Latest / Identity at the Center / #359 - Identiverse 2025 - Andrew Shikiar’s FIDO Alliance Update

Transcript

#359 - Identiverse 2025 - Andrew Shikiar’s FIDO Alliance Update · Identity at the Center

• 0:05
  This is identity at the center. Welcome to the Identity of the
• 0:11
  Center Podcast. I'm Jeff, and that's Jim.
• 0:12
  Hey, Jim. Hey.
• 0:13
  Jeff, how are you? Oh, not so bad yourself.
• 0:15
  Fantastic man here at Identiverse 2025.
• 0:18
  So much to talk about. We've done identity squabble
• 0:23
  last night. We did a podcast with the saving
• 0:27
  folks today. This morning's shout out to
• 0:29
  Enrique and David Lee. I can't wait till that comes
• 0:31
  out. I'm really excited to watch
• 0:33
  that. And yeah, they make their such
• 0:35
  like their whole recording studio was, is way better than
• 0:38
  what we're doing here, more, much more professional.
• 0:40
  But it was fine. We're fine.
• 0:43
  We're doing OK, guys. We also had identity beer and I
• 0:47
  just got my umbrella associates identity authority beer, so I'm
• 0:53
  excited from. Sebastian, right?
• 0:54
  From Sebastian and Roland. Yeah.
• 0:56
  Do you know what Umbrella Associates is?
• 0:58
  Do you know what the the nod is to that?
• 1:00
  No, I don't, but I know. There is.
• 1:02
  One, it's a video game Titan, OK, but it's also their company.
• 1:04
  But yes, yeah. Yeah.
• 1:06
  Umbrella labs or something or? Something like that corporation
• 1:11
  or whatever. I'm not the expert, but I know
• 1:12
  it has something to do with Resident Evil.
• 1:14
  Yeah, yeah. So yeah, we're here at
• 1:16
  Identiverse live on the show floor.
• 1:17
  So thanks to, you know, RSM. RSN.
• 1:22
  Forgetting us here and setting up.
• 1:23
  CRA for like sponsoring, basically giving us this awesome
• 1:26
  space. Yeah.
• 1:27
  So, yeah, definitely appreciative.
• 1:30
  We might have people just walk up to us and talk in the middle
• 1:33
  of us recording here an episode, but we'll deal with it like we
• 1:35
  always do live. But yeah, why don't we jump
• 1:38
  right into it? We've got our guests.
• 1:39
  We were trying to figure out, is this like the 10th, 11th time?
• 1:42
  Andrew Shikiar, part of the Fido Alliance here, executive
• 1:45
  director and still C MO CEO. OK, welcome.
• 1:50
  I guess back for the 11th. Thank you.
• 1:51
  Yeah. I can't be here enough.
• 1:53
  It's great to be here. Thank you.
• 1:54
  Thanks guys. Yeah, exactly.
• 1:56
  So let's start with I guess what you've been up to.
• 1:58
  So you've got authenticate Con coming up here in a couple
• 2:01
  months, but what's new in the world of Fido?
• 2:04
  You know, more of the same, right?
• 2:05
  So, you know, very focused on pushing passkey adoption since
• 2:09
  we talked last, more passkeys are enrolled.
• 2:11
  We're seeing good progress overall, right?
• 2:13
  So you know, Fido's mission is to reduce the world's reliance
• 2:16
  on passwords, right? And passkeys are better
• 2:18
  alternative than passwords and legacy forms of MFA.
• 2:21
  So I just gave a talk earlier today, shared some updated
• 2:24
  numbers, and we estimate there's over 15 billion accounts that
• 2:27
  can use pass keys. In reality, you know, probably 2
• 2:31
  billion plus are in active use today, which is a very big
• 2:34
  number, right? So a lot of people are using
• 2:36
  pass keys, which is fantastic. And we just introduced this
• 2:40
  concept around 3 years ago, which in one way sounds like a
• 2:43
  long time, but in other ways it's really not that long,
• 2:45
  right? So three years ago when we
• 2:47
  introduced the term passkey, we introduced 2 things.
• 2:49
  One was the ability for the private key and the Fido key
• 2:52
  pair to be securely synchronized and readily available across
• 2:56
  devices, which it was a huge, very fundamental shift.
• 2:59
  It is huge and also contentious. I was at this very same
• 3:02
  conference where people are up in arms about this also excited
• 3:05
  but also concerned and both, both were legitimate.
• 3:08
  All right, good reason to be excited, also good reason to be
• 3:10
  concerned. What was the concern?
• 3:12
  Well, the concern is that is changing the the Fido security
• 3:14
  model, letting the private key, you know, leave the device for
• 3:18
  the first time, but we do that in the name of usability, all
• 3:22
  right. And so we can come back to that
• 3:23
  in a second. So introduce passkey is doing
• 3:25
  that, but also for the first time having a brand and a logo
• 3:28
  program associated with Fido. All right, so people have been
• 3:31
  doing web auth N and Fido 2 for years, but there wasn't any
• 3:34
  commonality to it, right? And every side had a different
• 3:37
  way of telling you what you're doing.
• 3:38
  And so by 1, you know, pivoting towards making pass keys more
• 3:43
  Fido, more usable, and two, giving them a name.
• 3:46
  We set the stage for, you know, where we sit today, which is
• 3:49
  where 75% of consumers are familiar with pass keys.
• 3:52
  That's. That's.
• 3:55
  Great. 75% of people, if you ask people have you heard of a pass
• 3:58
  key, you know, more people say yes and no, which is amazing.
• 4:01
  It's absolutely amazing. So on a couple fronts, 1.
• 4:04
  So it's great because now companies that are thinking
• 4:06
  about deploying pass keys can do so with confidence, right?
• 4:09
  The early adopters are, well, how am I going to explain this
• 4:11
  to people, you know, are people going to know what's happening?
• 4:14
  The fact of the matter is the answer to now is yes, because
• 4:17
  most people have, you're at least familiar with it, more
• 4:20
  likely have used a pass key on another site.
• 4:23
  The other benefit on a personal level is that I don't need to
• 4:25
  explain what my job is to people.
• 4:27
  I meet people, you know, I can explain like what a pass key is
• 4:29
  because generally if you say, well, I lead a filer like a
• 4:32
  standards organization, no one knows what that means.
• 4:33
  But if you say, yeah, I'm helping get rid of passwords in
• 4:35
  favor of pass keys and we're like, Oh yeah, I get that.
• 4:37
  I like pass keys. So yeah, there's a lot of
• 4:39
  awareness of the pass keys and we're we're seeing good adoption
• 4:42
  across the board. I think one of the most exciting
• 4:46
  thing that's happened so far this year is that we're seeing
• 4:48
  major banks support pass keys. And I think when we look back in
• 4:51
  2025, so if we interview, if you interview me in January 2026,
• 4:56
  I'm going to predict now that 2025 is the year that pass keys
• 5:00
  hit banking. So a very big, big moment here
• 5:02
  in the US is when Wells Fargo rolled out pass key support.
• 5:06
  So if you are a Wells Fargo customer, you can use pass keys
• 5:09
  to sign into your account, whether it's your native app or
• 5:11
  on the on the desktop. That's huge.
• 5:14
  That's huge because it goes back to the point I was talking about
• 5:16
  earlier, which was a concern around sync ability.
• 5:18
  And the feedback was, well, look, no one like banks are
• 5:20
  never going to use pass keys. They'll never do this.
• 5:22
  Well, they are right. They understand they're, you
• 5:24
  know, they still need to do some added signaling and things like
• 5:28
  that, you know, to, to have, you know, higher assurance on top
• 5:32
  of, of, of of a sync passkey. But you can do that, right?
• 5:36
  That's not holding people back. And I think that's very
• 5:37
  exciting. So that's what we've been up to.
• 5:39
  The other thing we're working on is like other things we can do
• 5:42
  to add added signals within the passkey sign in itself for
• 5:47
  higher assurance scenarios. Those are things we're working
• 5:48
  on and we'll continue to progress inside the Alliance
• 5:51
  over the next, you know, year or so.
• 5:53
  So I see like this. The sinking thing is such a big
• 5:55
  deal for me because I used so many different devices and I
• 5:58
  remember when the source came out, I was like, oh this is
• 6:00
  great. And then I was like, wait, why
• 6:02
  do I have like 8 different pass keys?
• 6:03
  Because I have 8 different devices.
• 6:05
  And so I understand the security implications of it, but what
• 6:08
  good is security if there's no usability and nobody adopts it?
• 6:10
  So I understand the reason for the concern, but as a consumer
• 6:15
  of this look, it makes my life so much easier, which makes me
• 6:18
  want to use it more, which in the day makes me more secure.
• 6:21
  A. 100% that's exactly it. You know, and so like having to
• 6:24
  enroll every device for every service is is this, it's a not
• 6:28
  like we were hearing this from relying parties like it's a non
• 6:31
  starter. It it also almost forces like a
• 6:37
  recovery process every time someone wants to enroll a
• 6:39
  passkey. And so it's it's almost counter
• 6:40
  intuitive or counter productive in the sense that like if you
• 6:43
  have to enroll every device or every service, you're keeping
• 6:45
  that password front and Center for someone to enroll.
• 6:48
  And with Pat, you know, well, now that you have, you know, the
• 6:50
  the passkey is syncing, you don't need to do that.
• 6:52
  You can start putting the password further and further in
• 6:54
  the background and then, you know, get rid of it entirely.
• 6:56
  And of course, companies like Microsoft are letting consumers,
• 7:00
  you know, ditch their password or new accounts for signing up
• 7:02
  without a password at all. And that's the goal, right?
• 7:04
  Our mission as an alliance is to reduce or eliminate the world's
• 7:08
  reliance on passwords. And pass keys are doing that,
• 7:11
  full stop. You mentioned the private key
• 7:15
  leaving the device. Give us the the quick and dirty
• 7:19
  version of that. Well, so it's so the, I mean,
• 7:22
  historically, you know, you have a device bound key so that you
• 7:24
  know, the private key never leaves the device and, and the
• 7:26
  user when you are going through part of the authentication
• 7:29
  ceremony, you're verifying yourself to that device and the
• 7:31
  private key is there. And then once you verify the
• 7:33
  private key talks to the public key on the server and the
• 7:36
  private key just always stays in that device.
• 7:38
  So with with pass key, you know, synchronization that, that that
• 7:41
  private key can essentially be securely managed in the, in the
• 7:44
  cloud environment. So say it's an OS cloud like
• 7:48
  iCloud or or Google Cloud or, you know, Dashlane or one pass
• 7:51
  or one of these guys. And then it's readily available
• 7:54
  wherever else you have those clients, right?
• 7:56
  So in the Apple example, it would be on my iPad, my MacBook,
• 7:59
  my other iPhone, whoever it might be, it's just it's there,
• 8:02
  right? And so then when I come in time
• 8:04
  to sign in on that new device, you know, I enter my, well,
• 8:08
  depending on, on, on the setup and the flow, I may have a first
• 8:15
  step or enter in my username. I may not need to do that.
• 8:17
  And then when it comes to sign in, I just automatically have
• 8:20
  the passkey there. And I still need to verify
• 8:22
  myself using the on device biometric or on device, whatever
• 8:25
  the screen unlock may be a biometric or a pin or a security
• 8:28
  key, But then the, the, the key's there.
• 8:31
  And so from a usability standpoint, then from the
• 8:34
  average consumer, it's, it's, it's, it's the same thing I'm
• 8:38
  doing to unlock my devices when I'm doing the sign in anywhere,
• 8:40
  right? I mean.
• 8:42
  But that's is that always the way that pass keys have worked
• 8:45
  in? A sense yeah, you're using the
• 8:47
  device unlock, right? And so when you ask your average
• 8:49
  consumer, how do you sign into thing, they'll say how do you
• 8:51
  sign into sites on your phone? They'll say I'll use Face ID.
• 8:56
  They won't say I'm using a password manager, they won't say
• 8:58
  I'm using pass keys or like they think about the interface, which
• 9:00
  is the device unlocks interface. That's that's where they, most
• 9:03
  consumers, you know, deal with, whether whether if you're an
• 9:05
  iPhone or Android or your PC, that's where they contemplate
• 9:09
  and then the passkey, you know, sits behind that.
• 9:12
  You know, so you also talked about signals becoming more a
• 9:16
  part of, you know, the Safeway to adopt pass keys for
• 9:20
  organizations that have concerns about that.
• 9:24
  Talk to us a little bit about what you're what you're
• 9:27
  envisioning there. Is that really kind of where
• 9:29
  FIRE Alliance is going or FIRE is standing?
• 9:32
  No. So I think, you know, when you
• 9:33
  think about authentication, right, or in general, I mean,
• 9:37
  it's all it's always been about signals.
• 9:40
  How much do you trust a sign? How much do you trust the device
• 9:42
  found passkey? You know, most banks, I mean,
• 9:44
  larger, like high assurance organizations will have all
• 9:47
  sorts of risk modeling and risk engine and risk signaling.
• 9:51
  And it's a matter of, you know, how much they lean on one signal
• 9:54
  over the next, right? And, and so I think that there
• 9:58
  are, you know, passive signals, there's active signals, there's
• 10:02
  all and there's all sorts of vendors, of course, this
• 10:03
  ecosystem that provide different sorts of data to a service
• 10:07
  provider for them to, you know, make their own decisioning on,
• 10:09
  right? So these things feed into a risk
• 10:12
  engine or a decisioning engine, which it then grants access or
• 10:14
  not, or maybe it triggers A anomaly or triggers a step up or
• 10:18
  things like that. So it's all about like balancing
• 10:20
  signals. Something we're working on
• 10:22
  inside of Fido Alliance are ways to actually embed added signals
• 10:27
  as part of the passkey sign in itself, right?
• 10:30
  So we're working on something called Trust Signal Framework,
• 10:32
  which is it will be a framework that will be supported in
• 10:34
  operating systems that allows very strong signals about the
• 10:40
  passkey to be embedded in that actual passkey sign in.
• 10:45
  So we're establishing both the framework and we'll be
• 10:47
  specifying some actual signals that a high assurance RP can use
• 10:52
  and lean upon to have higher confidence primarily for like
• 10:56
  the new device use case. All right, So we talked about
• 10:59
  like Wells Fargo, for example, like Wells Fargo, Wells Fargo
• 11:01
  right now they're doing like a one time binding for me to to
• 11:05
  set up my passkey. But when I'm on my same device,
• 11:07
  they know it's me and there's a high, you know, they have, they
• 11:10
  have the high degree of confidence that it's me.
• 11:12
  Now when I go to a second device with any service, that's where
• 11:15
  they, you know, you enter in, it's some some risk is
• 11:17
  introduced. And that's where I think this,
• 11:20
  our ability to add more data with that sign in is going to
• 11:25
  add a lot of value to these higher assurance scenarios.
• 11:27
  And so that's what we're focused on with this concept of trust
• 11:29
  signals, which is something we're actually working on inside
• 11:31
  of Fido Alliance. Is that something that you're
• 11:33
  working specifically on Fido Alliance like you said, or are
• 11:36
  you working on a conjunction with like shared signals
• 11:38
  framework and some of the other open standards that are being?
• 11:41
  Working on inside of Fido Alliance and of course we
• 11:43
  interact with other standards bodies across the board on on
• 11:45
  everything but so it's not tied, it's not tied to the shared
• 11:48
  signals framework, but there's obviously some some parallel
• 11:51
  concepts. I think it might come together
• 11:52
  at some point or I know there's sometimes a little bit of
• 11:55
  competition, but it's. Not no, no, no competition, but
• 11:58
  we like, we always look at like building joint use cases with
• 12:00
  those other standards bodies and we work you know, very
• 12:03
  collaboratively with Open ID Foundation, W3C and groups like
• 12:06
  that. Here's my vote for SSN.
• 12:08
  So, Sean, if you're listening, I got you.
• 12:11
  Well, let's talk about the signals again a little bit more.
• 12:14
  Where do you see these signals coming from?
• 12:17
  Well, so it's still work in progress, right?
• 12:19
  And so again, we're focused on establishing the framework and
• 12:21
  then understanding what signals we want to provide.
• 12:23
  And I think, you know, one could envision Fido Alliance creating
• 12:27
  some signals. Perhaps there's information that
• 12:30
  say platforms may have about users, about their devices,
• 12:34
  maybe about the phone numbers. There might be things like that
• 12:36
  that we may be able to specify. And there may be a framework
• 12:40
  that other people can bring a signal into.
• 12:43
  So it's still work in progress and you know, I think we'll you
• 12:46
  want to talk a little in more detail about this probably next
• 12:48
  time we we connect. All right.
• 12:49
  Well, if I get, I mean, one of the things that I was so
• 12:52
  impressed about with Final Alliance is your ability to
• 12:55
  bring all these big tech companies to the table to build
• 12:59
  out the standard for pass keys. How about they come to the table
• 13:04
  and start sharing the signals that they have with each other
• 13:08
  and with the smaller companies that obviously don't have the
• 13:11
  scale and have the the infrastructure to kind of build
• 13:15
  the millions and millions of accounts that have been
• 13:17
  compromises or devices that have been compromised, things like
• 13:21
  that. Well.
• 13:22
  I think that's part of the idea, right?
• 13:23
  So, so and we're very fortunate that we have the the the
• 13:26
  stakeholders sitting around the table that you're talking about.
• 13:28
  And I think that's why we've been successful.
• 13:30
  And there's a lot of information that you know, platforms have
• 13:33
  and and OS vendors have about users and about the pass keys
• 13:39
  that they should be able to provide to the higher assurance
• 13:42
  star piece, right. And so I think that's that's a
• 13:44
  very natural conclusion actually is to, you know, leverage the
• 13:47
  signals that the the platforms are getting as as part of this
• 13:50
  part of this output. We're lucky having this platform
• 13:52
  to give feedback, but how can others give feedback?
• 13:56
  How can other people give feedback be involved in this
• 13:59
  process? I mean, we are an open
• 14:01
  organization, so I know one can join Fido Alliance and take part
• 14:03
  in it. And I think generally, you know,
• 14:05
  always happy to engage with individuals who have ideas about
• 14:07
  things that Fido needs to do. I'm always happy to talk to
• 14:09
  people. But, you know, we have, you
• 14:11
  know, our membership's growing, we have 300 plus members right
• 14:16
  now and they all take part in the alliance and different
• 14:18
  working groups and things like that.
• 14:21
  We have our member meetings 3 * a year of authenticate in
• 14:23
  October. Authenticate's a great chance
• 14:25
  to, you know, lean in, meet a lot of these key stakeholders
• 14:28
  and, and, and, you know, bring ideas to the table.
• 14:31
  You know, we also liaise with other.org's.
• 14:35
  All right, so I mentioned, you know, we work with the Opine D
• 14:37
  Foundation W3C and with a whole bunch of different adjacent
• 14:42
  standards bodies to make sure that we're addressing use cases
• 14:44
  together and educating each other as constituents on on what
• 14:50
  we each you have to offer. You mentioned Authenticate
• 14:53
  Conference, which I love. It's one of my favorite
• 14:55
  conferences of the year. It's coming up in October.
• 14:58
  It's in the same place it's been for the last couple years,
• 15:00
  Carlsbad, Southern California in October.
• 15:03
  Is chef's kiss right? What can we look forward to this
• 15:06
  year? Is there a, a theme that's been
• 15:07
  developed yet? Like, what are what?
• 15:09
  What are we trying to get out of this?
• 15:10
  Yeah. So it's interesting, so
• 15:14
  authenticate, first of all, it's fantastic.
• 15:15
  I encourage everyone to come. It's it's really, it's a very
• 15:18
  unique environment, very collegial, very warm.
• 15:21
  One of the really cool things about the final community and
• 15:23
  you, you see this in spades that authenticate is, is this.
• 15:27
  And it sounds cheesy, but there's truly a sense of
• 15:29
  community and everyone wants to help each other.
• 15:31
  It's not cheesy because not every industry is like this.
• 15:35
  And look, we're in cybersecurity at large, but we're in identity
• 15:38
  and access management. And the identity and access
• 15:40
  management community is amazing. People walk up, introduce
• 15:45
  themselves. Yes, we have competitors and
• 15:47
  products and blah, blah, blah, right?
• 15:48
  Everyone has that. But the willingness to share and
• 15:51
  bring new people into this is such a great thing I've seen.
• 15:54
  I've met so many new people at this conference already.
• 15:58
  There's also, you know, within with pass keys, there's also a
• 16:01
  realization that it's in everyone's mutual interest for
• 16:03
  everyone to be successful, right?
• 16:05
  If someone does really crappy pass key implementation, someone
• 16:07
  has a crappy pass key experience, they're not going to
• 16:09
  use pass keys next time, right? So everyone wants everyone else
• 16:12
  to be successful with how they roll this out.
• 16:13
  And every vendor wants the vendors to be successful in
• 16:15
  helping their customers out too. So there is a sense of
• 16:18
  community, a sense of purpose, a sense of mission that's very
• 16:21
  pronounced at authenticate. So anyone who's interested in,
• 16:25
  you know, you have use cases, you need help and like this is a
• 16:28
  great chance to come and learn. So I think there'll be a lot of
• 16:30
  that. You know, one piece of feedback
• 16:32
  we got from Authenticate last year is OK, yeah, we know
• 16:34
  passkey's are great. So we don't need, you know, 75
• 16:37
  case studies hearing about passkey's or great passwords are
• 16:39
  bad. So what we're doing and we're
• 16:41
  building out the contents to be a little bit more nuanced this
• 16:43
  time, right? So not just success story after
• 16:46
  success story, but look more into data, look at some adjacent
• 16:49
  use cases, look at, you know, some some different challenges,
• 16:54
  different deployment scenarios and also look at adjacencies,
• 16:57
  right. So how are passkeys relating to,
• 16:59
  We have a new payments initiative, how are passkeys
• 17:01
  relating to payments and digital credentials and some of the
• 17:04
  spaces that we're now moving into as Fido Alliance, we'll be
• 17:07
  talking about a lot of that as well.
• 17:09
  Yeah. I mean, I'm so interested to
• 17:12
  know about the how signals can combine with passkeys.
• 17:16
  Are there real use cases out there in the wild happening and
• 17:20
  we'll be maybe get some real life stories?
• 17:24
  I think I mean, we're seeing pass keys used for for payments
• 17:27
  and then and then and other, you know, other, other spaces.
• 17:29
  And I think we'll we'll see some of those stories certainly at
• 17:32
  authenticate and then a lot of the stakeholders will be there
• 17:34
  as well. And other space, you know, are
• 17:36
  very interested in understanding is like, well, you know, how
• 17:39
  does Fido, how does Fido play in the broader, you know, digital
• 17:41
  credentials landscape? And this is something that we're
• 17:43
  actively seeking feedback on. You mentioned that, you know,
• 17:46
  the cast of organizations we have in Fido Alliance, you know,
• 17:49
  I think it's those companies that have helped us be
• 17:51
  successful, right? The fact that we have really
• 17:54
  everyone sitting around our, our virtual table that needs to be
• 17:56
  sitting around the table to solve the password problem.
• 18:00
  Can they also do work in wallets and credentials?
• 18:04
  You know, we think so. And so we're actively engaging
• 18:06
  with that broader community to see like, well, what, what, how
• 18:08
  can phyto add value here, right? What, what, what technology can
• 18:11
  we help build? Like our CTAP protocol, for
• 18:14
  example, is very well suited for credential presentation.
• 18:16
  It's being used that way already.
• 18:18
  We're expanding and building and innovating upon that to make
• 18:20
  sure that's it's very, you know, fit for purpose for credential
• 18:23
  presentation. But our certification program,
• 18:26
  for example, like can we, you know, is there certification
• 18:29
  work for us to bring into this community the the works we've
• 18:32
  done run usability, UX testing and branding and design, Like is
• 18:36
  there expertise we could bring there as well?
• 18:37
  So these are discussions we're actively having right now and
• 18:40
  we'll be having between now and October.
• 18:43
  And I think we'll have more to share and authenticate as to
• 18:45
  like where that stands. They were focused in on growing
• 18:48
  the conference from a quality or a quantity perspective.
• 18:51
  In other words, do you see it doubling in the size?
• 18:55
  How do you maintain the quality of the conference and the
• 18:59
  discussions and all the things you've been talking about?
• 19:01
  Yeah. And I think we'll continue to
• 19:03
  grow. We want to, we do want to grow
• 19:05
  the conference, but keep it at the right size, you know, So
• 19:07
  it's going to be, it's like Idanoverse, right?
• 19:08
  It's going to, it's always going to be kind of a content first
• 19:11
  conference where people come to learn and network.
• 19:14
  So I think we had around 700 people on site last year and
• 19:18
  maybe 600. We're going to grow probably 800
• 19:20
  this year, 900. And so we want to grow, but also
• 19:23
  make sure that the contents really sharp.
• 19:25
  And, but the other thing we, we hear from our attendees that
• 19:27
  they like being with each other, right?
• 19:29
  The networking is very important and the hallway cons as
• 19:31
  important as the, as the, the sessions.
• 19:35
  And so we create opportunities for, for people to network and
• 19:37
  people to meet and, and, and do all that.
• 19:39
  And so I think we'll continue to to, to grow in that regard.
• 19:42
  And also have it be a fun conference.
• 19:45
  I mean, it's fun, you know, So last year we introduced Family
• 19:48
  Feud or Phyto Feud. And I know you, you rolled that
• 19:50
  back here at Identiverse and with this identity squabble.
• 19:54
  So we'll continue to innovate with things like that at
• 19:57
  Authenticate and make sure it's a fun place for people to enjoy
• 20:00
  themselves and learn at the same time.
• 20:01
  One makes the fun in with the education for sure.
• 20:05
  You know, what I was wondering is authenticate did have a
• 20:09
  little bit of an international flair, but I'm, I mean pass cues
• 20:13
  are global, right? So talk to that for a little
• 20:16
  bit, like what else are you guys doing outside of the North
• 20:19
  America market? That's a great question, Jim.
• 20:21
  So we're actually going to introduce authenticate APAC most
• 20:24
  likely we've not announced this publicly until now.
• 20:27
  So consider to say most likely announcement.
• 20:30
  Yeah, about a month to get your to get your ducks in a row.
• 20:33
  We're targeting May of 2026 in Singapore to have our first
• 20:39
  authenticate APAC conference. And so you know as a membership
• 20:44
  we meet 3 * a year, once in the Americas, once in Asia, once in
• 20:47
  Europe. And the way actually
• 20:49
  Authenticate was launched is it, it was appended to our member
• 20:51
  plenary in the US and it still is.
• 20:53
  Our member meeting is signed with Authenticate and so we'll
• 20:55
  take the same model but bring it to Asia.
• 20:58
  So our member meeting in Asia will be in Singapore and we'll
• 21:00
  have probably a 2 day authenticate conference and a
• 21:03
  two day member meeting separate. In fact, the past two years
• 21:07
  we've had what we call the Phyto AIPAC Summit.
• 21:09
  One was in Vietnam and one was in in Malaysia.
• 21:12
  Both were very well attended. We had around 300 people attend
• 21:15
  both lots of sponsors. There's a lot of activity in
• 21:19
  Asia, especially in Southeast Asia around Fido, a lot of
• 21:23
  emerging activity in those countries.
• 21:25
  So we're very excited to actually apply the Authenticate
• 21:28
  brand to that and really, really start building on this momentum
• 21:31
  in in that part of the world. Well, do.
• 21:34
  You notice differences throughout the different regions
• 21:36
  like you mentioned APAC, right, and the North America and
• 21:39
  Europe. Are there differences you've
• 21:40
  noticed from like an adoption or style of adoption or kind of
• 21:45
  regional things like that where it's like, oh, this region
• 21:48
  really likes this or this has seemed to work here, but it
• 21:50
  doesn't work elsewhere? It's, it's interesting.
• 21:54
  I mean we're seeing adoption across the board and, and, and
• 21:56
  Japan's fascinating, right. Some, some of the earliest
• 21:59
  adoption was in Japan through NTT Docomo.
• 22:02
  They were kind of one of our early flagship RPS and the
• 22:06
  Japanese market has really accelerated over the past two
• 22:08
  years and a lot of it's being driven by government.
• 22:11
  And so we have a seminar in Tokyo every December.
• 22:17
  And two December's ago, the head of digital agency in Japan, you
• 22:22
  know, spoke about passkeys, kind of very cautious, like this is
• 22:25
  interesting and still need to see.
• 22:27
  Meanwhile, they've basically done a full embrace of passkeys
• 22:29
  now in Japan because they're seeing all these threats emerge.
• 22:32
  They're seeing the usability, the benefits of passkeys.
• 22:34
  And it's being proven out by some of the earliest adopters of
• 22:37
  passkeys worldwide are in Japan with Docomo line, Yahoo Japan.
• 22:42
  And they've had great success. And so, you know, through the
• 22:45
  success in industry, we're seeing government embraces also
• 22:48
  with, you know, E citizen services and also pushing
• 22:52
  industry to adopt passkeys to protect themselves from the
• 22:55
  ongoing growth of attacks. So, you know, Japan's one market
• 22:58
  that had very early adoption of Fido, you know, a little, you
• 23:03
  know, cautious on passkeys. Now it's going now it's going
• 23:05
  full bore in Southeast Asia. We're seeing a lot of interest
• 23:08
  in the work we're doing around identity verification.
• 23:10
  All right. So looking at like, so we do, we
• 23:12
  have a certification program for face verification for for more
• 23:16
  secure onboarding. And a lot of the government's
• 23:19
  there and the regulatory bodies are looking at pointing towards
• 23:21
  this as part of their own regulatory regimes.
• 23:25
  All right. So if you're going to do online
• 23:26
  banking, you need to onboard people using a certified method
• 23:29
  and we have a certification program that fits that.
• 23:31
  So I can't generalize, but it is interesting to see how different
• 23:38
  regions adopt in different ways. Sometimes it's driven by
• 23:40
  government, sometimes by industry, but always what it
• 23:44
  always requires is some sort of flagship service kind of being
• 23:47
  that flag bearer to to help, you know, generate awareness and
• 23:50
  generate and then drive adoption.
• 23:52
  You know, like every time we talk, I this, this topic comes
• 23:54
  up and I ask you because I'm always curious if something has
• 23:57
  changed or anything like that. So I appreciate you taking, you
• 24:01
  know, answer it the way you do because they think there's so
• 24:03
  much more that we can be doing as an industry for an adoption
• 24:06
  standpoint. But, you know, having just been
• 24:07
  at EIC for the first time, you know, exposes me personally to
• 24:12
  things that I'd normally wouldn't see as someone in the
• 24:15
  US or North America or whatever it may be.
• 24:17
  So I'm most curious what those stories are that work
• 24:20
  internationally because some I think we can learn some of that
• 24:23
  and bring that back and say, OK, well, we've seen this work
• 24:24
  elsewhere, right. And then we tweaked that on our
• 24:27
  messaging on our side to say, OK, why aren't more people using
• 24:29
  pass keys or how can we accelerate the adoption?
• 24:31
  Is it probably a better way to put it is it's?
• 24:33
  It's here, it's here. And so I think Europe, Europe
• 24:38
  has some regulatory challenges, you know, so I got a question a
• 24:41
  lot about PSD 2 and how does Fido, you know, fit how does
• 24:43
  pass keys with PSD 2? And you know, we're actively
• 24:46
  engaging with regular the regulators there.
• 24:48
  So to make sure they explicitly contemplate pass keys as they
• 24:50
  update those regulations. But we have banks deploying in
• 24:54
  Europe as well. All right.
• 24:55
  So Ibanka in in Spain and Bank ID Norway, there are banks
• 24:59
  deploying in in Europe and and we're seeing a lot of interest
• 25:02
  from central governments there as well in Fido in general and
• 25:08
  our certification programs also. Thanks for coming on the show
• 25:14
  today and I hope this background noise only enhance the episode.
• 25:19
  Yeah, we're live on the floor. I mean, you know, we, we no one,
• 25:21
  no one likes jumped in the middle of this or like threw
• 25:24
  anything at us. I was kind of, I was waiting for
• 25:27
  like a pie in the face or something.
• 25:29
  Like nothing like the face is unmarred for those watching.
• 25:31
  So yeah, all good. Yeah.
• 25:33
  So thank you again for taking time with us.
• 25:35
  What's next for you here in Vegas?
• 25:37
  So we'll kind of wrap things up with that.
• 25:38
  Like do you have more dinners, dances, gambling?
• 25:43
  Shows this is no comment on gambling.
• 25:46
  I have another night here. So I had AI had a nice session
• 25:49
  earlier on today. One thing that's always cool
• 25:50
  about, you know, being identverse and talking about
• 25:54
  Fido is that our sessions are always packed.
• 25:56
  I'm not trying to I'm not trying to be arrogant, but like the
• 25:58
  passkey sessions yesterday that Megan and team did were packed
• 26:02
  and my session today was packed. It's this is awesome to see how
• 26:04
  much interest there is and what we're doing.
• 26:07
  We don't take that for granted at all and we appreciate people
• 26:10
  actually the tuning in and wanting to hear what we're up
• 26:12
  to. So we have more sessions this
• 26:15
  week. There's a UX session tomorrow.
• 26:17
  There's there's just some other master classes.
• 26:21
  So we have a couple more, you know, pieces of content here at
• 26:23
  Universe and lots of networking and meetings and maybe a little
• 26:25
  bit of carousing as well. But we have some fun.
• 26:28
  I mean, you have balance in all things, right?
• 26:30
  Yeah. OK, we'll go ahead and wrap it
• 26:32
  up. I think for this week we'll have
• 26:33
  a late link to your LinkedIn profile in our show notes as
• 26:37
  well as final alliance.org. Definitely big supporters of you
• 26:40
  guys organization. I think that's how but 10th or
• 26:43
  11th time. You're always so great for your
• 26:44
  time. So appreciate it.
• 26:45
  Appreciate it. And you can find us on the web,
• 26:47
  idacpodcast.com, like and subscribe, do all that cool
• 26:51
  stuff. And yeah, we'll talk with
• 26:53
  everybody in the next one. You've been listening to
• 26:58
  Identity at the Center. We hope you've enjoyed the show.
• 27:02
  Make sure to like, rate and review, and we'll be back soon.
• 27:06
  But in the meantime, hit the website at
• 27:09
  identity@thecenter.com. See you next time on Identity at
• 27:15
  the Center.