I hold in my wallet, there needs to be something that can
57:33
tell me that that driver's license really came from the
57:36
state of Virginia and not from, you know, I did just make it
57:39
myself. How's that going to work?
57:42
Right. So, so there's a, there's kind
57:43
of a new term that people are floating around called
57:46
acceptance networks. We could probably do a whole
57:48
show on just acceptance networks, but that's that's
57:51
essentially I think what it's going to take.
57:53
It's not going to be a company, right?
57:56
It can't be a company. It has to be a protocol, A
58:00
governance model. It has to have lots of people
58:03
who have bought off on it and you know there there can be more
58:08
than one one acceptance network. There doesn't have to be 1.
58:12
When I say acceptance network, the best example we have of
58:15
acceptance networks are Visa and MasterCard and American Express.
58:20
They're all acceptance networks. They have governance, they have
58:23
technology, they have protocols, they have processes.
58:26
And all of those things make it so that I can walk into a
58:29
merchant in London, slap down a little piece of plastic and that
58:33
merchant is almost guaranteed that they're going to get paid.
58:37
But that's that's magic. Why does it work?
58:40
Well, it works because governance, process, protocol,
58:43
technology of them all come together and solve that problem.
58:46
That's what we need. We we need that sort of thing
58:48
doesn't have, it shouldn't be run by the government, doesn't
58:50
shouldn't be run by a single company.
58:52
But we're going to have something like that, maybe
58:55
multiple some things like that and you know we'll decide which
58:59
ones we want to use based on where we want to do business,
59:02
so. All right.
59:04
Final question. Go back to AI because I just
59:06
have to How do you see that impacting your book writing
59:09
process in the future? Well, you know, it's it's
59:12
interesting. So I'm I have tried to
59:16
incorporate generative AI in multiple places in my life.
59:23
So I use AI like a virtual assistant, but I don't like to
59:28
just ask it to write sections 'cause I think it produces text
59:32
which at least at this point, you can still kind of tell It
59:35
wasn't written by me at least because I have a certain writing
59:38
style. And even if you say, oh use the
59:40
style of Technometria blog to to do this, it still doesn't write.
59:44
So what I do is I like asking questions.
59:46
So I I don't know, I mean one of my favorite books and there's a
59:50
whole store back story to this. One of my favorite books is a
59:53
book called Snow Crash. And in Snow Crash, the
59:56
protagonist who is named Hero Protagonist uses this.
1:00:03
AI called the Librarian. And this Neil Stephenson wrote
1:00:07
this book like in 2004. Something like that.
1:00:10
No, no, sorry. So 1994.
1:00:12
I mean, long ago, right? And if you go list, read the
1:00:17
read the dialogue that hero has with the librarian, that's what
1:00:21
you should be doing with Chachi PT, right?
1:00:24
So I'll ask Chachi PT. Something like tell me how this
1:00:29
particular company enables zero trust or what their product does
1:00:33
to And then I'll say OK, but what about this, do they And so
1:00:38
I'll ask it for information. Now you have to kind of take it
1:00:41
with a grain of salt because as Johanna Stern says, these are
1:00:45
large language models, not large fact models.
1:00:48
So, so you you say you have to know enough about the subject to
1:00:51
be a good interrogator that I use it.
1:00:55
I interrogate it all the time. In fact, I am giving all of my
1:00:58
kids at 5, giving all of my kids a $250 gift certificate and a
1:01:05
instruction sheet on how and and I'm expecting them to use the
1:01:09
$250 to subscribe to chat sheet PT for one year.
1:01:14
It's because you do get some benefits from subscribing and to
1:01:18
to incorporate it into their lives.
1:01:19
So, so that's how important I think it is.
1:01:22
I I want all of my kids to know about it and that's my Christmas
1:01:24
gift to them. I think that's cool.
1:01:26
I'm, I'm, I'm a ChatGPT subscriber and I've built, I
1:01:29
think, let's see, three or four different specific models for
1:01:34
different types of use cases and yeah.
1:01:37
That's one of the things you can do as a subscriber that you
1:01:40
can't as a non subscriber and I agree with you, that's really
1:01:43
important. And I think it's it's a good way
1:01:45
to learn it. But it's also really interesting
1:01:47
to see how the the technology is evolving literally right before
1:01:51
your eyes. And you know it's the ultimate
1:01:53
low code experience, right? Tell me this, do this and you
1:01:57
see it take shape. From you it feels, it literally
1:02:00
feels like the web in 1994. But with better graphics.
1:02:06
He went better graphics. All right, let's end on a way to
1:02:09
go. This is definitely one of our
1:02:10
longer episodes, but I've. I've really enjoyed this
1:02:12
conversation. Before we started talking, we
1:02:15
were talking about hobbies and you mentioned that you're into
1:02:18
bicycles, and they said, OK, well, what kind of bicycles?
1:02:20
And then you started rattling off a bunch of bicycles.
1:02:23
Rd. Gravel.
1:02:25
I've got a Specialized road bike, which is a road bike.
1:02:29
I've got a Cannondale Quick CR1 which is kind of a gravel bike.
1:02:34
I've turned it into a gravel bike.
1:02:36
I've got a Trek Super Commuter plus eight that is AI use it for
1:02:42
commuting, but it's electric bike.
1:02:44
I also use it for longer rides like on bike trails and stuff.
1:02:47
And then I've got an electric bike, mountain bike, which is a
1:02:50
a Specialized. Oh, now I'm going to forget the
1:02:53
name of it. Anyway, yeah, all great bikes.
1:02:56
I I I love all of them. I can't part with any of my
1:02:59
babies. Why do you need 4 bicycles?
1:03:03
Well, it kind of depends on the mood you're in, right?
1:03:05
I mean, sometimes I want to go out on a trail and so I take
1:03:10
the, the mountain bike, Sometimes I'll take the gravel
1:03:14
bike. If I'm, you know, feeling
1:03:16
especially spry, I've kind of, you know, I'm more, I'm more
1:03:20
prone to take the electric bikes nowadays, I have to admit, you
1:03:24
know, I find that it is true that the electric bike is less
1:03:28
work. My running theory is that, and I
1:03:32
have some data to back this up, is that on a mile per mile basis
1:03:37
you're doing 65 to 70% of the effort on the electric bike.
1:03:41
Of course it depends on how high you have it dialed up, but doing
1:03:44
60 to 70% of the effort on the electric bike that you do on non
1:03:48
electric bike. But on an hour by hour basis
1:03:52
it's exactly the same, right? So on a on an hour by hour basis
1:03:57
I'm doing essentially I'm burning the same amount of
1:03:59
calories according to my calorie tracker and you know feel the
1:04:03
same kind of tiredness and and So what that means is the
1:04:07
electric bike allows you to do more in an hour than you could
1:04:10
have with a non electric bike which means you get to have more
1:04:12
fun right? You can go further you can see
1:04:14
more places. So I do find myself tending more
1:04:17
towards the electric bike these days.
1:04:19
All right, bonus lighter note. Jim picked up on the stacks when
1:04:23
I'm reading the book that, but you might be a Jackson Browne
1:04:27
fan. And so, Jim, you want to ask,
1:04:30
ask the Jackson Browne question? Yes, I would tell us your
1:04:33
favorite Jackson Browne song. But bonus to that question 1A is
1:04:38
why are you a big Jackson Browne fan?
1:04:41
Yeah. So, so I'll answer the last
1:04:44
question first. So I'm a Jackson Browne fan
1:04:47
because I kind of came to him through the Eagles.
1:04:49
So I'm also a huge Eagles fan and Jackson Browne and the
1:04:52
Eagles kind of intersect with each other.
1:04:55
Jackson Browne and Glenn Frey Frey were roommates when and he
1:05:01
wrote, oh, oh, now I'm can't forget.
1:05:04
It's tough getting old. Anyway, he wrote one of the
1:05:06
Eagles, you know hits and so. So I kind of came to him through
1:05:11
that, right? Started listening to his music
1:05:15
and you know, I like it because he's very philosophical.
1:05:17
So. So I'm going to pick a couple of
1:05:21
probably less well known songs as my favorites, even though I
1:05:26
like them all, but but I I like Fountain of Sorrow.
1:05:30
It's not as well known, but it's it.
1:05:35
It's about how, you know friends and lovers kind of navigate
1:05:41
through this kind of, you know, where where they're at in their
1:05:44
relationships and and you know, it's called found of sorrows
1:05:49
because this fountain of sorrows springs from your life like a
1:05:53
fountain in a pool. You know.
1:05:54
That's the lyrics, right. And I just find his lyrics so,
1:05:57
so interesting. Yeah.
1:05:59
The the other bonus which I, I almost no one has heard of is
1:06:04
lawyers in love, which so, so go listen to it.
1:06:08
Jackson Browne, Lawyers in love. It's about the Soviet Union
1:06:12
being turned into vocational land for lawyers in love.
1:06:15
I I don't know that there's deep philosophy there, but it's
1:06:18
definitely entertaining so. It's interesting premise, I
1:06:22
guess. Yeah, I always go back to
1:06:26
somebody's baby, which was a song in Fast Times at Ridgemont
1:06:30
High, which. Yeah, yeah, it's.
1:06:32
Got to rank within my top five movies of all time.
1:06:35
Yeah, yeah. Well, and the song's great.
1:06:37
I mean, it's very light hearted. It's not as philosophical as
1:06:39
many of many others of his songs, but yeah.
1:06:43
All right, we'll go ahead and wrap it up for this week.
1:06:45
I know we've spent some extra time here with you, Phil, but
1:06:48
really appreciate it. I'm gonna have links in our show
1:06:51
notes. So phil.winley.org is your
1:06:54
website. The book is called Learning
1:06:57
Digital Identity. We'll have a link to that for
1:06:59
for Amazon for people to check that out.
1:07:01
I guess try and find the Jackson Browne's Easter eggs, maybe
1:07:05
through it. Yeah.
1:07:07
And then, yeah, we'll wrap it up for this week.
1:07:09
You can find Jim and I on the web at idacpodcast.com or on
1:07:13
Twitter at IDAC Podcasts on Mastodon.
1:07:17
Speaking of self, sovereign slash decentralized at IDAC
1:07:20
podcast, at Infosec, dot exchange.
1:07:23
And of course you can connect with Jim and I on LinkedIn.
1:07:25
And yeah, let us know, you know, what you think of the episode
1:07:28
and subscribe like you know, all that jazz.
1:07:32
And Jim, anything you want to close with?
1:07:34
Yeah, I wanted to close with, we got a mention from Lindsay Dunn,
1:07:39
who is somebody that I met at Octane this year.
1:07:42
She's a identity consultant out of Germany and she just
1:07:48
mentioned, thank you Jim McDonald and Jeff Seidman, your
1:07:51
podcast is the best. She was writing about the the
1:07:56
episode that we did with Jason Rebholtz of Corvis Insurance and
1:08:01
just how much she had taken away.
1:08:03
I mean it was quite at the write up, so I know you got tagged,
1:08:06
you'll see it as well. But she just mentioned that our
1:08:09
podcast is the best, so we'll just leave it at that.
1:08:12
I'm not gonna argue with that. I mean that's that's, that's,
1:08:15
that's that's an opinion and we'll take it as fact.
1:08:16
How about that? So, yeah, thanks for that.
1:08:18
Stuff like that is cool when we see it out in the world.
1:08:20
And yeah, keeps us going. So, all right, good mention.
1:08:23
We'll go ahead and wrap it up for this week.
1:08:25
Thanks everyone for listening and we'll talk with Y'all in the
1:08:28
next one. You've been listening to
1:08:31
Identity at the Center. We hope you've enjoyed the show.
1:08:35
Make sure to like, rate and review and we'll be back soon.
1:08:40
But in the meantime, hit the website at
1:08:42
identity@thecenter.com and find us on Twitter at IDAC Podcast.
1:08:49
See you next time on Identity at the Center.