Latest / Identity at the Center / #237 - OAuth 2.0 Step Up Authentication Challenge Protocol with Vittorio Bertocci

Transcript

#237 - OAuth 2.0 Step Up Authentication Challenge Protocol with Vittorio Bertocci · Identity at the Center

• 0:00
  On October 7th, 2023, our friend Victoria Bertoci passed away of
• 0:04
  cancer. A couple of weeks prior to that
• 0:06
  he reached out to Jim and I asking to record an episode
• 0:09
  about an RFC that he had been working on, with a plan to
• 0:12
  release it today, October 9th, 2023.
• 0:15
  To be honest, in the moment it felt a little bit like a goodbye
• 0:18
  and I'm glad we were able to connect one last time.
• 0:20
  The conversation, you'll hear in a bit was recorded on September
• 0:23
  23rd, 2023, and he passed away just a couple of weeks later.
• 0:27
  We are honoring his memory by releasing this episode as we had
• 0:30
  agreed to do. Victorio may be gone, but he
• 0:33
  will not be forgotten. This is identity at the center.
• 0:45
  If it has anything to do with I am, this is the go to podcast
• 0:51
  now. Your hosts, Jim McDonald and
• 0:54
  Jeff Steadman, welcome to the Identity at the Center podcast.
• 1:02
  I'm Jeff and that's Jim. Hey, Jim.
• 1:04
  Hey, Jeff, how are you? Oh, not so bad yourself.
• 1:07
  I'm doing all right. I'm looking forward to, you
• 1:10
  know, getting this episode out to everybody.
• 1:12
  He was a really important one. And I hope everyone enjoys it.
• 1:17
  Yeah, so just kind of kicked down the 4th wall.
• 1:19
  We just had a conversation with Victoria Butochi, who I'm sure
• 1:22
  most people in the industry know.
• 1:24
  We talked about the new R FC-9470-O OFF 2.0 Step up
• 1:29
  authentication challenge protocol that just got released.
• 1:32
  And he also gave us an update on where he stands from the health
• 1:35
  situation. So I'm sure people in the
• 1:36
  industry are interested to hear about that.
• 1:38
  Yeah, why don't we just get right into it?
• 1:39
  So without further ado, let me introduce the Victorio and we'll
• 1:43
  hear that conversation next. So we've got Victoria Vertochi.
• 1:46
  He's a principal architect at OFF 0 and Octa product unit.
• 1:50
  He's been on the show a few times at this point.
• 1:52
  Welcome back to the show, Vertorio.
• 1:54
  Thank you. Thank you, Jeff.
• 1:55
  And Jim, last time I believe it was in a suit in Vegas during
• 2:00
  some Gartner event, I believe it definitely was a Gartner event,
• 2:04
  that's for sure. That was a fun time and you're
• 2:07
  you're working on a new thing. This is one of the conversations
• 2:09
  we're going to talk about today is around this this new Oauth to
• 2:13
  Step Up Authentication Challenge protocol that you have an RFC
• 2:17
  out for RFC 9470 and we'll have a link in our show notes for
• 2:21
  people to check that out. I guess why don't we start the
• 2:23
  basics? What is this?
• 2:25
  What are you doing? Absolutely.
• 2:27
  The first thing I'd like to say is that I'm no longer working on
• 2:31
  it because it is finally an official spec.
• 2:35
  Congratulations. Thank you.
• 2:37
  Thank you. It took a remarkably short time
• 2:40
  because I think that we introduced the idea in May of
• 2:43
  2022. So it's actually remarkable that
• 2:47
  it went through so well and this spec is.
• 2:51
  I'd say one of the typical things that I like to do, I like
• 2:55
  to look at the current situation and see things that are
• 2:58
  unaddressed. And in particular, there is this
• 3:02
  idea of a step up authentication.
• 3:04
  That is an incredibly important scenario because of course we
• 3:08
  observe it happening all the time and yet it was absolutely
• 3:12
  no standard for it. So everyone that uses features
• 3:16
  of a particular platform that we want to use to achieve it.
• 3:20
  Which means that there is no interoperable way to do it,
• 3:24
  which means that its usage is more limited than it should be.
• 3:30
  And so with my friend Brian Campbell in Absolute Luminaire
• 3:35
  in the Space of OR, we looked into these and we said, you know
• 3:38
  what, why don't we formalize the simplest way to deal with this?
• 3:44
  And that's exactly what we've done.
• 3:48
  And basically the main point is. You can use the POP
• 3:52
  authentication statically. So imagine that you have an app
• 3:55
  that calls one method that is read only and one method that is
• 3:59
  right. You can have a static table that
• 4:02
  says whenever someone asks for this particular thing, they need
• 4:07
  to do this level of authentication or this other
• 4:09
  level of authentication and that's fine.
• 4:13
  But the reality is that things are not that simple because when
• 4:17
  at runtime. You have an app that is calling
• 4:20
  something. There are information that are
• 4:22
  only available at that moment. If I'm buying something, the
• 4:26
  cost of the things that I'm buying is only available now
• 4:30
  that I'm performing the call. When I asked for the token,
• 4:33
  there was not such information. Or now you know that with a I
• 4:38
  anomaly detection there are all these risk engine evolution
• 4:44
  components that you can place in front of your API.
• 4:48
  And visa component analyzes what you're sending and if it decides
• 4:53
  that the risk is high, basically it can just refuse a token.
• 4:58
  That on paper would be perfectly fine.
• 5:00
  So basically what we have done was we extended the error system
• 5:07
  of off to add another component. So when you call an API using
• 5:13
  off and the API refuses. Because they can send you this
• 5:20
  header, this HTTP header with some extra information.
• 5:24
  So we extended this adding the requirements that the API has
• 5:30
  internal authentication. So now you can send back this
• 5:34
  thing called ACR value, which is a buffer, A parameter and a
• 5:38
  claim that basically points to one particular authentication
• 5:43
  ceremony that is known by the authorization server.
• 5:47
  So when the client attends the call, gets back his header and
• 5:51
  the error. Now they can turn around, go
• 5:54
  back to the authorization server and include this information.
• 5:59
  So that if for example the requirement is that they have to
• 6:04
  do with both, then the authorization server will know
• 6:08
  how to do it. And the interesting part is that
• 6:11
  we are extending all authorization server to accept
• 6:15
  this parameter. But this parameter already
• 6:17
  exists in Open Any Connect. I mean, you can do exactly what
• 6:21
  I just described when you're asking for an ID token.
• 6:24
  So all we did there was to extend all proper to support
• 6:29
  this parameter. And I'm a big pragmatist, like I
• 6:33
  don't like buying the Sky stuff. And the larger majority, well, I
• 6:38
  cannot say it, but a big number of authorization server
• 6:42
  implementations out there are also open any connect.
• 6:46
  Implementations and so that means that substantially this
• 6:50
  stuff is right there, like you don't have to write extra code
• 6:54
  and the code that you have to write on the resource server of
• 6:58
  API to send back this error and the code you have to put on the
• 7:02
  client to accept and forward these requests are trivial,
• 7:08
  super simple. So now you can build systems
• 7:12
  that are very sophisticated in behavior at runtime.
• 7:16
  But are incredibly easy to implement, and in fact I know
• 7:20
  that even before this became RFC, there were a number of
• 7:24
  people that implemented early drafts just because they needed
• 7:28
  it. And this is like a I'm so glad
• 7:33
  that I had the chance to see this fruit, because it's such an
• 7:36
  important an important spec. What do you think?
• 7:41
  Yeah, Victoria, you had the. Had the podcast.
• 7:46
  Identity Unlocked was a fantastic podcast to get into a
• 7:52
  lot of the standards. I think you know I I listened to
• 7:55
  a lot of episodes and really enjoyed it.
• 7:58
  I also realized that sometimes that Lane was going a little
• 8:01
  fast for me. So forgive me if some of my
• 8:04
  questions are very basic, but I'm trying to understand within
• 8:09
  the Oauth 2 world. It seems like Okay we have the
• 8:15
  Oauth 2 standard and now we have Rfcs that go on top of that.
• 8:19
  At some point will they be rolled into Oauth 3 or Oauth
• 8:23
  2.1? How exactly?
• 8:26
  If you could very simply explain how is that going to work.
• 8:30
  So the general idea we've off is that offer is a framework, there
• 8:35
  is a course back, a couple of course backs that define the
• 8:40
  core scenarios. And then define the rule of the
• 8:43
  games when you want to extend this back.
• 8:46
  We didn't want to boil the ocean by taking everything into
• 8:50
  account. And in fact The thing is that
• 8:53
  the new scenarios that are part of the extensions are scenarios
• 8:57
  that emerged. Has the industry evolved so we
• 9:00
  couldn't have everything packed into there.
• 9:03
  So by design, technically we could go forever with these off
• 9:08
  to the core and extensions now. A small group of I don't know
• 9:16
  Good Samaritans and don't know how to define them decided to
• 9:22
  created off to the one version of the spec which substantially
• 9:27
  takes some of the most fundamental extensions and the
• 9:33
  security best practices and integrate that into the off to
• 9:38
  the one. I don't think there is much talk
• 9:42
  of the off free. That's all because of the the
• 9:45
  challenge that you have in here is also that the bigger the
• 9:48
  install base you have the more you cannot make a radical
• 9:54
  changes because you'd break stuff.
• 9:57
  In fact, there have been a tense to start from scratch but the
• 10:03
  outside of off. But we didn't go very far
• 10:06
  because off works and. People keep adding stuff on it
• 10:12
  and now it's not just a matter of techies.
• 10:16
  There are things like a Foppi, the financial grade API's which
• 10:20
  is the final operating but is all based on off which is now
• 10:24
  used officially for certifying the banks and insurances and
• 10:30
  similar. So you build on top of these and
• 10:33
  then you have to be very careful into not breaking people,
• 10:38
  especially because often. We are techies and we have a bit
• 10:42
  of a city, you know, putting the books in the bookshelf in the
• 10:46
  right height order and similar. But in fact, if you do that and
• 10:51
  then you break the actual business scenarios, then we are
• 10:55
  not in a good place. I think that's the part that is
• 10:58
  sometimes confusing for people is this idea of a core framework
• 11:02
  and then the extensions. And I feel like at some point
• 11:05
  the extensions become so popular and so prevalent and at what
• 11:09
  point do they become part of the core frameworks?
• 11:11
  I think is I think that's always a challenge, right?
• 11:13
  Because I think you probably want to maintain compatibility,
• 11:17
  right, as much as possible going backwards.
• 11:19
  But at some point, you know, you get, you know, step up
• 11:22
  authentication. This is not a new thing, right?
• 11:24
  It's been around for a while, but now it's an actual, you
• 11:28
  know, RFC, it's part, it's an extension, It's how people can
• 11:30
  take use it in a standard way, which is fantastic.
• 11:33
  Do we run the risk of, I guess what risk do we run if we don't
• 11:38
  continue to either build extensions like that and sort of
• 11:42
  agree on the way that those methodologies work versus yeah,
• 11:45
  it's time for a Oauth 2.1 or 3.0 or whatever it may be to push
• 11:50
  either security or interoperability forward?
• 11:52
  Right, so here there is a the formal aspect and then there is
• 11:59
  a bit of like readability aspect.
• 12:02
  Formally, the extensions are always incremental.
• 12:06
  So normally you don't break anything.
• 12:09
  It's only forward compatible, but never backward compatible.
• 12:14
  And the consolidation can happen for things that are absolutely
• 12:20
  obvious, like for example, Pixie is a method for protecting the
• 12:25
  code physician code, and at first it was devised for one
• 12:29
  particular scenario, but it turned out that there are
• 12:31
  certain attacks that happen all the time.
• 12:34
  And so Pixie is one of the things that is being now
• 12:37
  integrated enough to that one. So now if you want to be
• 12:40
  compliant with off to that one, you must support Pixie.
• 12:45
  The thing is that most implementations they do already
• 12:48
  because it was an important requirement, the consolidation
• 12:53
  in the two. That one is a bit trying to make
• 12:58
  it easier to discover that those things exist, because now you
• 13:02
  have like Visa. Huge graph of extensions that
• 13:07
  it's hard to navigate. So off to that.
• 13:10
  One is bringing in some of the fundamentals, the things that
• 13:14
  really you shouldn't miss. But it's more of a readability
• 13:18
  thing because in theory, even if you just keep doing extensions,
• 13:23
  everything is there. So I think you mentioned that
• 13:26
  you that this started in May I believe is that when this picked
• 13:30
  up I. Believe that's.
• 13:33
  That's when it started. Somewhere around there.
• 13:35
  But still from, I mean that's only four months to get it into.
• 13:39
  I know wait may or 22/22/22, so all right so year and but still
• 13:44
  that's still relatively quickly right for something like this to
• 13:46
  move forward? It's super, super quick, yes.
• 13:50
  Why do you think that is? Like, why?
• 13:52
  Why would? Why did this one move so much
• 13:53
  more quicker than maybe other ones?
• 13:55
  Scope. A scope was very small, a
• 13:59
  scenario was very clear and. So there was very little
• 14:04
  controversy. The interesting part is that the
• 14:06
  controversy demonstrated that everyone thinks slightly
• 14:11
  different of what step up means and so a lot of the worker was
• 14:15
  into reaching common ground. Like for example, the idea of
• 14:19
  step up is a misnomer because there is no intrinsic hierarchy
• 14:26
  of methods that might be the exact same 2 tokens.
• 14:31
  That the pending of the mood of the API.
• 14:34
  You can accept one and not accept the other and one hour
• 14:37
  later vice versa. So you cannot say that one
• 14:40
  method is higher than the other. But in the vast majority of
• 14:45
  cases it's usually a step up, as in the classic I move from read
• 14:50
  only to write and then there are also lots of other complications
• 14:56
  like when I get these new token. Should I also hold on to the to
• 15:02
  the old one? And normally the answer is yes,
• 15:05
  because when you token might be specialized for that particular
• 15:08
  call or might have like a shorter like a might be short
• 15:13
  lived and so the user experience will be bad.
• 15:16
  So all these considerations came to light as part of the
• 15:21
  discussion, but in the end there was no controversy about the
• 15:26
  need for this particular thing. And also like record was
• 15:30
  literally trivia at the same time of the of the of the our
• 15:35
  publication. They also published the POP
• 15:39
  which is an incredibly important spec, but instead it took a very
• 15:43
  long time. It took a very long time because
• 15:47
  it's complex. Basically the pop allow you to
• 15:50
  do send their constraint protection on the tokens, so if
• 15:53
  someone steals the token if they don't have the right key
• 15:57
  material. They cannot reuse it and it's
• 16:00
  all negotiated at runtime, so you don't need it to do
• 16:02
  complicated stuff like distributing certificates.
• 16:06
  It's an incredibly important spec, which is also called for
• 16:10
  the by Brian Campbell, which has his hands everywhere.
• 16:15
  And yeah, actually my spec, our spec was dependent on the POP
• 16:23
  because we had the reference in our.
• 16:26
  References section to depot and we couldn't go RFC until they
• 16:32
  would get an RFC number. And so it was a week in which I
• 16:36
  was refreshing every day. I paid you to see if they
• 16:40
  actually, that sounds to me like the equivalent of like Google
• 16:43
  searching like your own name and looking for, you know what's the
• 16:46
  news about me today is you're looking for like, did this thing
• 16:48
  get passed or not? Believe it or not, years ago I
• 16:53
  used it to do it. Now it's pointless because there
• 16:57
  is so much auto generated spam content that if you do want, but
• 17:04
  I occasionally do it on Slack because there will be
• 17:07
  discussions in which people mention me but they don't act
• 17:10
  mention me. And it's so easy because once
• 17:14
  you land in there and you say, ha ha, and people sometimes
• 17:17
  don't realize we were on a public channel.
• 17:19
  And so I like, I like the acknowledgements that you made
• 17:23
  at the end of the RFC spec, thanking the Academy, the
• 17:26
  viewers at home and the shampoo manufacturers.
• 17:28
  I thought that was really funny. That was actually Brian's idea.
• 17:33
  And was it OK? Brian this week wrote a blog
• 17:37
  post about the spec and about myself and my state of health,
• 17:42
  and he wrote it on the official Ping blog, which is about that.
• 17:48
  Absolutely, really good. Absolutely remarkable.
• 17:53
  Do you want to give an update on what's been going on with your
• 17:56
  health? Sure.
• 17:58
  Well, they this, the basic story is pretty simple.
• 18:02
  At the end of June, I discovered that I have pancreatic cancer,
• 18:07
  which is one of the worst kinds. We've spread to the liver and
• 18:11
  the lungs and I started treatment.
• 18:15
  I cut my hair myself and there is a video of Instagram that
• 18:19
  shows. That I do it.
• 18:21
  It's a time lapse is it will be funny if it was not be tragic
• 18:26
  but but at the beginning of August the cancer caused a very
• 18:33
  severe bleeding like I almost bleed out and I was one week
• 18:41
  intubated and my organs shut down.
• 18:46
  But somehow the doctors. I am with the Virginia Mason in
• 18:50
  Seattle. They are incredible.
• 18:53
  The doctor somehow saved me, but this thing left me with 20
• 18:58
  pounds thinner, like my muscle is gone.
• 19:03
  My kidneys started working very recently and so right now I am
• 19:09
  recovering from that event and until until I'm strong enough to
• 19:15
  to restart chemo. But unfortunately the meanwhile
• 19:20
  what's happening is that the cancer is gone, is still ongoing
• 19:24
  because it's completely unchecked.
• 19:26
  So when people ask me how are you?
• 19:29
  Or they see that I moved it from the hospital to the house, they
• 19:32
  think like it's improvement. And it's true, like I feel a
• 19:35
  little better every day, but I'm still.
• 19:39
  It's like if you break your your arm on the Titanic and then
• 19:43
  every day your arm feels better, but the Titanic is still going.
• 19:48
  To water the iceberg. So I am in this kind of tricky
• 19:52
  situation, which as you can imagine is not fantastic.
• 19:57
  But at the same time, I have to admit that I had an incredible
• 20:03
  life. Like I started as a 10th of 10
• 20:08
  kids of a janitor, so as you can imagine, sleeping in six people
• 20:15
  in the same room. I started working at age 15 for
• 20:21
  covering my studies and like I did all sorts of jobs and I
• 20:27
  would have never, ever dreamed of achieving the level of
• 20:31
  success that I got. Absolutely never.
• 20:36
  I am incredibly grateful when I when I made some messages on
• 20:41
  social about my condition, I received literally thousands of
• 20:47
  messages. Thousands.
• 20:49
  And a lot of them were from people I know, all mentors, I
• 20:55
  had colleagues and also my company.
• 20:59
  Octa is being incredible in this.
• 21:02
  I'm being supported in ways that I'm in all everyday.
• 21:07
  But the thing that hit me was that so many of those messages
• 21:13
  were of strangers that told me how I influenced their career,
• 21:20
  that some of their life choices. And they went very specific
• 21:25
  saying I was at that conference in that session and he said his
• 21:30
  finger. And I decided that this was
• 21:34
  going to be my career and now a director in post X.
• 21:38
  So it's an incredible blessing to have done this and although
• 21:44
  it's very hard to accept once mortality, the reality is that
• 21:50
  we can work out at anytime and be hit by a bus.
• 21:53
  The only difference between the ME and normal people is that now
• 21:57
  I'm forced to think about my mortality every day.
• 22:01
  But in practice there is not like nothing much difference.
• 22:05
  It's easy to say it's harder to internalize, but I'm trying very
• 22:09
  hard. I'm doing Visa Up from Sam
• 22:12
  Harris, one of my favorite philosophers called the Waking
• 22:17
  Up. It's a meditation up and it's so
• 22:20
  much better than everything else I've tried.
• 22:23
  So if people are interested in mindfulness, highly recommend
• 22:27
  it. Victoria, I know you touched so
• 22:29
  many people. I want to bring up 1.
• 22:32
  So I was talking with Steven Strong, who I know you worked
• 22:36
  with at All Zero and later Octa, and he was like the story was
• 22:42
  very supposed like the first time he met you.
• 22:44
  He sat down I guess in the cubicle across from you and he's
• 22:47
  like, who's this guy? I thought it was just such a a
• 22:53
  cool and kind of cute story because you guys became very
• 22:57
  good friends and you know Steve and I know is a listener of the
• 23:01
  show and I I I'm sure he'll enjoy that that I brought.
• 23:05
  That up, I remember seeing you at so many conferences and I
• 23:09
  would attend all of your. Talk your your talks, right.
• 23:13
  Your presentations because you had such a different way of
• 23:16
  approaching it. It was funny and it was
• 23:17
  entertaining. And I think we've modeled a
• 23:20
  little bit of this that, you know this this sort of podcast
• 23:22
  sort of off of that thing. Like yeah, you know it's
• 23:24
  identity actions, management. We can have fun still or at
• 23:27
  least try to make it entertaining.
• 23:29
  And yeah, I think I finally, you know, worked up the courage at
• 23:33
  some point to kind of introduce myself and, you know, your
• 23:36
  support for what we've been doing here and just the industry
• 23:38
  at large has been, I mean just. Outstanding.
• 23:41
  So I don't think I can add more to that other than just you know
• 23:47
  it's, it's how much you've meant to the industry.
• 23:50
  I think it's been great that you've been getting the
• 23:52
  outpouring of support that you have from folks all over the
• 23:54
  world and people who took the time to actually write things
• 23:57
  and reach out and stuff like that.
• 23:58
  It's, you know, it's a difficult situation sometimes, but being
• 24:03
  aware of it, I think is always validating too as well, right?
• 24:06
  Absolutely. And you guys are doing an
• 24:09
  incredible job. I'd save it.
• 24:11
  Now if you were to stop doing what you're doing, there would
• 24:15
  be a hole and you'd see people like running around like the
• 24:21
  headed chickens because like you really are of a spoke of the
• 24:25
  identity wheel and your podcast is so important and you guys are
• 24:30
  doing such a good job with it. I know that people absolutely
• 24:33
  love it and I love it. Well, we appreciate.
• 24:37
  That thank you. Yeah.
• 24:38
  Thank you so much. You want to wrap up on a lighter
• 24:41
  note. I know that you and I, but way
• 24:44
  more you than me. Let's just be very clear here
• 24:47
  are into the VR and the AR spaces and things like that.
• 24:52
  Apple Vision Pro is coming out at some point here in the near
• 24:56
  future. What is going to be the first
• 24:58
  thing that you do with it? Because I know you're getting it
• 25:02
  right, Yes, absolutely. I don't think that the API would
• 25:07
  allow it, but the first thing I'd like to do it is instead of
• 25:12
  the eyes that under the original screen, how do you do the googly
• 25:15
  eyes so that when you move around the googly eyes.
• 25:20
  But apart from that, I think that that thing has an enormous
• 25:25
  potential for a R For me like a VR is a fun about celipsy stick
• 25:32
  and AR is truly where you can augment.
• 25:37
  Then like I think that the ones we love viable hardware like
• 25:43
  that finger is great in terms of output.
• 25:46
  I believe that it can give a right experience, but you can't
• 25:50
  go on there on the bus, on the bus with it.
• 25:54
  Whereas instead I think that the augmented reality is going to be
• 25:59
  as much of A cognitive revolution as writing has been.
• 26:05
  Because I just think you can add a layer of meaning to absolutely
• 26:12
  everything apart from the like. Forget the privacy stuff, which
• 26:17
  of course is going to be such a huge huge problem.
• 26:20
  But imagine everything like how you approach a machine and on
• 26:26
  top of it there are the instructions and how to operate
• 26:28
  it. Or in a simple guidance for
• 26:32
  going around or attaching notes like or like a.
• 26:38
  Think of truly augmented cognition like this system sees
• 26:46
  everything you have seen and save it somewhere.
• 26:49
  And then when I see it again at the border of your vision, they
• 26:52
  are like these all the distances that you can go and refer to.
• 26:56
  Like I'm convinced that the generation that will have access
• 27:01
  to viable hardware plus the A I can now can help query with
• 27:08
  enormous amount of information that you load.
• 27:11
  They will be different like they grow up just like the brain of
• 27:18
  people changed. You know there was no grammar
• 27:21
  like people winged it when we were talking before writing
• 27:25
  instead after writing. Not just the grammar, but a lot
• 27:29
  of interesting changes happened in recognition.
• 27:33
  If you read the shallows from don't remember the name of the
• 27:38
  guy that speaks about cognitive revolutions, I'm convinced that
• 27:42
  that one will be big and our generation might not even
• 27:45
  approve. Like imagine someone that once
• 27:48
  they take off their glasses they are only a fraction of
• 27:52
  themselves. But on the other hand, it's kind
• 27:56
  of like when people started saying, oh, but if you Google
• 27:59
  everything, you don't learn anything.
• 28:01
  Well, but it's so convenient and as it turns out, we the
• 28:06
  generation of people that only Googles it doesn't study in
• 28:09
  depth, they seem to be doing OK. So anyway, yes, I'm very excited
• 28:15
  what they are. Yeah, I am too.
• 28:20
  My problem with it isn't the technology itself, other than
• 28:24
  the way it looks. I just feel awkward being on the
• 28:29
  bleeding edge of things sometimes.
• 28:31
  So I remember when I first got my air pods.
• 28:33
  I had them before like anybody else did.
• 28:35
  I got locked out. And you know, they were very
• 28:38
  high in demands. And, you know, I'm a Apple
• 28:40
  fanboy and I've never putting them on O'Hare airport.
• 28:44
  And people were staring at me like, oh, he's got the apple air
• 28:47
  pots, you know, It was like whispers and hushed tones and
• 28:52
  like reverence. And it made me very
• 28:54
  uncomfortable and selfconscious. And I'm thinking about strapping
• 28:58
  these. I mean, they're big, this ski
• 29:01
  mask goggle, right? You know what it looks like, and
• 29:06
  I just don't know. Using in public terrifies me
• 29:10
  right now because of the looks I'm not going to get.
• 29:14
  I don't think that you'll see a lot of stuff in public.
• 29:17
  You might see it in some workplaces for people that want
• 29:20
  to be bleeding as what why they're so big and they are such
• 29:24
  short autonomy. Also think that the apps at
• 29:27
  first will not be geared to outdoor use.
• 29:31
  Will mostly be things like place this new piece of furniture in
• 29:37
  your in your room so that you know exactly what it will look
• 29:41
  like once you buy it. Stuff like that, probably.
• 29:46
  Well, they're definitely playing up to like, the media
• 29:48
  consumption angle, right? Being able to like watch Netflix
• 29:51
  on this certain size screen, and I travel a lot by plane, I think
• 29:56
  that would be pretty cool and nice.
• 29:57
  And I think it's like I'm gonna look like a real dork.
• 30:00
  You know, wearing, wearing these things and I think at some
• 30:03
  point. Yeah, I actually years ago
• 30:08
  brought by Oculus and used it on the plane and yeah, they wear
• 30:15
  the stairs and similar. The interesting thing is what
• 30:18
  was my first Oculus but that they pass through so that you
• 30:22
  could see the surroundings. And I remember a flight
• 30:24
  attendant that came to me and looked at me completely
• 30:27
  convinced that I couldn't see her.
• 30:30
  And I turn to her and saying can I help you?
• 30:33
  And she was. And I wrote a blog post about
• 30:38
  the experience and then I can tell you how.
• 30:42
  But I've been shown that in the triage list of the of the Oculus
• 30:49
  they were references to parts of my blog.
• 30:53
  And so I think I can claim that some of the features that we
• 30:57
  have now came from my blog complaining about it on the
• 31:01
  play. That's that's a good claim to
• 31:04
  fame. I I'm excited about it.
• 31:05
  I think it'll be I'm torn whether or not I'll be in the
• 31:09
  first Gen. or not. I know it's going to be you know
• 31:11
  extremely expensive for a first Gen. product.
• 31:13
  I think the rumor of I've heard is summer routine like 3000 and
• 31:16
  $4000 to start, which leads me to believe it's going to be
• 31:20
  probably more expensive. You know, past that for whatever
• 31:23
  addons and stuff like that, but it seems like such a cool thing
• 31:28
  and. You know, I'm sitting here in a
• 31:30
  hotel room, we're recording this.
• 31:32
  I can absolutely see a point where instead of me looking at
• 31:35
  my laptop screen is we're doing this over a R through and my
• 31:40
  screen is my AR glasses or whatever.
• 31:43
  You know, I'm having to be using that becomes the monitor for
• 31:46
  your computing life, right? Maybe it runs off of a pack like
• 31:49
  your iPhone or you know in the Samsung world they have like
• 31:52
  decks, which is kind of like a quasi desktop type environment
• 31:56
  thing. And it's super cool and super
• 31:58
  exciting for me and I can't wait.
• 32:01
  But at the same time, I know it's going to be interesting
• 32:03
  watching the social sort of acceptance of, oh, there goes
• 32:08
  that weirdo with the glasses again versus there goes that
• 32:12
  weirdo not wearing the glasses again, you know.
• 32:16
  Yeah, remember the glass holes? Yep, Yep.
• 32:20
  Yeah. Google Glasses and they're
• 32:23
  they're short commercial lifespan, I think they've taken
• 32:26
  on. Some some use cases in the
• 32:29
  enterprise and kind of thing. Yeah, they tried, but I think I
• 32:32
  heard recently that they are winding that part down as well.
• 32:38
  Pity like a Google add really interesting stuff for for VR.
• 32:44
  Like a Tilt Brush is a fantastic drawing, but he's investing most
• 32:51
  of that stuff. When I got my HTC Vive, which is
• 32:55
  sort of which would have been the Oculus competitor at the
• 32:57
  time, Tilt Brush was the thing that I would show off to people
• 33:01
  as like, this is what this is about, like Imagine, right?
• 33:05
  It was very much a tech demo, but there were some really
• 33:07
  talented artists doing some crazy stuff within it.
• 33:10
  And for people aren't familiar, Tilt Brush is kind of like this
• 33:12
  three if you took like Windows Paint or Microsoft Paint and
• 33:16
  turned it into a 3D scenario where you have like a brush and
• 33:21
  you can choose different styles and colors.
• 33:23
  But you paint in 3D inside of a cube, and there were some
• 33:27
  amazing things that you could do, You know, with that sort of
• 33:30
  concept. There's almost like 3D modeling,
• 33:32
  but by hand. Oh yeah, And now there are so
• 33:36
  many apps, including modelers, that are absolutely incredible.
• 33:41
  I wish I'd have more time. And now that I have short hair,
• 33:44
  I can actually use this thing better.
• 33:47
  Before with all the fluff it was always if I use it then my
• 33:53
  volume. I wasn't at the bright side,
• 33:57
  Jim. I know you're you're you're not
• 33:59
  super into the ARVR stuff, but what are your thoughts?
• 34:02
  Conceptually, I love it. I mean, I think it.
• 34:05
  I think as humans we're already able to have so many more
• 34:10
  experiences than people in the past that have, especially in
• 34:13
  terms of travel. You want to go to the beach, get
• 34:18
  on an airplane, go to the beach. You want to go to the mountains?
• 34:21
  You want to go to other countries.
• 34:23
  You can do all those things. I think with it VR you could
• 34:27
  potentially go anywhere. So you know, I think that's a
• 34:32
  really exciting thing. I think also using it for
• 34:35
  exactly the the thing you brought up in terms of having
• 34:39
  meetings and things like that, I think all that's exciting.
• 34:41
  So yeah, I love the concept. All right.
• 34:44
  Well, why don't we go ahead and leave it there for this week.
• 34:47
  Pretorio, as always, thank you so much for joining us.
• 34:50
  I'll have a. Bunch of links on our show notes
• 34:52
  based on this conversation. So congratulations again on the
• 34:55
  RFC 9470. I'll put a link to that.
• 34:58
  I'll put a link to Brian's Ping blog posts sort of about the
• 35:03
  about what's been going on and then anything else that we
• 35:06
  mentioned, I'll dig up and and put links for that as well.
• 35:09
  So thank you so much for taking the time with us.
• 35:11
  Any final thoughts as we wrap things up for this week?
• 35:13
  Thank you so much for having me. Sorry for my short winded voice,
• 35:19
  but as always is great to chat with you guys.
• 35:23
  Thank you. We love you, Victorio.
• 35:25
  Thank you for coming on the show again.
• 35:27
  We're gonna go. Out and leave it there.
• 35:28
  So thanks, Victorio. Thanks, Jim.
• 35:30
  And yeah, I'm gonna do just a normal outro just be like that's
• 35:33
  it. So we'll talk with everyone in
• 35:35
  the next one. Thank you guys.
• 35:39
  You've been listening to Identity at the Center.
• 35:43
  We hope you've enjoyed the show. Make sure to like, rate and
• 35:47
  review and we'll be back soon. But in the meantime, hit the
• 35:50
  website at identity@thecenter.com and find
• 35:54
  us on Twitter at IDAC Podcast. See you next time on identity at
• 36:02
  the center.