Latest / Identity at the Center / #375 - Mailbag for September 2025
Transcript
- 0:04This is identity at the center. Welcome to the Identity at the
- 0:11Center podcast. I'm Jeff, and that's Jim.
- 0:12Hey, Jim. Hey, Jeff, how are you?
- 0:15Oh, not so bad yourself. Doing great, man.
- 0:18We're doing a Jim and Jeff episode today, so that makes me
- 0:20happy. We have to hang out in person.
- 0:24It's been a while. We got a couple conferences
- 0:27coming up, so we'll get through a lot between now and the end of
- 0:29the year. And one other thing I wanted to
- 0:33mention. So I while I was away for a
- 0:36couple days this week, I kind of fell behind on LinkedIn.
- 0:38But I finally caught up with things on the flight home last
- 0:42night and got some quick responses from people.
- 0:45So they're a few shout outs for people who let me know they
- 0:50listen and they really appreciate what we do.
- 0:53So Adam, oh, Siobhan, I'm going to mess names of, I'm sorry,
- 0:58Shubham Gharia and Alejandro Lowe Fresetti, if you guys are
- 1:03listening. Thank you for the notes.
- 1:05I mean, Jeff, I don't know about you, but when I get notes that
- 1:07people listen and that they thank us for what we're doing in
- 1:12the, you know, for the identity space or they let me know, hey,
- 1:16I really enjoy the content or I'm learning a lot.
- 1:19I mean, it means so much to me. Yeah, it's very, it's very cool.
- 1:23I get those messages as well. What I find interesting is we
- 1:25don't get the same messages. So none of those people messaged
- 1:27me, but I have other ones. So I look at my list here like
- 1:30people have emailed or sent me LinkedIn messages recently.
- 1:32Jonathan, Judy, Isabella, Jesse Sadaf, Andy Kojo.
- 1:39So yeah, it but it is very cool. Glad that people get something
- 1:44out of this, whether it's, you know, they enjoy it or they hate
- 1:47it and they hate listen or watch it, either way is fine.
- 1:51I never get to hate ones. I'm I'm glad about that.
- 1:54I mean, you know, LinkedIn people keep things pretty
- 1:57cordial. For the most part, yeah.
- 1:59No, we've been pretty lucky. We've got to have a great
- 2:01community, which you've always said, right?
- 2:02The I am community is, is top notch as as I'll say so yeah.
- 2:07And that's pretty much what this episode's all about is we get
- 2:10questions a lot through our LinkedIn.
- 2:12So we get stuff, kind of queue them up and kind of save them up
- 2:16for a mailbag episode. And we'll kind of get through a
- 2:18bunch of these that listeners have sent out over the last
- 2:21probably at this point a couple months.
- 2:22Because I think we had a couple earlier in this year and then we
- 2:24had a run of conferences and episodes associated with that
- 2:28and then guests and things like that.
- 2:29So this is another way for us to catch up on, you know, those
- 2:32kind of questions. Yeah, and you and I have been in
- 2:35this identity space for 20 years each.
- 2:38We've been consulting for over a decade and one thing I know
- 2:42about myself and I think you say this for you, Jeff, is we don't
- 2:46know everything, right? That's.
- 2:47What you're going to be. I know everything man.
- 2:49Yeah, OK. That's why I said that in.
- 2:51Google really quickly I gave you.
- 2:54An I gave you an opportunity to be humble.
- 2:57But no, obviously you know that we don't know everything while
- 3:02we have guests come on most episodes, but we do our best.
- 3:06We're like the identity practitioners out there.
- 3:08We're, you know, in the battle together and we're going to go
- 3:13through our answers today doesn't mean they're they're
- 3:15right answers to these mailbag questions.
- 3:17If anybody disagrees or really likes to answer, that's another
- 3:21reason to reach out or you know, we put all these episodes on
- 3:24YouTube. We thought about as as audio
- 3:27podcast, right. We started as an audio podcast
- 3:30over six years ago, and most of our listener, most of our people
- 3:36who consume this podcast, our listeners, but we also produce a
- 3:43YouTube video for each one of these episodes that gives folks
- 3:46an opportunity to go out and comment on an episode, a
- 3:50particular episode, and ask question or say they like or
- 3:54disagree with a point. I'd finally encourage that.
- 3:57I mean, I don't have a problem with somebody disagreeing with
- 3:59me. That's what it's all about.
- 4:02Yeah, just be respectful, that's all.
- 4:05Stop putting a Bitcoin seed phrases that are obviously
- 4:08scams. I'm constantly policing those
- 4:10off of our off of our YouTube comments and stuff like that.
- 4:13So but yeah, you know, gives us an opportunity.
- 4:16So, you know, while you're listening and thinking about
- 4:18that, hit it, you know, hit that like and subscribe button too.
- 4:20That obviously helps. You know, Jim and I grow the
- 4:21channel and the podcast and get great guests, which, you know,
- 4:24we've done an amazing job over the years.
- 4:25And you know, Jim, that's all you getting, getting really cool
- 4:28people to, you know, spend some of their time and, and their
- 4:32thoughts with us on the air. It's been a pretty easy job
- 4:35actually, because most of the folks I reach out to I it's
- 4:38become an easier and easier job over time because the podcast
- 4:41has grown. In the early days, it was people
- 4:43like Darren Rolls, those people like Eve Mailer who agreed to
- 4:47come on this podcast that nobody knew about.
- 4:49So but it's still a big coordination effort, obviously.
- 4:54So I appreciate that, but we got some conferences coming up, we
- 4:59got some discount codes. We should probably at least
- 5:02acknowledge that and then jump into things.
- 5:05Yes, several conferences. See by the time people listen to
- 5:09this on, will it be Monday, the 22nd, I believe maybe it's 21st,
- 5:1322nd. I think the Philadelphia Cyber
- 5:16Security Summit will be on later in the week.
- 5:19So that's Thursday and I will be there.
- 5:22So I'm I think I'm moderating a panel.
- 5:25I'm not quite sure yet, but I believe I will be and so I hope
- 5:28to see some folks out there. I know a couple people who will
- 5:30be there, but feel free to use this discount codes free get you
- 5:34in. It's a pretty cool conference.
- 5:36So this will be my third one third city that I've done this
- 5:39year did Raleigh did Chicago a couple weeks ago, Raleigh a
- 5:42couple weeks before that and then kind of closing out that
- 5:45series for me, at least in Philly, but it's a pretty well
- 5:48run conference. It's a few 100 people.
- 5:50So it's kind of like the right size to actually meet people,
- 5:53have conversations and because it's local in a specific, you
- 5:56know, city, you meet people in your space that are in, you
- 6:00know, your kind of region and makes a little bit easier to
- 6:03form connections and things like that.
- 6:04So OK, forward to that and let's see after that.
- 6:08I'm actually going to be at sale point navigate conference, not
- 6:12this coming week, but I guess the following week, so you can
- 6:15look for me there. I'll be there as part of the RSM
- 6:16contingent, which everybody, well, not everybody knows,
- 6:18everybody thinks we do the podcast is our full time jobs.
- 6:20That's absolutely not the truth. That is our night and weekend
- 6:25job. By day we work for RSM as I am
- 6:27consultants, so helping people solve their digital identity
- 6:30security problems. But I'll be there for the sale
- 6:33point conference, probably somewhere around a booth.
- 6:36I think I'm also running a, a newer game show that we have not
- 6:40tried before. So it'll be kind of a test bed
- 6:41for that. So if you're a listener, you
- 6:43know, come stop by the RSM session at Cell Point Navigates.
- 6:48Let's see. Authenticate with Fido Alliance
- 6:50is coming up. So we're going to do Fido Feud
- 6:54rematch. So you're going to take on Megan
- 6:56again, I'm not sure if you guys have figured out teammates yet,
- 7:00but I know that there was a lot of people who expressed interest
- 7:03when it was time to register for Authenticate.
- 7:06So the Fight Alliance is a time to keep track of that.
- 7:08And we've been working with Megan and Adrian and obviously
- 7:11yourself to figure out OK, of the pool of people who express
- 7:14interest. Who do you want to get on stage
- 7:16and be part of that? I'm going to be the neutral
- 7:17party. I am the host.
- 7:20I'm the Steve Hardy without the long jacket or the mustache, but
- 7:24I'll be coordinating it. Adrian and I are working on the
- 7:27questions. So if you have not yet seen the
- 7:31survey that went out from the Fight Alliance, I also put it
- 7:33into the IT Pro conferences or maybe it was a general channel.
- 7:37There is either way that people can submit answers.
- 7:40So the questions are out there, but the only people who can see
- 7:43the answers are myself and Adrian for the Fight Alliance.
- 7:46So she and I are coordinating to make sure that, you know, this
- 7:49is a a fair game, Jim, so that there's no cheating, no
- 7:53allegations, nothing like that. Well, unlike, unlike last year,
- 7:56right, So. There wasn't cheating last year.
- 7:59There was interpretation of answers that were maybe suspect,
- 8:04but I'm. Going to give you my, my view of
- 8:07things, right? I didn't feel like last year was
- 8:10fair, but that was fun because last year really didn't count.
- 8:13Last year was more of like a trial run.
- 8:16This year, this is the first official year.
- 8:19So we'll see who wins this year. I think it's going to be team
- 8:22IDAC because this year is going to be completely fair.
- 8:27It's going to be heads up Team IDAC versus team Fido.
- 8:32And I mean, we know it's going to happen, right?
- 8:35I mean, I hope I know what happened.
- 8:36You're representing IDSC, so definitely need a better showing
- 8:39than than last year. Look, in Megan's defense, she
- 8:43walked away with the tiniest trophies we've ever seen.
- 8:45So her team has those. So we'll see.
- 8:49I I love the snack talk, though. So Megan, if you're watching
- 8:51under listening, you know, feel free to respond comments below
- 8:54or maybe something I'll link to him.
- 8:55Maybe we can, you know, draw up some healthy competition was put
- 8:58that way. You know, I, I think the biggest
- 9:03thing that I wanted to throw out, so I knew you were going to
- 9:04talk about one more conference coming up with Zimfosec World.
- 9:08We really appreciate all of the partnership that all these
- 9:14groups putting on these conferences have shown us,
- 9:18especially, you know, the CRA with the, all the conferences
- 9:24you mentioned, plus all the ones that are coming up.
- 9:27I mean, it's another thing that's going on with the
- 9:30conference or I'm sorry with the podcast that, you know, it's the
- 9:34listeners, it's the guests, it's the partnership with different
- 9:39conference organizers. Like we've pulled all this
- 9:41together and it's it's all four of the listeners really.
- 9:45That's why we do it. But it wouldn't be able to
- 9:49happen without this partnership. So definitely grateful for all
- 9:52of that. Yeah, shout out to especially
- 9:54Shirley at the CRA and Adrian at Final Alliance.
- 9:59Those two have been really fun to work with.
- 10:01And you know, the other reasons why we do fun things at
- 10:04conferences, I'll be honest, I don't really want to give a talk
- 10:08an identity. I feel like there's a lot of
- 10:09that already. I would much rather have a good
- 10:12time and sort of, you know, be a little bit more on the
- 10:14entertainment side and, you know, try to relax and make the
- 10:17conference something fun. And, you know, both Adrian and
- 10:20Shirley have been awesome work with, they've both been really
- 10:22open to new ideas, right, game shows and things like that.
- 10:25So plus they're just fun people and, you know, great to work
- 10:28with. So shout out to Shirley and
- 10:30shout out to Adrian. You know, we've all been all
- 10:32about the edutainment. There can be plenty of education
- 10:36that you know, the, the folks are showing at the these
- 10:38conferences and giving the presentations, whether it's
- 10:41success stories or new ideas around architectures or trending
- 10:46topics, they, they know them better than we do.
- 10:49And so you're getting plenty of education.
- 10:51So our sessions are more the entertainment variety.
- 10:57More of a pulse of of the people type thing, you know, what are
- 11:00people thinking with the different, you know, game shows
- 11:02that we've done and surveys and things like that.
- 11:04So they're fun. I like to do them.
- 11:06We'll do them when we until we get told we can't do them
- 11:08anymore and then we'll figure something else out from there.
- 11:10But you know, next thing you know, we'll have a Netflix
- 11:12special, you know, IDAC, you know, after dark and it'll be
- 11:16kind of like that midnight game show where it's just, you know,
- 11:18people pontificating and making jokes.
- 11:20But yes, Speaking of CRA, Infosec World 2025, that's
- 11:24coming up at the I believe it's the end of October that is in
- 11:27Orlando. So we'll be there and recording
- 11:30some episodes very similar to like Ideniverse.
- 11:32I have not been to that conference.
- 11:33I'm looking forward to it. I think it's more broader,
- 11:35obviously information security, but guess what I am as part of
- 11:38that world. So we're going to be there.
- 11:40So I hope people come and check it out.
- 11:43We got identifiers after that in DC, so be there for that as
- 11:47well. That is in November.
- 11:49And then I think closing off our conference Circuit of the year
- 11:52with Gartner and the IM Summit in Grapevine, TX.
- 11:55So we met with our friend Rebecca a little earlier today
- 11:59to kind of game plan through, you know, the game that we're
- 12:02going to run there and that's going to be a fun one.
- 12:04So lots of conferences, lots of different things are going on.
- 12:08I didn't mention discount codes because they're hard to remember
- 12:11what spot. But if you just remember one
- 12:13thing I DAC podcast.com, just Scroll down.
- 12:16Everything that I have that's available is going to be down
- 12:19there at the Gartner 1 is not up yet.
- 12:20I think that one becomes available in October.
- 12:22So once October rolls around, there'll be a Gartner one edit
- 12:24as well. But check it out.
- 12:26Great way to show support the show and show that we can, you
- 12:28know, have a good time and bring people to conferences and and
- 12:32meet all the friendly faces that we, you know, see us still
- 12:35images on LinkedIn and teams and other different things that
- 12:38happen. Yeah, I was at a meeting this
- 12:41week and kind of saw saw some people that I've been meeting
- 12:45with in Teams. And then there's one person I
- 12:48met who, you know, I've been on punny teams calls with and he
- 12:53was like 6-7. And I was like, whoa, I didn't
- 12:56realize you were that tall. You're talking about our friend
- 12:59Dan. Yes.
- 13:00Everybody has the same height on on a team's window.
- 13:03And then you get into real life, like, OK, wow, I didn't realize
- 13:06Jeff was that short or, you know, Jim was that tall.
- 13:09I'm not. I'm not really that tall.
- 13:11Yeah, you're what, 6/2? Yeah, yeah, look, everyone is
- 13:14tall when you're 5-6 like me so well, Dan.
- 13:17Dan's like 6-7. Yeah, no, Dan was great.
- 13:20Very tall guy. Yeah, he's an awesome guy too.
- 13:22Yeah, so we did an episode with him not too long ago, Dan
- 13:25Lauritsen, part of our series with RSM and so go back and
- 13:28check that out. But that's very cool to see
- 13:30people like that in in, in real life and and get their
- 13:32autographs for being on the podcast, which is fun.
- 13:36All right, let's get into a mailbag.
- 13:38We got a bunch of questions from people literally around the
- 13:41world. So again, if people have
- 13:44questions or they just want our thoughts on something, send them
- 13:47to us on LinkedIn, drop us an e-mail, drop us a contact form
- 13:50thing on our website. We try to queue these up from
- 13:53time to time. The more we get and as we get
- 13:55gaps in our schedule where we can address them, you know,
- 13:57that's kind of where this is at. So now with no more further ado,
- 14:02let's get Jim's $0.02 on a couple of these questions.
- 14:06I'll read off the questions, Jim, and then you give me your
- 14:08thoughts on it and then if I have anything to add, I will and
- 14:11we'll just kind of go through it that way.
- 14:12Is that cool sounds? Good.
- 14:13Yeah, I'll do it. OK.
- 14:15So first up, this is Matt in Maine.
- 14:18He knows who he is. I know who.
- 14:20He is right. How does a successful IM program
- 14:25engage the broader IT department regarding key concepts?
- 14:30So, additional context here. I recently volunteered to do a
- 14:32short presentation in an architect forum on what SSO is
- 14:36and how it works. This is the result of having a
- 14:39conversation with a software architect who recommended to a
- 14:41software owner that she worked with me to set up SSO on work
- 14:45day. We've had SSO set up on work day
- 14:47since we acquired it seven years ago, and this architect logs
- 14:50into it weekly like everyone else.
- 14:53Wow, a lot of context right there.
- 14:57That is a lot of context. Matt and I went back and forth
- 14:59and noticed. I'm not going to cut a keynote,
- 15:01get into all the nitty gritty details.
- 15:02But I guess before I even answer my first question is I'm not
- 15:06sure if the person is an architect if they're not clear
- 15:09on what SSO is. And the fact that they were
- 15:12logging into it already and had been for seven years apparently
- 15:18leads me to kind of wonder if there is some more education
- 15:20that needs to be done around identity and access management
- 15:24and maybe just general IT architecture networking.
- 15:29I'm not sure what it is, but what are your thoughts on how
- 15:31does the successful IM program engage the broader IT department
- 15:35regarding key concepts when it comes to identity?
- 15:38So hey, Matt, glad to get your question.
- 15:42And I think the first thing it kind of goes to the point you
- 15:45were making, Jeff, which is that, you know, Matt said I'm
- 15:49doing a presentation through the IT department.
- 15:51So we shouldn't start off with the assumption that because
- 15:55you're in the IT department, you know how everything works.
- 15:58Like you could be a software person, you could be a network
- 16:01person, you could be a mainframe person, you could be, make this
- 16:05a mainframe architect and he could run us in circles when it
- 16:09comes to mainframe architecture. And he really doesn't care who
- 16:14about he or she doesn't care who about, you know, single sign on.
- 16:21Having said that, you know, I, I think you need to start with
- 16:24some of the basics, you know, kind of like educating people on
- 16:30what is the business value of single sign on.
- 16:33I remember we used to run into questions early on in the single
- 16:37sign on days like, OK, isn't it worse to give people one
- 16:42username password to 100 systems than 100 username and passwords?
- 16:47Because if they lose 1, the blaster is is limited to that
- 16:54one system. I think the it's kind of like a
- 16:57psychology thing. If you have to manage 100
- 16:59usernames and passwords, you're probably using, you know, the
- 17:05same username password across multiple systems and your
- 17:08ability to kind of provide all of the features that you need in
- 17:12a holistic IM program like monitoring, like use your life
- 17:17cycle management, like having the right authentication
- 17:20policies and the ability to enforce them.
- 17:24Those things probably go out the window for most of those 100
- 17:28users and passwords. So it's kind of like here's why
- 17:31single sign on is good. Let me think, there are multiple
- 17:34forms of single sign on. There's Samuel single sign on
- 17:38and there is Oauth 2 or open ID single sign on.
- 17:46So there's a browser based set of redirections.
- 17:49So if you're starting to get into like application
- 17:51architecture and kind of how these things manifest, whether
- 17:56it's like browser based or there's some back end token
- 18:01sharing happening, I think that's a a big part of that
- 18:05explanation. I just, you know, it depends on
- 18:07who you're speaking to and as you start to whittle down that
- 18:11field to a smaller group, that's where you start getting into the
- 18:15specific details. If you're talking to a big large
- 18:19audience, you have to kind of keep it.
- 18:20I think even like a big large audience who is quote UN quote
- 18:23IT, you need to keep it at A at a business level to start your
- 18:28thoughts. I think this is an excellent
- 18:32example of sometimes we take people in knowledge for granted
- 18:37in the IM space, especially when you get surrounded into IT at
- 18:40large. Look, not everybody knows
- 18:43identity and that's fine, right? I think that's something that we
- 18:45all need to think about is how do we educate and inform other
- 18:49people in the organization as to what they're working on, stuff
- 18:52like that. So for sure, you know, I maybe I
- 18:56was a little bit rough, like how does this person become anarchy
- 18:58step without knowing SSO is I guess there's a possibility
- 19:01there, but it's also a good reminder to say, OK, what has
- 19:04the IAM program done to inform IT, whatever that looks like as
- 19:09to what the IAM program has been doing, what its capabilities
- 19:12are, what it's, you know, different features and
- 19:15functionalities that have been rolled out so that they can, you
- 19:18know, be part of that messaging as well.
- 19:20I think we focus a lot on end user training and making sure
- 19:23the end user understands it. There's probably a really
- 19:27significant Gray area when it comes to IT training for
- 19:31identity and access management concepts, features and
- 19:35functionalities and things like that.
- 19:36So I think it's a good opportunity to say, OK, we
- 19:39noticed the gap here. How do we address it?
- 19:42Is it, you know, something where we need to have more
- 19:44conversations with, you know, I'll call it IT in parentheses
- 19:48or quotation Marks and making sure they understand what are
- 19:53the different capabilities that the OEM program has and, and
- 19:56things like that. So I try to look at from the
- 19:59aspect of, yeah, OK, what, what did we miss here and how do we
- 20:03make sure that we account for that next time?
- 20:06Yeah. I mean, there's all kinds of
- 20:08goals that could come out of why you're doing that presentation
- 20:11in the 1st place. One of the goals might be you
- 20:14need to stop doing this shadow IT thing.
- 20:16Setting up applications that are completely outside of the the
- 20:21realm of our single sign on are completely outside the realm of
- 20:25how we do identity access management, logging in,
- 20:28monitoring. You know, people understand like
- 20:32why we use centralized single sign on multi factor
- 20:35authentication. It may start to add up that hey,
- 20:39if I go out and set up a sales force account with my credit
- 20:43card, that is not a good thing for the following reasons.
- 20:48I mean, that's just smacking with policy.
- 20:52Don't, don't go sign up for stuff that you're not prepared
- 20:54to support, because we all know that they're going to continue
- 20:56to do that. They're they're never going to
- 20:58sign up for a service and then you ask for IT to help them out
- 21:01down the road. That would never happen in the
- 21:02real world, would it? Yeah, right.
- 21:06All right, So hopefully, I know that was actually several months
- 21:09back that Matt had sent that. So he and I conversed and
- 21:12hopefully that helps Matt, you know, going forward.
- 21:15Let's get to the next one here. Amara in India asks what are the
- 21:20key factors that influence an individual's trust in a new
- 21:25digital identity system? And what can governments or
- 21:29organizations do to encourage wider adoption without being
- 21:33overly intrusive? You.
- 21:35Know you could go. First, good luck SO.
- 21:37No, I, I know Amara too. And so I don't really know her
- 21:43personally, but I know her from LinkedIn.
- 21:47I think a big part of building trust, it's just like any other
- 21:52part of human interaction. It's, you know, trust is earned.
- 21:56So it does build over time. But I think they're kind of like
- 22:00some fundamental concepts within identity or within technology in
- 22:08general that help you earn trust.
- 22:11And one of the first things is privacy, like knowing where your
- 22:15personal data is going to end up.
- 22:20Does the organization have a privacy statement?
- 22:26Is it clear? Or is it one of those 20 page
- 22:29documents like we can sell your information to third parties And
- 22:34so it's the privacy, but it's also how you communicate it.
- 22:37And then I think one thing that maybe takes that to the next
- 22:42level because that's like a big area in the, a big topic in the
- 22:45area of customer identity and access management is privacy and
- 22:52consent. So it's also the consent of
- 22:54saying, here's the data that I'm OK that you share, but I also
- 22:59have the ability to say forget me.
- 23:01So a lot of the things that we saw driven in GDPR are still
- 23:07very important and very relevant.
- 23:11Whether you need to be in compliance with GDPR or not,
- 23:14you'll be thinking about what were the drivers that that
- 23:19influence the design of GDPR. And it's like what people expect
- 23:23and why do people expect those things and how do those
- 23:27influence whether or not you're going to have trust for the
- 23:30organization? Now I also think, now let me
- 23:33bolt on something to that, which is if you do suffer A breach and
- 23:38many organizations do suffer a breach, how do those things get
- 23:42handled afterwards? Do you try to cover it up or do
- 23:45you, are you very transparent with your users and with the
- 23:49public in terms of what happened and what you're doing to rectify
- 23:53the situation? And for me, when I see that
- 23:57there's a cover up or it's a couple days, so there's any kind
- 24:00of communication, if people are left in the dark, I think that I
- 24:05start losing trust for that organization.
- 24:09Well, you have to be careful about the word cover up because
- 24:13that implies that there is some sort of, you know, conspiracy
- 24:17that might be taking place. I think this is an area that a
- 24:19lot of organizations struggle with is how do you report on a
- 24:22breach? Frankly, most suck at it.
- 24:27They're just not good. They either wait too long or
- 24:30they share incomplete information or they share
- 24:33information so quickly that the information is made incorrect.
- 24:38When they shared it, they might have thought it was correct at
- 24:39the time, but things change. And so I think breach response
- 24:43and breach communications are one part of it.
- 24:47But it comes down to the trust. I don't know if we'll ever fully
- 24:51solve it. Just to be honest with you.
- 24:52Like, I don't think we will ever fully solve it because they're
- 24:56the concept of privacy does not exist in every society, in every
- 25:01country around the world. I don't know what it's like in
- 25:04India, if that's specifically, you know, what she's asking for.
- 25:06I don't know, you know specifically what they're
- 25:08working on. But at any I can point to the US
- 25:11as a reference at any given .50% of the population is for the
- 25:14government and 50% is against it.
- 25:16So and it doesn't matter who's in charge.
- 25:18So that idea of trusts becomes OK, well, who do you trust and
- 25:22why? And I just don't know if we will
- 25:25ever get to the point where, you know, maybe trust is too loaded
- 25:29of a word. You know, maybe it's more like
- 25:31tolerate because I need it for, you know, a passport or a
- 25:35driver's license or some other piece of information.
- 25:37But I don't know if I don't know if there is really a spot where
- 25:43we get to the point where like all of our identity data is in
- 25:47the hands of 1 area. I think we're more headed to
- 25:50more of a Federated model where some bits of information are
- 25:53spread out a bunch of different, you know, networks, whether
- 25:56they're decentralized or not, that's a whole other bottle wax.
- 25:59But I, I, I don't know other than, you know, if you're, if
- 26:03you're talking about internally an organization, how do you
- 26:06build trust? If you make promises or make
- 26:09commitments, do them, right? If you're going to miss dates or
- 26:14whatever, communicate it, right? Don't, don't say I'm going to go
- 26:17build something and then forget about it.
- 26:20Or don't ask for feedback. Or if you get feedback, you
- 26:23don't consider it after you ask for it, right?
- 26:24I think this is just being what I would call just a decent human
- 26:27being and say if you're going to do something, do they do I trust
- 26:30that Jim is going to go off and do the thing that he's in charge
- 26:34of? I mean, yes, I hope so, right?
- 26:37But the same time now, Jim, it's on you as the person that's
- 26:40being trusted to do that. You've got to deliver if it's
- 26:43something you can handle by yourself, awesome, great.
- 26:46You have less dependencies the vast majority of the time.
- 26:49Now you're going to depend on other people.
- 26:50So now you've got other people that you're trusting to get
- 26:53their part done so you can get your part done to make part of a
- 26:56bigger thing, right? That's going to go out.
- 26:58So, you know, I think there's, it's a little bit bloated
- 27:00question, but that's kind of what I was thinking about when
- 27:03we said the word trust was like, oh, that's, that's a tough one.
- 27:06It's a. Tough one.
- 27:07I think, you know, your mind went directly to the government
- 27:12situation. I think primarily the federal
- 27:15government. It's just there's a history of
- 27:17like, you know, distrust of the federal government that goes
- 27:22back long before our time. But I think when you think
- 27:27about, and I'm not saying, I'm not saying that in any way to
- 27:32damn people who work for the federal government.
- 27:34So let me make that clear. It's just, I think it's a fact
- 27:38of life in the USI think when you think about that same
- 27:43mindset to your local governments or your healthcare
- 27:47provider or big tech or other companies that you trust with
- 27:51your information, the context changes.
- 27:55And I think transparency is a big thing.
- 27:58I think what's happening with your private data is a big
- 28:00thing. And I think how you handle an
- 28:02incident, if one does occur, it'd be a very big thing as
- 28:06well. Oh, for sure.
- 28:08I think it's a hard question to answer, yeah.
- 28:13It's hard question the. Idealist in me is, yes, at some
- 28:17point we'll figure out and get past all this because the
- 28:21benefits will be there that outweigh all the negatives.
- 28:24And I think that's also part of the wider adoption.
- 28:26Part of the question is why should I use this thing,
- 28:30whatever this thing is, right? Whether it's a product, whether
- 28:33it's something an identity rolling out, whether it's an
- 28:35identity program is standing up. Why?
- 28:38Why do I need this? Because that's the first
- 28:39question anyone's going to have is OK, cool.
- 28:42Like what does this do for me? And so I think you need to have
- 28:44your messaging and understand, are you delivering something
- 28:48that the organization both needs and wants?
- 28:53Because if they don't want it, they're going to find ways
- 28:55around whatever policies, whatever capabilities should put
- 28:57in place. So I think you really need to
- 28:59think about, you know, the, what is your target market look like?
- 29:02And are you delivering a product, in this case most
- 29:05likely an IM product that people actually want to consume and
- 29:09use? Yeah.
- 29:11You know, I'm also wondering, you know, if part of what Amara
- 29:16was getting at was decentralized identity, because I think in a
- 29:21lot of people's mind, that's the solution of owning your own
- 29:25identity and just allowing the attributes that you want to
- 29:29share with any given organization to be shared.
- 29:33My worry is that it starts getting to the point where it's
- 29:37like, just like it is today with all these cookie policies.
- 29:40Like you go to pay your electric bill and it's like you accept
- 29:44the cookies or you don't and eat it all.
- 29:50Day long. So that's the option that's.
- 29:53Your cookie policy, right, Right.
- 29:54Yeah. Yes, you're right.
- 29:58I, and some of this too, again, goes back to trusts.
- 30:02I picked on the government because I think that's the the
- 30:04easiest target, at least for me to think about.
- 30:05But the same applies to any social network.
- 30:08It applies to education, applies to healthcare, applies to
- 30:11finance. That's why I don't think it's
- 30:13going to end up being like 1. And I hate to use the word, the
- 30:15B word, but one blockchain, 1 decentralized identity, one
- 30:19decentralized Ledger, let's call it, right, that stores with us.
- 30:22I think we're going to end up with several and you're going to
- 30:27trust certain ledgers with certain pieces of data, but I
- 30:31find it highly unlikely that there will be 1 Ledger to sort
- 30:34of rule them all if you want to take a, a token reference to
- 30:37that one. And so no, go ahead.
- 30:41I was. Going to say, I think you used a
- 30:43great example there with social media slash big tech and I think
- 30:48that certain companies have over time damaged their reputation in
- 30:53terms of your privacy so much that rebuilding trust they
- 30:59happen to rebuilt trust it's and there's others that I think have
- 31:03done a better job over time. And I'm not going to name names,
- 31:06but because I suppose the one with the e-mail that's going to
- 31:10come from it. But I think that look, once you
- 31:13damage trust, it takes a long time to rebuild it.
- 31:17And if you really damage it, the words like you're selling
- 31:20people's private information out the back door, that's really
- 31:26hard to make up from it. So I think being very clear
- 31:29about what you're doing with people's data and giving them
- 31:32the ability to opt out of that, it is just fundamentally key.
- 31:39Yeah. And then?
- 31:40Do you trust that when you click that box that says don't sell my
- 31:42data, they're actually honoring it?
- 31:45Well then. Yeah, yeah.
- 31:46But if there's. One way to be overly intrusive,
- 31:48it's to do things with people's data that they that they didn't
- 31:51sign up for that they're not aware of.
- 31:54So good luck tomorrow. I, I don't know if that helped
- 31:57or not. I feel like we both got a little
- 31:58bit of soapbox there. But, you know, the, the idea of
- 32:01trust and getting things rolled out is, is challenging.
- 32:04And I'm going to focus my answer back more on like, if you're in
- 32:08an enterprise Oregon organization, you're trying to
- 32:10roll something out, then, you know, deliver on your
- 32:14commitments. Yeah.
- 32:15OK, so let's get to the next question.
- 32:17This one is from Sophie in France.
- 32:21For a country or a large organization looking to launch a
- 32:23new digital identity program, what are the most common
- 32:27practical challenges they will face in the first year?
- 32:30How can they plan for and address issues like technical
- 32:34integration with legacy systems, managing data migration, and
- 32:38ensuring the system can scale to millions of users?
- 32:42OK, so millions of users. That's a very large
- 32:44organization. Or maybe this is a customer
- 32:46solution, but where do you want to start with that one?
- 32:50You know, again, I'm not sure if this is going to be the specific
- 32:54answer that Sophie's looking for, but when I think about
- 32:57launching a new IM program or initiative, I think of a couple
- 33:02things. One is being the picture of
- 33:05where you're wanting to go, like what is the vision?
- 33:07What is it that you're trying to accomplish?
- 33:10So kind of making sure all that is architected out at whatever
- 33:14level you can and making sure that you're communicating that
- 33:18effectively to your stakeholders.
- 33:20They test number one, I think #2 is kind of what goes along with
- 33:26that, which is getting stakeholder alignment because
- 33:29you're going to have to, you know, rank an IM program.
- 33:32This isn't 4050 years ago where things slowed from the top down.
- 33:37Organizations are much more organized and kind of a matrix
- 33:42type organization. So you really can't get anything
- 33:45done of significance on your own.
- 33:48You need to have buy in, you need to work with others.
- 33:51So getting that buy in kind of building that, in other words,
- 33:54the politics of it all. And then the the last thing is
- 33:58like when you start to shift into execution, I don't think
- 34:03having like a Big Bang phase one approach is the right approach
- 34:07anymore. I think it's kind of like you
- 34:09have to design around getting into production with something.
- 34:12I think it's that you have to get these, what do you call it,
- 34:16like small wins or low hanging fruit people like to call it,
- 34:20it's not always the easiest thing and you just go after the
- 34:23easiest low hanging fruit thing. You know, that sometimes is the
- 34:26right move because you have to start earning some St. tread.
- 34:31So kind of what I did was when I was, you know, prior to my
- 34:35consulting days, my first IM program, I had to, I had some
- 34:41very skeptical application owners that said, all right,
- 34:45well, you know, we might turn over authentication to you, but
- 34:49we're not willing to turn over authorization.
- 34:53We still consider that to be part of the application.
- 34:56And as you know, like authentication, authorization,
- 34:59IM tools are designed to handle that as kind of core sweet spot
- 35:03and kind of delegating that out to every application to be a
- 35:08snowflake is not really the best approach.
- 35:12But if you say, all right, well, I'm going to accept this
- 35:16skepticism and I'm going to be really successful at launching
- 35:20authentication, you start to build, you know, the word from
- 35:24the last question, trust with those stakeholders.
- 35:27And now you can kind of leverage that trust to say, all right,
- 35:32let's keep going. Let's kind of go for that big
- 35:34vision that we've been talking about and kind of targeting from
- 35:38the very beginning. So those are my initial
- 35:41thoughts. Yeah, I think there's a lot that
- 35:44can go wrong and it will go wrong.
- 35:45And so be ready for that, especially in your first years,
- 35:49you're getting something rolled out is be flexible and build in
- 35:52time or capabilities or ideally both to address all the things
- 35:57that you didn't think of when I say you, meaning the
- 35:59organization, the program, whatever that looks like.
- 36:02When it comes to rolling this out, there will be things that
- 36:05will come up, they will come up early, they will come up in the
- 36:09middle and they will come up right before you launch.
- 36:11So be ready for it. And then I think, you know, the
- 36:15politics of getting things rolled out is also challenge.
- 36:17You need to get buying and support from a lot of different
- 36:20people in the organization to get things done, whether it's
- 36:22scope, whether it's getting applications integrated into
- 36:26your into your platform, you know, whether it is, you know,
- 36:30different data pieces that you want to pull in, right?
- 36:33All that stuff requires partnership with other parts of
- 36:37the organization to get that. And so, yeah, you've got to
- 36:39build trust. It can't just be, you show up
- 36:42and say here, I need this data and they're going to give it to
- 36:45you. They wouldn't be doing their
- 36:47jobs if they didn't question, well, what do you need this for?
- 36:50Why are you using it? What are you doing with it?
- 36:52And how are you going to protect my user experience and my users
- 36:55to make sure that my system doesn't break all valid
- 36:58questions, right? So you've got to be able to
- 37:00address, you know, all of that. Yeah.
- 37:03And if your response is those aren't your users, those are the
- 37:06organization users, you're missing the point.
- 37:09The point is like you don't want to be fighting with everybody.
- 37:13You need to kind of as much as possible build alliances with
- 37:17the folks that, hey, maybe they're giving you a hard time.
- 37:21This is really, I think we say, you know, anybody, you can come
- 37:24from any background, then be an IM program manager.
- 37:28But I think the people who make good IAM program managers
- 37:31realize that, you know, just because they don't get along
- 37:34with somebody doesn't mean I've got to fight them to, you know,
- 37:38get them to do what they should be doing or do what's right.
- 37:42Put the organization goals in mind and what you have to
- 37:45accomplish. And if sometimes you have to
- 37:48bite your tongue, then that's just the way it is.
- 37:51Yeah, I mean, you can go and fight everybody if you want, but
- 37:55real hard time, first of all, making any friends and getting
- 37:58anything done. So find, you know, areas that
- 38:01you can align on and honestly address the questions that come
- 38:05up. I think it's the other thing
- 38:06too, before you're not going to have all the answers.
- 38:09That'll be part of the things that you miss as you go through
- 38:11this. It happens to everybody.
- 38:13It's a lesson learned for next time.
- 38:14And you add that to your checklist for the next time.
- 38:16And then they'll be new things. You add those to the checklist,
- 38:19Jim and I have like a 15 step checklist just for recording
- 38:23this podcast because each thing on that on that checklist,
- 38:26something has happened to cause it to be on there.
- 38:28I joke with our guests. It's like the the the warning on
- 38:31the shampoo bottle that says don't drink shampoo, right?
- 38:34Jim's holding up his Airpods case are very early episodes.
- 38:37He was constantly flicking his, his Airpods, you know, the case
- 38:40and it was driving me crazy. And so there was a line at him.
- 38:42Jim, throw your iPods case across the room so it doesn't
- 38:45tempt you, right Though it's OK to get smarter.
- 38:48It's OK to get better. And I think recognize that you
- 38:51don't have all the answers. There will be things that are
- 38:54not able to be answered and that's OK.
- 38:58Just make sure that you understand that and you can you
- 39:00have viable alternatives or plans you can work around with
- 39:02it. OK, next question.
- 39:06We got two more here, Jonas. In Germany, in many parts of the
- 39:11world, a significant portion of the population doesn't have a
- 39:14smartphone or reliable Internet access.
- 39:16How can digital identity systems be designed to serve these
- 39:20offline populations, ensuring that digital inclusion doesn't
- 39:24become a barrier to accessing essential services like
- 39:27healthcare or banking? Another good one.
- 39:29Thanks, Jonas. Jim, where do you want to start
- 39:32with that one? People don't have access.
- 39:36By the way, these questions have been fantastic.
- 39:39I think it's a very real issue, and I think it's even a more
- 39:43real issue for governments. You know, Jeff, I think a lot of
- 39:48times when we're working with science, like, oh, there's some
- 39:52small percentage of the population that doesn't have
- 39:56smartphones and we usually come up with like a small workaround.
- 40:01I read an article recently about I think it was, well I'm not
- 40:05sure what nation it was in, but it was somewhere in Africa and
- 40:10it was actually mentioned that a lot of the citizenry.
- 40:14Chooses to have flip phones rather than smartphones because
- 40:18of the power consumption and they can keep a, a flip phone
- 40:22active for like a week on one charge.
- 40:25So it's a, it's a big thing. There's also scenarios I think
- 40:29that we've learned about where they're like clean rooms or
- 40:33things like prisons where folks can't bring in soft tokens.
- 40:38So I think one thing is that, so it's like sizing up what is your
- 40:43issue? Is it that one 2% of your user
- 40:46population is a much larger, you know, I'm not, I'm not going to
- 40:51sit here and make a case for multi factor authentication
- 40:56using SMS. But I do think multi factor
- 40:59authentication using SMS for say medium risk type access, medium
- 41:05assurance use cases is something that could be considered.
- 41:11So for example, if the data that you are securing is only your
- 41:18data, right? So in other words, there's no
- 41:20privilege access going on. I think an SMS might in some
- 41:25cases. It obviously depends on what
- 41:27that data is, but the overall risk of that access, the overall
- 41:32requirement for assurance of who's logging in.
- 41:35You could go for a lower assurance use case and a lower
- 41:40assurance form of authentication.
- 41:45If you have a very small user population with higher risk
- 41:49access, consider using heart tokens, UV keys, or some other
- 41:54form of heart token like an RSA token, something like that.
- 42:00But I, you know, I think those are probably some of the, the
- 42:04key scenarios. Like are you looking at a large
- 42:06user population that doesn't have smartphones where you can
- 42:10do soft tokens and authenticator apps?
- 42:13Or are you looking at a very large, a very large group or a
- 42:17very small group? And what is the requirement for
- 42:21the level of assurance? Are these privileged
- 42:23administrators? Are these people who have access
- 42:27to a lot of data, such as data, or are they just accessing their
- 42:31own data? Maybe it's a rewards program,
- 42:34something like that. Hey, SMS is probably going to
- 42:37work. And by the way, SMS works on
- 42:40flip phones as well. So those are some of the
- 42:42thoughts that come to my mind. I don't have a good answer for
- 42:47this because the last I checked and I did some research on this
- 42:49actually from a stats perspective to see about let's
- 42:53see, 1/3 of the world's population does not have
- 42:57Internet access. So roughly 2.6 to 2.7 billion.
- 43:01And these are stats from bank myself and Statista or Statista,
- 43:06I'm not sure how you pronounce the website.
- 43:07So I kind of looked at this, but basically a third of people do
- 43:11not have Internet access. So if I don't have Internet
- 43:15access, how do I do anything in today's world and not get left
- 43:20behind? That is the billion dollar
- 43:23question because I think this is something we also discussed in
- 43:25Germany when we're at EIC earlier this year.
- 43:28One of our podcast, and I don't remember exactly where it came
- 43:30up in those conversations, but was how do you connect the
- 43:34unconnected and cell phone? Sure.
- 43:38I think the stat I saw was like 88% of the people have a cell
- 43:43phone doesn't really differentiate between a
- 43:45smartphone and a dumb phone as we'll call it.
- 43:48So there is a lot of work to go there.
- 43:51I don't think it's viable to say, well, I'm just going to
- 43:53ship on Ubikey like that doesn't make sense to do what they don't
- 43:57have a computer going to deal with that Ubikey right.
- 44:00So I think I think it's a real problem The the answer I I don't
- 44:05know what it is. I, I don't know if I have a good
- 44:07answer for Jonas here because it's, it's a question that I see
- 44:11answered and I'd love to hear from anybody who has ideas on
- 44:14this. I think there was a project
- 44:15called Worldcoin or something like that where Sam Altman had
- 44:19some sort of like retinal eye scanner thing that he was
- 44:22sending to all different cities around the world to do some sort
- 44:25of like in person identity verification.
- 44:27I don't know enough about it, but it seemed to me like that
- 44:30wasn't a good solution. So I don't know what the answer
- 44:34is If you, if I don't have Internet and I and I don't have
- 44:37a phone, you know, you know, I'm going to get, they're going to
- 44:43get. I just jumped to scenarios.
- 44:45Here, which is that you do have Internet, but I mean it's a good
- 44:48question like where, what is your Internet access?
- 44:51Is it your flip phone? Is it like kind of a browser?
- 44:54And do you remember going into the browser on your flip phone
- 44:57when flip phones were evolving? It was pretty rough.
- 45:00You had to hit the five key like 3 times to get to the third
- 45:04letter on that button. Yeah, A.
- 45:06Little T9 predictive text. I mean, you're talking to wrong
- 45:08person with that because, you know, I rocked Windows Mobile
- 45:11way, way back in the day. So, you know, before that we had
- 45:14Palm and stuff like that. But you're totally right.
- 45:16And I would argue probably the vast majority of people don't
- 45:19have computers. They probably only access the
- 45:22Internet on their phone and. And if.
- 45:25They don't have a a relatively modern smartphone and I'd I'd
- 45:28say you know something that's running either iOS or most
- 45:31likely Android because iOS is mostly AUS thing.
- 45:36Most people are running an Android phone of some sort.
- 45:38They may be several years out of date then they may not have all
- 45:42the security patches. They may be prone to all sorts
- 45:44of backdoors and things that get left behind even from the OS
- 45:48makers where they just say, yeah, it's been 7 years of
- 45:51updates, It's been five years of updates.
- 45:53We just, we're not going to patch those anymore.
- 45:56And so that leaves not only a, a, a large percentage of the
- 45:59population with extremely limited functionality from an
- 46:03access standpoint, they don't have the latest security
- 46:05patches. And so they are ripe for, you
- 46:08know, a lot of problems and, and people take advantage of them.
- 46:12Yeah, One thing that came to mind is we're talking about
- 46:15people don't have the Internet access was maybe kiosk is part
- 46:19of the answer, but it's it's all part of the answer, right.
- 46:23It's the identity practitioners on the ground of, or technology
- 46:28practitioners really even more broadly, solving these problems.
- 46:33Shout out to them because you have to take all these parts and
- 46:37pieces and wire together what your solution is going to be.
- 46:41And it may not be perfect. I will say that, you know, when
- 46:45you're a government trying to address the population, you,
- 46:49you're always striving for as perfect as it can be, as
- 46:53inclusive as it can be, leaving out large segments of your
- 46:57population is not, not fair, right?
- 47:01And so, and I don't say that to not the people who are coming up
- 47:07with these solutions. Obviously they're doing their
- 47:09best, but that is the challenge. Yeah, I think it's, you know,
- 47:14this is the word inclusion comes in.
- 47:16It's like how do you design systems that are inclusive of as
- 47:20many people as possible for the people who can't be included?
- 47:24What are the organization's governments, whatever that looks
- 47:28like, doing to bring those people with them?
- 47:31Because I'm sure it doesn't make sense.
- 47:33Like if I was building on a system and say, OK, well, we're
- 47:35always going to have 1/3 of our population never able to use
- 47:38this product like that is that sounds stupid to me.
- 47:42Like from a from like even just on making money, capitalistic
- 47:45kind of approach. But even from a coverage of the
- 47:46government, supposed to be government of all the people.
- 47:48What are you doing to bring that third up to at least some level
- 47:53of parity to be able to access a service?
- 47:56Because if I don't do that, the other 2/3 of my audience are
- 48:00never going to reap the full benefit of a 100% solution or a
- 48:03solution as more people take advantage of it.
- 48:06You know, we look at mobile driver's license, for example,
- 48:08here in the US we're what a decade it feels like into this.
- 48:11And I, I think it's only what 1415 states that have it only 35
- 48:17or whatever more to go. So it means we're still decades
- 48:20away from that because not everybody has gotten on board of
- 48:23supporting that, you know, that concept.
- 48:25So I think it's AI think it's multi pronged approach.
- 48:28I think we need a ton of solutions, but I also need to
- 48:30think we look at the problems say, OK, why don't these
- 48:33populations have Internet access?
- 48:35What are we doing to give them some level of access so they can
- 48:39access resources for people who don't have cell phones or have
- 48:42older cell phones? What are we doing to either
- 48:45replace or update those phones, whatever.
- 48:47And hey, this all comes down to money and taxes and that makes
- 48:51everyone really happy all the time.
- 48:52So I'll just leave it at that point.
- 48:54But there are so many factors here that it's it's it's almost
- 48:57impossible for me to even have a coherent thought about it.
- 49:01Do you have a digital driver's license right now?
- 49:03Nope. Not available in North Carolina.
- 49:07When I was at the airport yesterday, I saw a lot of people
- 49:10using them and I had technology envy big time.
- 49:15Yeah, I mean, and look, I'm a nerd.
- 49:17I want as much things, you know, as I can digitize as much as
- 49:20possible. I don't write anything down.
- 49:21Everything is notes that I type. I can type that so that I can
- 49:24write. So I'm with that.
- 49:27You know, we, we had the REAL ID here in the US you know, that
- 49:30theoretically was supposed to launch in May when we were at
- 49:34EIC. And, you know, that's been
- 49:35postponed several times because we've only had 20 years to get
- 49:39that right. And we still haven't figured out
- 49:40how to do that. And at least here in North
- 49:42Carolina, you know, trying to get an appointment with the DMV
- 49:45takes literally months. And of course, if you're the
- 49:47kind of person to waste the last second to get anything done,
- 49:51yeah, Now you can't board a plane because you have a
- 49:53reality. So they've actually like relaxed
- 49:56restrictions because we don't have our, you know what together
- 50:00to support that. OK, I'm going to get off my
- 50:05soapbox in that one because I'm starting to get angry.
- 50:08Rachel, in Canada, this is the last one.
- 50:10Oh, this won't be controversial at all.
- 50:12Biometric data like fingerprints or facial scans is often used in
- 50:16digital identity systems because it's so unique.
- 50:19What are the fundamental pros and cons of using biometrics for
- 50:22identity verification? And what are the main security
- 50:25considerations organizations must address when storing this
- 50:28kind of sensitive data? OK, biometrics, not
- 50:32controversial at all. How do you want to respond to
- 50:34Rachel? Well, if she asks about the pros
- 50:38and cons, I think the pros are increased security, increased
- 50:43convenience. I love using fingerprint on, you
- 50:47know, rather than having to type in the password.
- 50:51And I think it's more more secure than relying just on
- 50:55passwords. I think the risks are, you know,
- 50:59if that data were to fall into the wrong hands risk that, you
- 51:03know, you're being surveilled. I think those are some of the
- 51:07key risks. You know, I think that the best
- 51:12practices for managing it well, one thing is it could keep the
- 51:19the biometrics on the device rather than uploading it to use
- 51:24some kind of central server. So you see a lot of solutions
- 51:28keeping the biometric on the device and then communicating to
- 51:31the back end with some secure channel.
- 51:36I think that if you do have to put it on the security channel
- 51:41now you're very dependent on that organization doing a good
- 51:45job of securing your biometric data.
- 51:48So you're hoping that they're doing something like tokenizing
- 51:51it and things like that. So high level response to that
- 51:57question is a good question. I mean, it's, you know, you see
- 52:00it propping up more and more every day.
- 52:02And I think that it's got, it's getting to the point it's like,
- 52:07well, you know, it's definitely a train that is too far out of
- 52:11the gate to stop. I think that's a good thing.
- 52:14But I think these questions on, you know, how secure is my data,
- 52:20They're just completely legitimate questions.
- 52:24Yeah. It seems kind of like a running
- 52:25theme here with some of these questions is trust.
- 52:27Do you trust wherever the state is being stored?
- 52:30Look, I like biometrics. I think it's a great technology,
- 52:32a great solution. It's easy.
- 52:34It's, you know, you, you can't forget your face as much as
- 52:37maybe I might want to. Your face is with you all the
- 52:40time. Or your fingerprint, right?
- 52:41Or your voice or whatever that may be.
- 52:43Is it perfect? No, of course not.
- 52:45Nothing is. But is it better than, you know,
- 52:48a password? Heck yeah.
- 52:50I mean, how many people want to keep remembering passwords or
- 52:53have to change them or have to use upper or lower and then you,
- 52:56you know, have all the different problems with that.
- 52:58So there is an obvious Bennett to biometrics with the
- 53:03assumption that the biometric data is being processed and
- 53:07stored securely and that there is some transparency how it's
- 53:12being used. Again, it's your data.
- 53:15So what happens if your face gets stolen?
- 53:19I can't really go change my face as much as I want to, you know,
- 53:22this is this is it. So if that biometric data
- 53:26becomes compromised somehow and someone's able to duplicate it,
- 53:29whether it's, you know, figure out how to unencrypt the
- 53:32information or whatever it may be, that's a real problem.
- 53:36And we need to have some ideas around how do we make sure that,
- 53:41you know, there's some, some indicator somewhere that says,
- 53:44you know, Jeff's face is compromised in more ways than
- 53:47one, right? So how do we, you know, how do
- 53:50you address those sorts of things?
- 53:51Same thing with fingerprints. You know, voices can be altered,
- 53:54right? All that stuff.
- 53:56So it's a very sticky situation. I think in the end, benefits are
- 54:01good and it gun comes down to trust.
- 54:04Yeah, If you put everything to a centralized database and then
- 54:07that centralized database gets breached, what are you going to
- 54:11do? Add?
- 54:11To it, this whole new concern, which is that of deep fakes, I
- 54:17can, you know, create an AI avatar of your face, of your
- 54:23voice, maybe not your thumbprint, but you can see this
- 54:29is a big time concern. Then quantum computing.
- 54:32How's that going to affect it? One thing I would say is like,
- 54:35you know, you and I are very good about talking about these
- 54:39topics and more or less the abstract.
- 54:42We have the sponsors spotlight episodes where our partners,
- 54:48our, you know, technology vendors come in to talk about
- 54:52their specific solution, how they solve these problems.
- 54:55And we try to keep those episodes educational on, Hey,
- 55:00here's the the topic in the industry, as well as giving the
- 55:04opportunity for our sponsors to talk about how they solve that
- 55:10specific problem with their technology.
- 55:12We also try to keep some entertaining as well.
- 55:16So I'd say if you've kind of heard any of the topics today,
- 55:20if you're coming from a technology vendor and you're
- 55:22like, guys, you need to talk about you fill in the blank,
- 55:27reach out to us. You know, we we should talk
- 55:30about the sponsor spotlight episodes, but none of what we
- 55:34talked about so far has been sponsored.
- 55:37Yeah, I almost sound like a like that was a shameless plug there
- 55:39for more sponsors. But there are a lot of options
- 55:42in this space and you just, there's no silver bullet, you
- 55:48know, as of at least September and recording September 19th of
- 55:522025, there's a lot of really good options.
- 55:55And I think layering those options is the approach here to
- 55:57make sure that you try to get as many people involved as possible
- 56:03served in one way or another with whatever capability makes
- 56:06the most sense. And just understand and know
- 56:08that you're not going to be able to get everybody.
- 56:10And then, you know, some of it is going to be under control.
- 56:12Like, I can't solve every single problem in the world as much as
- 56:15I want to. There are other things that need
- 56:17to happen to make that, you know, to make that problem
- 56:20become something that is solvable.
- 56:22And it may take days, months, years, decades, lifetimes, you
- 56:27know, but we see that. But progress marches on.
- 56:29Sometimes it doesn't move as quickly as we want it to, but it
- 56:31does move on. And you know, hopefully people
- 56:35can can take some sort of solace in that.
- 56:37I feel like it's a little of a downer these last couple
- 56:40questions, but hopefully that helps.
- 56:43Yeah, One thing I just, you just reminded me I'll I'll be quick
- 56:46is and maybe I won't be so quick, but is that a lot of
- 56:53times talking about the happy path.
- 56:55So whether it's like the biometric authentication, things
- 56:58like that, it's the unhappy path.
- 57:01It's how do I call the help desk and say I need my password to
- 57:05reset things like that. That's how the breaches are
- 57:09primarily taking place today. It's social engineering.
- 57:12If you can take out the social, if you can take out like the
- 57:15fishing, then all they have left is the social engineering.
- 57:18If you're, if your main process is too hard to hack, make sure
- 57:24that your help desk isn't getting hacked.
- 57:26Make sure that you've got enough controls at the place where you
- 57:32can get socially engineered to let somebody in your
- 57:35organization is basically open the front door.
- 57:39Do what you can to solve that problem.
- 57:41And a lot of times that's process and there's a lot of
- 57:44technology out there that can support that as well.
- 57:48Yeah, you've seen a number of those things come through.
- 57:50And chances are the way you're going to get breached is through
- 57:52a human social engineering gives up a password, uses a bad
- 57:56password, you know, clicks the MFA prompt that we said we'll
- 57:59solve all of our problems. And yet somebody goes and says,
- 58:01yeah, sure, go ahead, right. There's just you can't, you
- 58:05can't ignore the human factor. And so people will unfortunately
- 58:08always be the weak link, at least until the all the AIS take
- 58:11over and then we don't have to worry about it.
- 58:13They'll just tell us what we can and can't do.
- 58:14So I'm surprised we didn't have an AI question really in this
- 58:16bunch, but that might be refreshing for people.
- 58:19Yeah, right. For sure.
- 58:21All right. Let's wrap things up ending on a
- 58:25lighter note. We were kind of pontificating
- 58:27before we hit record here what we want to go with, and I think
- 58:31we started down the air travel route of problems that you and I
- 58:35have experienced. And maybe some of these are
- 58:36recent, maybe not, but let's start there and let's maybe
- 58:39treat this a little bit like we're ahead of time.
- 58:41But Festivus, you know, we've got the airing of the
- 58:44grievances. Let's just start with generally
- 58:47speaking, what are some air travel etiquette things that
- 58:52people should be aware of when they're on a plane or maybe in
- 58:57an airport or something on those lines?
- 58:59Let's get some education out there.
- 59:01OK, I think First off, you learn etiquette probably over time or
- 59:09but some of it's just the basic human decency.
- 59:13You know, don't take off your shoes and stink up the plane.
- 59:18Don't eat sauerkraut on the plane.
- 59:21Don't do things that are going to gross other people out or are
- 59:25inconsiderate of the people around you.
- 59:28And now I want to talk about one specific thing that I've seen
- 59:32happen more and more recently, and it really irks me, which is
- 59:38here's how planes unload people by row.
- 59:43People in the front of a plane, usually if the X is on the front
- 59:46of the plane, get off first, right?
- 59:48And then it's row by row. And if somebody like said, go
- 59:52ahead, go get off in front of me, fine.
- 59:55However, if you think that you're going to just push your
- 59:59way to the front of the line or but that is tremendously rude
- 1:00:04and we can't be friends, well. Hard stance.
- 1:00:08There can't be friends. I agree.
- 1:00:10I think it's just a thing. I I don't see that very often.
- 1:00:13I think what I typically see more and I, and I will defend
- 1:00:16this practice is if you've got a tight connection, usually the
- 1:00:21airline is aware of that and they ask people to stay seated
- 1:00:24to say, hey, let the people with the tight connections deplane
- 1:00:27first so they can get out there. And I've been part of that group
- 1:00:29before. And I can tell you as someone
- 1:00:31who was on a tight connection, as in me literally running
- 1:00:35through the Atlanta airport to make my flight to Amsterdam, I
- 1:00:39greatly appreciate it. You know, being able to skip
- 1:00:41even the four or five rows that I had to get to the front
- 1:00:44because I was already kind of, you know, near the front anyway.
- 1:00:47The problem I have with it is all of a sudden everybody's got
- 1:00:50a tight connection. And so people who are obviously
- 1:00:55not, you know, underneath, under that sort of duress tend to take
- 1:00:58advantage of the situation. So have a heart, you know, think
- 1:01:02of it as if you were in that position.
- 1:01:04If you've got plenty of time, you know, let those people pass.
- 1:01:07If you're one of those people, make sure they understand like,
- 1:01:09hey, I've got to take connection.
- 1:01:10Do you mind if I, you know, get in front of you?
- 1:01:13You can do that all as you're taxing to the gate right?
- 1:01:16Doesn't have to be like right that second.
- 1:01:18Say hey, talk to the people around and say hey.
- 1:01:20Just FYI got a tight connection is OK.
- 1:01:22If I get in front of you, 99% of the time people are cool.
- 1:01:27Yeah. And so that should be a
- 1:01:28relatively straightforward thing I.
- 1:01:30Totally agree with you. I've been on both sides of it as
- 1:01:32well and I've stayed put in my seat.
- 1:01:34If I didn't have a tight connection, I've gotten up and
- 1:01:37taken advantage of it wherever you need to.
- 1:01:42Yeah, but I think it's the me first mentality that bothers me.
- 1:01:47And you see it on the roads a lot of times where it's like,
- 1:01:50are you got a queue of cars and someone's like, oh, well this
- 1:01:54lane is free. I'm going to go all the way up
- 1:01:57until they go down those two lanes.
- 1:02:01Me first. Or someone sees that you're
- 1:02:03backing out of your spot and they're just like, no, I'm
- 1:02:06going. Or you turn on your turn signal
- 1:02:09and the person speeds up so you can't switch lanes.
- 1:02:12Me first. I don't like that.
- 1:02:16Be considerate of your of your fellow humans, that's all.
- 1:02:20OK, I'm, I'm OK with that. That's, that's a stance I can
- 1:02:22get behind. Where do you feel about people
- 1:02:25standing up when the when they get to the gate, immediately get
- 1:02:31to the gate and people stand up automatically even there's
- 1:02:34really nowhere to go? That drives.
- 1:02:37People crazy for some reason I don't quite get it, but it seems
- 1:02:41to be a common thing that people complain about is why is
- 1:02:43everybody saying even if they're like row 30 all the way in the
- 1:02:45back, you know back of the bus people stand up immediately when
- 1:02:49they land I. Don't know everybody's reason
- 1:02:51for doing what they do. That doesn't seem to bother me.
- 1:02:54I had a flight yesterday from Orlando to Denver.
- 1:02:58Is 4 hours as in the middle seat?
- 1:03:01My legs were cramped up by the end.
- 1:03:05I couldn't wait to stand up, but I had a middle seat wasn't able
- 1:03:09to stand up until like I literally walked off.
- 1:03:12But yeah, that doesn't that one doesn't bother me too much.
- 1:03:16I don't see how that really infringes on other people.
- 1:03:20Unless your your goal is to get your bag and to move up two
- 1:03:23rows. Then I think it's me first
- 1:03:26mentality and I don't like that. Yeah, I think it's I, I get, you
- 1:03:31know, the older I get, it's like, I've been sitting for X
- 1:03:35number of hours. I need to, like, stand up and
- 1:03:36stretch my leg, especially when you're crammed into these tiny
- 1:03:38little airplane seats that nobody fits into.
- 1:03:41So I get it. I don't have a position on it,
- 1:03:43but I thought I'd throw it out there because I see it commonly
- 1:03:46on, you know, like the Delta subreddit, which I see from time
- 1:03:50to time is like, why are these people staying home?
- 1:03:51And like, cares, you know, they're not going anywhere
- 1:03:54faster typically than anyone else.
- 1:03:56Usually they're stuck behind everyone else.
- 1:03:58You have to see those videos. Sometimes people post and it's
- 1:04:00like someone takes off their shoe and puts it on the arm
- 1:04:04like. Gross.
- 1:04:06I haven't run into anybody that's that inconcerate yet, but
- 1:04:10that is nasty. Yeah, it's.
- 1:04:12Pretty gross I had. One issue where somebody behind
- 1:04:15me had their barefoot on my like armrest on the window.
- 1:04:20And so the person's gross big toe and it was not a, it was not
- 1:04:24a a nice big toe. It was a pretty gnarly looking
- 1:04:27one. And you know, I put my elbow
- 1:04:30there and then, you know, I'm end up moving and it kept
- 1:04:32showing up there. And so, you know, I just started
- 1:04:35like, you know, elbowing it and you know, stuff like that.
- 1:04:39And I eventually I eventually got the hip, but just gross.
- 1:04:42Keep your shoes on, people. You got your little space and
- 1:04:48just think about like the people around you is that.
- 1:04:54I think that is the two things that I've learned in my decades
- 1:05:00of travelling. 1 is be considerable of other people and
- 1:05:06then the other is like manage and maintain your temper because
- 1:05:11things happen during travel. You're sitting on the the runway
- 1:05:14for two hours and it's the plane track that's being filled with
- 1:05:20exhaust fumes and you're just like angry.
- 1:05:25I mean I would be. Pretty angry about that too.
- 1:05:27Like like let's come on, let's let's figure this out.
- 1:05:29But. Yes, it happens all the time
- 1:05:31though a slow burn. Is.
- 1:05:33Is preferable and you just have to somehow find a way to keep
- 1:05:43your cool and realized that this is going to happen sometimes.
- 1:05:49How about the times where you're like, you're sitting in the
- 1:05:51airport, they delay. This happened to you and I.
- 1:05:53We were both in the Atlanta airport.
- 1:05:55They delayed, delayed, delay. It's 11:45.
- 1:05:59They finally cancel. You're rebooked to the 6:00 AM
- 1:06:02flight and we can't pay for your hotel tonight because weather.
- 1:06:07And you know, it wasn't weather. It wasn't weather where you're
- 1:06:10going. It wasn't weather where you are.
- 1:06:13You could fly off the handle and be angry.
- 1:06:15It's really not going to get you anywhere.
- 1:06:19Yeah, these things are going to happen in your career of travel.
- 1:06:23Yeah, I think people who travel a lot probably understand it
- 1:06:26about the people who don't. It's just these are things that
- 1:06:29happen. You know, it's an odds game.
- 1:06:31You might go 100 trips that are totally fine and another person
- 1:06:35might go 100 trips and every single one was a disaster.
- 1:06:38So you just never know. I have the Flighty app on my
- 1:06:42phone, which is a great iOS app for anybody who is interested in
- 1:06:46like their air travel and kind of keep things track.
- 1:06:49And so I have all my flights in there that goes back back to
- 1:06:512010 and all time. I have lost 125 hours from
- 1:06:57delays since this has been tracking 11 this year 2024, I
- 1:07:02lost 33 hours of time because of delays with flights.
- 1:07:06Now some of that was hurricane related where I was like gone
- 1:07:09for three, you know, essentially 3 days, which didn't really
- 1:07:11count on that part of it. But yeah, it, it's, it's going
- 1:07:15to happen and it's just, you know, Goose Frappa deal with it.
- 1:07:20Go into a moment of Zen or whatever it might be.
- 1:07:23You have to. You have to or it's going to
- 1:07:25ruin your life. So quick story, I was flying
- 1:07:28back from Orlando yesterday. We were both in Orlando for
- 1:07:31company conference and I, I boarded the flight and I'm good
- 1:07:35and I'm on a window seat on my flight from Atlanta to Asheville
- 1:07:40and plane is boarded. You know, everybody's on
- 1:07:44essentially at this point. And I get the, the flight
- 1:07:47attendant comes back and says, hey, you've been upgraded.
- 1:07:52Like, OK, I'm like, I'm already in the window seat.
- 1:07:54There's two people sitting next to me like the point is
- 1:07:57literally ready to go and they couldn't have figured that out
- 1:08:01like before. So shockingly I declined the
- 1:08:04upgrade because I was like, I'm not going to make these people
- 1:08:05stand up to move up like 5 rows into 2D or whatever it was in.
- 1:08:11So I was like just next time tell me sooner.
- 1:08:16Don't wait till like the boarding door is closed to.
- 1:08:20Somebody else and they took 10 minutes to move up there.
- 1:08:23No, the, the, the seat was empty, but I just, I felt bad
- 1:08:29because it was like these two people sitting next to me.
- 1:08:31I'd already gotten comfortable and got my stuff kind of set up
- 1:08:34and was like I. Don't want to if it was a.
- 1:08:38Longer flight, Absolutely, but for a 38 minutes or a 45 minute
- 1:08:41flight? You didn't do that.
- 1:08:43Yeah, I don't. Know oh I'm not.
- 1:08:44I'd be ashamed. Of the old, yeah, if it was, if
- 1:08:47it was a flight more than an hour, I would have done it.
- 1:08:49But at Atlanta, Nashville is, you know, 45 minutes, maybe 50
- 1:08:54if everything you know, goes wrong.
- 1:08:55But, and I was like, just. And at that point it was also
- 1:08:58like, I don't know, 9:00 at night.
- 1:09:00I just want to get home. Yeah.
- 1:09:03All right, let's wrap it. I'll be.
- 1:09:04Interested to see what YouTube shorts you make out of if
- 1:09:10anything from the leg node comes up.
- 1:09:13I don't know. I typically don't.
- 1:09:14I try to keep it on point. So I'll probably try to focus on
- 1:09:16that. But I know you'll be getting
- 1:09:17into the YouTube Shorts thing, so you might carve something out
- 1:09:19of this. Yeah, I.
- 1:09:21Love it. Some sort of public messaging
- 1:09:23and then that's when I really get to hate because people would
- 1:09:25be like, I'm going to stand up and get past you anytime, you
- 1:09:27know, screw you, Jim. I'd like sour drought.
- 1:09:32Right. That's the one that that
- 1:09:34definitely bugs me. And as much as I like
- 1:09:36McDonald's, I do not want to smell it on a plane as it goes
- 1:09:39past me because now I'm thinking about French fries.
- 1:09:41Well, especially if you're. Starving and you don't have
- 1:09:44anything? Yeah, yeah.
- 1:09:47All right, let's call it for this week.
- 1:09:51Visit our website, idacpodcast.com.
- 1:09:54It has all of our episodes. It has all of our discount
- 1:09:57codes, all that good stuff like subscribe, share with friends.
- 1:10:02You know, we're doing crazy amounts of downloads every month
- 1:10:05now. So it's pretty, pretty
- 1:10:06ridiculous, but definitely want to keep that up.
- 1:10:09And yeah, thanks to everyone who always reaches out and sends
- 1:10:12this message on length ends, people who see at conferences,
- 1:10:14etcetera. Also forward to meeting us
- 1:10:16folks. So we'll go ahead and leave it
- 1:10:18there for this week. Thanks everyone for watching and
- 1:10:22or listening and we'll talk with you all in the next one.
- 1:10:26You've been listening to Identity at the Center.
- 1:10:30We hope you've enjoyed the show. Make sure to like, rate and
- 1:10:34review, and we'll be back soon. But in the meantime, hit the
- 1:10:38website at identity@thecenter.com.
- 1:10:42See you next time on Identity at the Center.