Latest / Identity at the Center / #287 - Identiverse 2024: Andrew Shikiar from the FIDO Alliance

Transcript

#287 - Identiverse 2024: Andrew Shikiar from the FIDO Alliance · Identity at the Center

0:00
One of the myths that you put in the, I think in yesterday's talk
0:02
was that regulators from the bank, you know, banking side
0:05
don't, you know, don't go with Vito or don't like.
0:08
But yeah, Vito, I'm interested in, you know, interested in that
0:11
conversation because that is definitely the conversation that
0:14
I have to have. Next is how do I convince, you
0:18
know, FDIC who is traditionally running all the 2016 guidelines?
0:24
How do you, you know, how do you get into, you know, how do you
0:27
make that? How do you make that volume?
0:29
Yes. So there's there's a couple of
0:31
things here. There's there's regulators and
0:32
compliance officers Ohio. This is identity at the center.
0:43
If it has anything to do with IAM, this is the go to podcast
0:49
now your hosts Jim McDonald and Jeff Stedman.
1:00
Welcome to the Identity at the Center podcast.
1:01
I'm Jeff, and that's Jim. Hey, Jim.
1:03
Hey, Jeff, how are you? Oh, not so bad yourself.
1:05
Doing fantastic. I mean, you know, we're here at
1:08
our dinner. Verse 2020. 4.
1:10
Great sessions, great podcasting environment, great guests.
1:14
Great podcasts. And great lunch.
1:17
Oh yeah, I didn't ate lunch. Yeah, you missed out.
1:20
And OK, well, sorry, I had a kind bar for lunch.
1:24
That's about what I had time for as well as our guest Andrew
1:28
Shakur had a kind bar as well. So we're sharing the kindness.
1:31
Want to give a shout to RSM and Cyber Risk clients for hooking
1:34
us up, being able to do this, So shout out to them.
1:37
Let's get to it. Andrew, this is your 7th time on
1:39
the show. You're the executive director of
1:41
the Fight Alliance. Welcome.
1:43
Thank you so much. It's great to be back.
1:45
Yeah. This is becoming like an annual
1:46
occurrence where we talk with you at Universe and then we talk
1:49
with you later in the year again around authenticate.
1:51
Time, yeah, that's fantastic. And I think those two shows for
1:54
Acid Fight Alliance are kind of served as to kind of milestones
1:58
or mileposts people throughout the years fall and and and
2:02
spring. So we've generated a lot of our
2:05
deliverables around these two events and it's, you know, it's
2:07
a good time to engage with the broader identity.
2:10
So this is your 7th time on the show.
2:12
Why is this something that you keep coming back to?
2:15
Why do you keep subjecting yourself to the torture?
2:17
Because the hosts are so amazing.
2:20
Go on I. Don't know where we get first.
2:27
I do really enjoy talking to the two of you.
2:30
It's a fun, fun format and we can be loose and then talk about
2:33
all things identity. I think the community you've
2:36
built up has been fantastic. It's been fun to watch the
2:38
podcast grow. This is a great way to kind of
2:40
let people know what's new in the land of file.
2:43
Yeah, it keeps growing. We've got a live studio
2:45
audience. They're off camera, but they
2:47
might have questions that are going.
2:48
They're also guarding the door to make sure that noisy things
2:51
try to stay outside. But yes, thank you also to our
2:54
guests for being here. But yeah, it continues to grow.
2:57
It's crazy. And you're one of our early
2:59
supporters going through. So that also is part of the
3:02
process, right, of going through those seven episodes like that's
3:04
been spaced out over. When you come in early, you can
3:06
kind of add your Yeah, exactly. It's fantastic secret strategy.
3:13
So, Andrew, I mean Fire Alliance is obviously growing.
3:16
I mean your team's growing for I hear the memberships are
3:20
growing. Give us a little bit of an idea,
3:22
the kind of growth you've experienced at Final Alliance.
3:25
Yeah. I mean, so the alliance is
3:26
growing. You know, our objective growth
3:29
is not an objective for alliance in of itself.
3:31
It's really a byproduct of what's happening in the
3:33
marketplace. Our goals alliance is to reduce
3:38
identity related fraud in the market, right.
3:41
And most of that comes from passwords, which is why they've
3:43
been so focused on, you know, reducing reliance on passwords
3:46
in favor of passkeys. And our approach to this, we've
3:50
been working on this for over 10 years now and it has to be a
3:53
very mature, robust technology that's been implemented,
3:55
implemented at scale. And as we introduced the concept
3:59
of pass keys two years ago, you know, things have really just
4:03
taken off from there. And So what we're seeing is that
4:06
people are adopting needs and technology at scale.
4:09
And our membership has grown largely because people want to,
4:12
you know, be involved or as they want to be involved in
4:15
understanding how are the tech, you know, how are the
4:18
specifications evolving. They want to be involved in some
4:21
of our deployment working groups to, you know, understand and
4:24
establish best practices on how to implement Fido in different
4:27
settings. They want to lead into our, you
4:30
know, user experience stuff. And that's a big growth area for
4:33
us is US, as we are not just, you know, releasing a real kind
4:38
of watershed US guidelines for the industry to use to make sure
4:44
that you implement Fido correctly and pass you
4:46
correctly. But also inside that group, we
4:48
have product leads and design leads who are again, sharing,
4:52
you know, learning from each other and what's the best way to
4:54
to, you know, use this relatively new technology of
4:57
sync passkeys. So for all those reasons, you
5:00
know, we are growing as a membership, but also our remit
5:04
is growing, all right. So yes, we're focused on user
5:08
authentication, but we're also looking at the adjacent areas
5:10
which matter a lot as well. All right.
5:12
So one of those is in connected devices.
5:16
So we have a specification called Fido Device Onboard which
5:20
is all about onboarding devices and taking the password out of
5:22
play there as well for connected devices such that as soon as
5:25
they come online to a network they automatically dial.
5:28
Home, if you will. And are immediately onboard,
5:30
which is more secure and more efficient than individually, you
5:34
know configuring each device on a say spark meters or for
5:38
onboard or things like that. And then our certification
5:41
program continues to grow as well.
5:43
You know, certification to me has always been the thing that
5:45
makes standards actionable, right?
5:48
So our Fido certified program initially only focused on user
5:52
authentication products, but it makes sure that if you are, you
5:55
know, licensing party that you know, these things work
5:57
together. So you have 5O2 server, it'll
5:59
work with any Fido certified authenticator because they we
6:02
don't just test conformance with spec, but also that these
6:05
products work together. So we do interrupt testing for
6:07
this. But even that program has grown
6:09
from the remit of just user authentication certification to
6:12
we have a stand alone biometric performance certification
6:15
program and we have new work, new work, newer work and
6:19
identity verification including an announcement we have here
6:23
identivers announcing our face verification certification
6:29
program that we launched just our event.
6:31
So you're. Verifying people's faces.
6:34
We're verifying the performance of the of the products that are
6:38
verified people's faces. So again, if you're licensing
6:41
software from someone, a lot of this ID work, whether you're
6:47
doing document authenticity or face verification has been kind
6:50
of black box. And the vendor says, I'll do
6:53
this really well and here's my performance numbers.
6:55
But there's not been a way to independently verify that,
6:57
certify that. And so now with our
6:59
certification program for the IDD face work, for example, you
7:03
know that the vendor who's done this has met certain thresholds
7:06
for, you know, for biometric performance.
7:10
So meaning like false exempt rate, false reject rate, attack
7:13
detection, but also the other equal we have in there is bias
7:18
as we can't talk about biometric authentication without talking
7:22
about the bias challenge as we're testing for bias, you need
7:27
to see a certain threshold to demonstrate that that your
7:31
product is not lending to bias in order in order to be
7:34
certified. So we think this is a really,
7:36
really important program and that as companies who are
7:39
involved in, you know, doing more rigorous ID proofing of
7:44
employees or maybe even of consumers, they will want to,
7:48
you know, look for companies that have passed this market.
7:53
I think the certification program is in my mind a lot of
7:58
what's needed because Fido like zero trust, like AI is becoming
8:03
an adjective. You walk around the vendor hall
8:05
you're talking about, it's just dropping a sentence.
8:09
We're we're Fido compliant. And how would you actually know
8:15
if somebody's Fido compliant, right?
8:16
They have a sample approval from the Fido alliance.
8:19
Makes total sense. Otherwise it could just be M or
8:22
zero trust compliant. Just believe me, yeah.
8:28
And so that's why the certified program's so important and the V
8:31
launch, we've had a certified program in 2016.
8:34
So we have over 1000, you know, user authentication products
8:36
certified. And I love that number.
8:39
What I love more than that is seeing you have fiber certified
8:42
being a staple part of more and more RFPs coming out.
8:45
And so for in, in different deployment scenarios for
8:48
workforce, for government, for consumers, you know, so our
8:52
vendors are getting these RFPs, they must be fiber certified,
8:55
which is great so that, that, that beginning builds trust in
8:57
the ecosystem and builds opportunity in the ecosystem.
9:00
And we have vendors who, you know, have all sorts of
9:03
innovations now they compete with each other, but all of them
9:05
have a slightly different lean on things and bring different
9:08
value to the table. And this allows them to have the
9:10
common thread of being vital certified, which allows them all
9:13
to, you know, potentially be used by by different licensing
9:17
parties. I think that's, look, I wasn't
9:19
saying, certainly wasn't trying to criticize people from wanting
9:24
to be fighter compliant. It's just what I wanted to know
9:26
was is there any teeth to that? Does it actually have a meaning?
9:30
I say it has to mean something. It has to mean.
9:32
Something so to be fighter certified for user
9:36
authentication products, you can form the specifications and then
9:39
the most standards have a self conformance test or you say, I
9:41
conform to this, the spec and that's great.
9:43
But we do that. So it can be yourself
9:46
conformance test. We, we, we build test tools you
9:48
use to show that your product adheres to the spec.
9:52
But on top of that, you're also going through interop tests so
9:55
that there's a live test where you must test against other
10:00
products in the value chain to show that these things work
10:03
together. And ultimately, if I am a
10:05
purchasing company, that's what I part of what I want.
10:08
I want to make sure that I'm not being locked into a vendor, but
10:11
I am being future proofed. And so when I buy a fighter,
10:13
when I license and fight a certified product, I know that
10:16
these things are true. So there there is TV on it.
10:20
Yeah, I'm sorry. How many?
10:23
How many products? Is it by product or by vendor
10:27
that are certified? Over 1000 products from hundreds
10:31
of vendors. I don't know the exact number of
10:32
vendors. Wow.
10:34
That's fantastic. So each product goes.
10:36
Through this verification cycle. Process Ubico, for example, has
10:41
probably, you know, 25 or maybe more out of certified security.
10:46
How do you validate I guess remaining in compliance?
10:50
Is it something where I mean we're in a software defined
10:53
world now, right, Where version upgrade comes out?
10:55
I can certainly understand the hardware certification, but
10:59
software certification, is that something out there too and how
11:02
do you address that? People need to recertify every
11:04
time there's a recertification process for software products.
11:06
OK. And so for like that's going to
11:08
come more to the fore for this identity verification work that
11:12
we're doing. You know there will be
11:13
recertification every couple years to make sure that every
11:16
sell the plans. So this was announced yesterday
11:20
and you spoke about this here at Identiverse.
11:23
What other exciting things are happening at Identiverse that
11:25
kind of pique your mind as guy named Fido?
11:28
I mean, with my Fido lens on, which is really my, I was
11:33
thrilled to see how much people are talking about pass keys.
11:36
I counted 16 sessions and have pass key in the title and dozens
11:40
more. Sure, they have pass keys in the
11:41
content and it's fantastic. But you know, we collectively as
11:45
an alliance and all of our members of talking about
11:47
thousands of people worldwide have been on this journey and
11:50
the community is, you know, our Fido community.
11:54
It truly is a remarkable bunch of people.
11:57
It's remarkably supportive, collaborative, and it's good to
12:01
see all the efforts that everyone's put into this being
12:04
rewarded by the realization that the the broader identity
12:08
community has sees what we've built as so integral to what
12:12
they're looking to be plugged. So I've been thrilled by that,
12:15
especially, you know, the passkey piece.
12:18
Two years ago we introduced passkeys right before Universe.
12:21
We came here. It was it was the firestorm and
12:25
a lot of a lot of concerns. And that because the final
12:27
security model for the first time was changing slightly,
12:30
rather being augmented slightly to allow the private key to
12:34
leave a device and to be synchronized across the cloud.
12:38
And that, you know, that raised consternation and concern for
12:42
some people on some skepticism as whether or not that would
12:45
ever take root. And so it's been great to see
12:48
again, the community kind of keep their heads down and focus
12:51
on, you know, making sure that our past ecosystem is open,
12:55
inclusive, and then working just to focus on the benefits of, of
13:00
how this can be used. And then you're seeing these
13:02
massive rollouts that keep on coming.
13:04
Every week there's someone new rolling out Pass Keys.
13:07
So today is on stage with Amazon.
13:10
So Mike Slaw joined me on stage and talked about how they have
13:13
10s of millions of Amazon customers enrolled in Pass Keys,
13:17
10s of millions, right? And then one of their success
13:21
metrics is over a 15% increase in sign and success rate.
13:25
Amazon runs like a 1% margin, I think.
13:27
And so if you're increasing the size of success rate by 1%, I
13:31
think that's going to move the needle.
13:32
On their bottom line. 15% it has to be making meaningful impact
13:37
to to their margins and into their bottom.
13:40
Line, which is great. And that success rate really is
13:42
talking about people who can't get logged in.
13:44
They need support or they need faster, faster way to get in,
13:47
right? Exactly.
13:48
And and let's so it's not to say that the 15% like the people
13:52
who. Yeah.
13:54
You're not getting that. So say the number of signs, say
13:58
the signs resuscitating hypothetically, this is not
14:00
their number. Say with passwords, it's 75% and
14:03
then with pass fees is 90%. Yeah, the, the 25% of people
14:07
with passwords not getting in before, a lot of them would go
14:10
through a reset and get, you know, get signed in, but some of
14:13
them probably wouldn't and they'd leave.
14:15
Yeah. So that's, that's a very
14:16
meaningful number. But we're seeing that number
14:18
time and time again for people who are sharing data on how
14:21
passwords are working and like 2 metrics, two most common
14:24
metrics. One is success rate and time
14:26
decided. And oftentimes when compared to
14:29
legacy 2FA, like SMSOTP. And in both instances, you know,
14:33
both members are improving. And so I mentioned that there's
14:36
always someone new, you know, coming in, rolling out like was
14:40
thrilled to see Amazon, that's thrilled to see PlayStation and
14:43
Microsoft. And I was staying in the
14:46
hallway. Someone from a major online
14:49
service just came up to me and said, hey, I loved your talk.
14:51
And in a couple of weeks we're going to be rolling this out to
14:54
20 million consumers. So, you know, so it's the proofs
14:57
in the pudding again, the work and the focus that everyone in
15:01
the alliance has put into, into, you know, building the core
15:04
foundations of bio authentication, developing the
15:07
use cases and the best practices for how to do this.
15:10
You know, the US work we're doing which really paints a
15:12
picture on how to drive and optimize enrollment flow for
15:16
pass keys and management flow for pass keys.
15:19
All those things are leading to the success that we're seeing in
15:21
market. So, you know, the coolest thing
15:23
I've seen is all that, which is the fruits of the labor that
15:28
everyone's put into the work that bio law system.
15:30
Yeah, you actually just told my my, my next question, which was
15:34
going to be I've seen Kevin Goldman around the the
15:38
conference this year. To me, it's like it's a user
15:41
experience isn't good. Then the whole thing kind of
15:46
sits on a weak foundation, but the user experience, like you
15:51
guys have put so much effort and investment into that.
15:56
You know, camera transformational and the work
15:58
that Creep has done has been transformational and it's really
16:02
cool to see. So that they had a master, they
16:04
did not have a master class. Take it back.
16:05
They had a 30 minute session to introduce the guidelines.
16:08
It should have been a master class.
16:09
I'm not complaining, but it should have been because it was
16:11
overflowing and they had 25 minutes to talk about
16:14
guidelines. There's a lot of documentation.
16:17
There's a lot of documentation out.
16:19
There it is. So G Yeah.
16:20
So I'd encourage people to go to oursitefidolines.org/UX
16:24
guidelines. I'll get the link and I'll put
16:25
it in our show. Or just search by the US
16:27
guidelines. We have pretty good search
16:28
stuff, but the depth of content there is amazing.
16:32
And this is and, and, and what's really cool about that group is
16:37
that for, you know, those standards geeks, for those, you
16:38
know, this, you understand how standards work.
16:40
You get standards work, you get a bunch of really bright people
16:43
in room to, you know, you're experts in their field to talk
16:47
about protocol and argue about like where semi colons fit and
16:53
that, you know, shall versus musts.
16:56
We have the same practice here with UX, but instead of, you
17:00
know, engineers, we have designers and messaging experts
17:04
and US leads and human interface leads.
17:07
And they've all collaborated remarkably to scope through
17:11
research that has led to our guidelines and to refine the
17:13
guidelines and actually develop a UI kit, which is freely
17:17
available too. So the resources that this brain
17:20
trust is put into the UX work that we have, the design work
17:24
that we have is phenomenal. And it's all it's it's an
17:27
incredible resource for people to use.
17:29
One thing I find gratifying, I know that the US group finds
17:32
gratifying is when I talked to someone who's deployed and said,
17:35
yeah, of course I use your guidelines and it's super
17:38
helpful. So yeah, but we feel really good
17:41
about that work too. And it's free, it's on the web.
17:43
It's not like it's gated behind anything, right?
17:45
I think people can get to. All free, yeah.
17:46
That's all free like, there's no reason not to use it.
17:48
There's. No business interest and so we
17:50
will be expanding. That's one of our key themes as
17:53
an alliance is enablement. You know, what can we need, what
17:56
can we need to enable people. So whether it's, you know,
17:59
usability pieces or other assets that we will be developing and,
18:04
and rolling out over the next couple months, it's all about
18:07
helping people get to yes and gets deployed.
18:11
But coming back to your key point, Jimmy, usability is key.
18:15
And I've said it's for years. Something for MFA is unusable.
18:19
What old can you use? So your consumers won't opt in
18:22
and employees will work around it.
18:25
But what we heard today in the session that I did is that both
18:28
sides of the equation are super important, right?
18:30
Our tagline is simpler, stronger authentication.
18:33
So yes, it needs to be simple, but needs to be strong too.
18:36
So Bank of America talked about why they came to fight us purely
18:41
from a security standpoint. Now they want to stop the threat
18:44
of social engineering that imposed hundreds of thousands of
18:48
employees around the world, which they've done by rolling
18:50
out Fight Out. You know, throughout the
18:52
organization, 97% of their employees are not using
18:56
passwords. They're using different forms of
18:58
fight authentication. That's fantastic.
19:00
Which? Means that security threat has
19:01
been thwarted. Yeah, this might seem like a
19:04
down in the weeds question. But I.
19:08
I think one of the things when we had MFA but not Fido yet or
19:14
you know, not in the form that it's in now.
19:16
So we could say MFA on you must use MFA.
19:20
Can you do the same thing with passkeys?
19:22
Can you make it? Because every time I kind of go
19:25
through through the flow with, you know, more and more seen
19:29
passkeys more and more, it's always, do you want to use this
19:33
set of passwords? I kind of think that's because
19:36
some people don't want to change period.
19:38
They'd rather take the risk of passwords.
19:41
But if I want to make passkeys required, is that?
19:44
Is that too down in the weeds of a question?
19:47
No, I'll try that says tell me if I get off track of my answer,
19:49
that'll be an answer to your question if that's the two in
19:51
the weeds. No, I think that couple things
19:56
there. You know, one thing you'll hear
19:58
is say a lot is that we need to reframe the way to think about
20:01
authentication. And the only favorite reference
20:04
anyone's ever had on authentication is how to make
20:06
passwords suck less, right? Passwords are horrible.
20:09
Everyone knows. Everyone knows are horrible.
20:10
So we add on layers, we do MFA and that's when the answer is to
20:14
add on layers. And all our regulations, you
20:16
know, most regulations to date have been about how to do MFA
20:21
and they never contemplated a true password replacement.
20:25
And passwords are that right. So we have a question on.
20:32
Yeah, come on up to the microphone.
20:34
So I guess I do that that's you're heading down that path
20:36
with. Bank of America to talk to you
20:38
this morning and then I think it was your your talk yesterday.
20:41
Yeah. The the one of the myths that
20:46
you put at noon, I think in yesterday's talk was that
20:49
regulators from the bank's, you know, banking side, don't, you
20:51
know, don't dope by it or don't like.
20:53
But if I, I'm interested in, you know, interested in that
20:57
conversation because that is definitely the conversation that
20:59
I have to have next is is. How do?
21:02
I convince you know FDIC who is traditionally running off of
21:07
2016 guidelines. How do you you know, how do you
21:11
get it? You know, how do you make that?
21:13
How do you make that by? Yes.
21:15
So there's there's a couple of things here.
21:17
There's there's regulators and compliance officers O by.
21:21
So I mentioned regulations. So when interest pass fees two
21:28
years ago, there's a lot of pushback like, well, this is
21:30
different, this is scary. This is like you aren't going to
21:32
buy it. Regulators are going to hate it.
21:34
There's no regulations. My point of talking about the
21:36
frame of reference is that any regulations on the books today
21:41
were developed thinking about how to make prevent the damage
21:44
of passwords, but now there's pass keys as a password
21:48
alternative. And so this supplemental
21:50
guidance 863 BI think was a good step in that direction, which
21:56
recognized basically said that if you implemented sync
21:58
credentials or sync passkeys according to their cutting set,
22:01
it meets AL two can be considered unfixable.
22:06
And then Sisa has her own came up their own statement talking
22:09
about using sync passkeys as a as a form OF2FA, right.
22:13
So in full stop, I think you know, the passkey is going to be
22:16
as effective or more, I'd say more effective than SMSOTP, the
22:19
legacy form of two FA. Now for super high assurance
22:22
scenarios, you'll want to use device bound passkey, but
22:26
there's, there's wrinkles in all this stuff, right?
22:28
So I think going back to your question on how do we talk, So a
22:32
couple of things. So I think the NIST guidance is
22:35
going to be a really important milestone and we'll see other
22:38
regulators start to follow suit. And we have a very active policy
22:42
engagement program where we engage with policy makers
22:44
worldwide. We'll point them to this,
22:46
they're aware of this. And I think that as they're
22:48
updating their own guidelines and guidance and regulations in
22:52
countries all over the world that they'll start following
22:55
suit and start thinking about if you're using passkeys in this,
22:58
if you're using passwords, then you must do traditional MFA.
23:01
So I think these things can coexist.
23:03
I think guidance will come out that points to points to passkey
23:08
specifically. Now go on as far as banking goes
23:11
in regulated industry, you know, the question remains, well, how
23:13
am I going to, you know, how do I roll a sync password to
23:15
consumers when I don't know about the provenance of the
23:19
password provider or even know for sure that's Andrew on that
23:22
device because it's synced. So these are legitimate
23:25
questions too. And so my answer there is a
23:27
couple full one. You know, every platform
23:31
provider who's actually inside of Fido Alliance is deeply
23:34
committed to addressing high assurance scenarios with sync
23:38
passkeys, right? So that will happen as a matter
23:40
of how we get there, what the technical solution is and when
23:43
they choose to support that in their platforms.
23:48
But a lot of banks, I'm talking to you today, even with that
23:52
understanding that challenge, they don't necessarily have all
23:55
they want. You know, they're choosing not
23:57
to look that perfect way to do it and going back to their
23:59
compliance officers and saying, well, jeez, even if I use a a
24:03
pass key as a password equivalent, but if you treat
24:06
them one for one, when a much better place taking a pass key
24:09
as a primary factor than I was with password as a primary
24:12
factor. So it might be initially as
24:14
receipt banks rolling out pass fees, you know, cautiously,
24:17
maybe they start passing just for signing and then maybe they
24:20
do some sort of set up for, you know, higher value transactions.
24:23
Or if you think about this, at the end of the day, these are
24:25
all signals. Everyone has a risk engine and
24:28
then these are all different types of signals that they have.
24:30
And so if you leave more under other signals, then you leave
24:33
under passkey signals for now. But as the passkey itself has
24:36
more and more trust signals embedded in it, you can dial
24:39
down other signals. I don't think that any regulated
24:44
entity would ever trust a passkey in them itself to say it
24:48
wouldn't trade any. They wouldn't trust any other
24:50
single, you know, authentication credential without doing added
24:54
risk, you know, risk modeling and things like that.
24:56
So again, I think the we're super happy with the some little
25:03
guidance from NIST. I think that will help
25:06
accelerate and control more cautious entities and to start
25:11
to support pass keys for their consumers as well.
25:15
Do you think situations like the Fido certification helps that
25:19
case may say as other other organizations waiting for that
25:23
to be in place to say, OK, there's a little more assurance
25:25
that so? One thing we want to do is so
25:28
the program we have in the books is a certified passkey provider
25:30
program. And so it's a legitimate concern
25:32
from from some entities like how do I know that the person
25:35
managing these passkeys is I don't know their business is
25:38
good. All right, so maybe I'll trust
25:42
Apple and Google, they're known entities and I trust their
25:45
security. But if, if Joe's passkey
25:46
providers is managing Andrew's passkey, why would I accept
25:49
that? And so the program we're we're
25:51
putting in place is a certified passkey provider program, which
25:54
will certify that the manager of these passkeys is, you know,
25:57
taking the requisite steps to protect their cloud, encrypt
26:01
cloud, protect the keys and all those things such that once
26:04
certified that the relying party, which should have more
26:07
confidence in that passkey provider.
26:08
So I think that's something that's something from a
26:10
certification front that we intend to deliver which could
26:13
not. So yeah, I'm sorry, let me
26:16
interrupt right there on the certification, who would conduct
26:21
the certification? How what do you, how do you
26:25
perceive the mechanics of something like that?
26:28
Does that sounds pretty involved?
26:30
Yeah. So we look, we have a very
26:32
robust certification program. We may have certain
26:35
certifications in house and some with third party labs.
26:39
And so typically we talked about how user authentication
26:43
certification works, where you do self conformance testing, we
26:47
verify that and then we do an interop test on top of that.
26:51
Actually we have Secretariats, you will do a vendor
26:53
questionnaire to to do further rigor on the vendor itself to
26:57
make sure that everything's up to snuff.
27:00
So for the certified passkey provider program, it'd be, you
27:04
know, more of that feast where we are assessing this, like
27:06
there, there's better questionnaire, there will be
27:08
some conformance, like some, some physical tests.
27:10
Also the authenticator tests on, on, on how they're actually
27:15
performing. Now those are all things that we
27:17
can manage in house. Now where certification gets
27:20
more complex is with biometrics where you know, there are third
27:23
party labs. The biometric testing is
27:26
incredibly complex, incredibly expensive to set up.
27:29
And so we work with third party labs to do, to do those tests.
27:33
And so we, we do these in conjunction with third party
27:35
labs. And typically the vendor will
27:37
come to us with their vendor statement.
27:39
They then work with the lab to go through the tests for
27:42
whatever they are testing to come back to us for the
27:43
certification and the management of that certification there.
27:47
That just kind of shows the value of being certified in
27:51
spending all that money to go to a lab and do all these things
27:55
must be pretty important. Yeah.
27:58
And I, I think ultimately, you know, certifications are driven
28:01
by two things. The most important one is one is
28:06
customer demand. You know, customers want to see
28:09
certification especially again in in regulated industry, they
28:13
compliance is key. And so it's like they want to
28:17
build the compliance offers and say, look, this is biometric
28:20
certified or IDV certified, whatever it is.
28:22
And that's very important to have any certification.
28:25
Of course you know, the regular certification is, is important,
28:28
but having that certification is critical.
28:30
So the customer demands for certification is, is 1
28:32
component. The other thing is, you know, as
28:35
I said, we have 1000 something Fido certified products and we
28:38
have hundreds of vendors who are in the Fido community because
28:41
certification could be in the area of differentiation as well,
28:44
right. So for our our our
28:46
authenticators, hardware authenticators, we actually have
28:49
higher levels of sort of security certification they can
28:51
do with L1L2L3. And so we see companies going
28:56
through that both in response to demand, but also in able to
29:01
differentiate themselves from a competition.
29:03
I. Think we had another question
29:05
here. And your rubber color with
29:08
tasting foods. Yesterday, the CEO ping started
29:14
out with a deep fake video. Yeah.
29:16
So how does the Fido allowance alliances face verification,
29:22
addressing, being able to prevent things like that?
29:26
Yeah, that's a great question. So the evil Andres 2 evil
29:30
Andres. Evil Andres.
29:32
I love that. So part of what the
29:36
certification, IDV certification, the face
29:39
verification certification program does is look at
29:42
likeness. So on those videos were not
29:46
great likeness, but they kind of showed how they could be
29:48
manipulated. But beyond that, there's things
29:51
that the vendors are checking for that are a lot more subtle,
29:54
like shadowing. They could flash a bright light
29:57
or something like that, you know, to look for a reflection
30:01
on the face. There's all sorts of things that
30:02
they do, frankly, I don't fully understand that the vendors do
30:06
that. We test for also to ensure live
30:08
news. So live news is more than just,
30:10
you know, moving your head. We're seeing a catch phrase,
30:13
although those are those are also really important elements
30:16
of lightness detection as well. Yeah, I'm not a robot.
30:19
Yeah, this is exactly what a robot would say.
30:23
So Authenticate is coming up later this year.
30:25
We're looking forward to seeing you again in.
30:27
Carlsbad What can? We yeah.
30:29
What can we expect for for folks who haven't been to authenticate
30:32
one? It's awesome, yes.
30:34
But. Tell people why they should be
30:36
there other than to see us and you.
30:38
Yeah, well, that's that's that's probably the reason not to come.
30:41
That's me. That's the reason to come, of
30:42
course, is just see us. But it's look, if you want to
30:45
lean into learning more about authentication and Fido, this is
30:50
the place to go. I love it Inverse, you know, I
30:53
love that the broader identity community and and it's a great
30:56
place to learn and a lot of the like it inverse authenticate.
31:00
The sessions were fantastic, but the hallway column is is even
31:04
even better. I mentioned before about our our
31:07
community. Now, I've been involved with a
31:10
number of standards and I've never been involved with a
31:12
standard where people really generally want to help each
31:15
other. They want to help each other and
31:17
they want to help new entrants and people who are new to this.
31:20
They want to help everyone be successful.
31:22
And that's what happens on authenticated.
31:24
It sounds, it sounds so cheesy and but it really is remarkably
31:28
warm, encouraging and supportive community.
31:31
And I think you see that you guys have been the past couple
31:34
of years, you see that you space it off on a date.
31:37
But I like I had companies who I know who have deployed, they
31:43
always say to me like, so I often time connect them with
31:45
someone else who has successfully implemented Fido
31:48
and they kind of want to pass it on.
31:49
And so people are always willing to see what's the term.
31:55
Collaborate. That's not.
31:56
Collaborate. Here's a movie called Whatever.
31:57
They'll pass it on or something. Not me now, I don't know.
32:02
Anyway, people are willing to. There's a movie somebody, I'm
32:04
sure somebody is some of the comments like it's this it.
32:06
Wasn't a great movie, but it was the whole idea is like you
32:10
spread the wealth and so there's this willingness to help each
32:14
other kind of bootstrap, bootstrap your own knowledge and
32:17
and get engaged. So that's a long winded way of
32:19
saying it's a great place to learn.
32:21
It's also fantastic. Pay it forward.
32:25
There we go. Get to the rescue.
32:27
Pay it forward. People like to pay it forward.
32:29
And then like the individual actually said this to you, I'd
32:30
like to pay it forward. Please connect me to someone who
32:32
has to say these cases to me. That's, that's amazing.
32:35
You don't see that with other standards, you know.
32:36
So I think that speaks to a couple of things and I'll come
32:39
back to authenticate in a second.
32:40
But I think that spirit of community speaks to the
32:43
magnitude of the mission that we have the challenge in hand.
32:46
Like no one's ever said, yeah, you guys are like, why get rid
32:49
of passwords are so awesome. Like everyone understands the
32:51
challenge. Said nobody ever.
32:53
Said no one ever. Yeah.
32:55
And. There's a sense of, you know,
32:58
this collective, the collective will is the only way to make
33:00
this happen, which also speaks to the fact why we have so many
33:03
of the right companies sitting together doing this.
33:05
So Apple, Google, Microsoft, but that's pretty cool.
33:09
But then the next layer down, like fierce competitors all
33:11
working side by side to make this happen.
33:14
So I think the magnitude that's has in hand leads to the the
33:17
spirit of collaboration that we have, which is also manifested
33:20
and authenticated. Authenticated S is in Carlsbad,
33:24
CA, which is beautiful. For anyone who's not living in
33:27
Southern climes in October, I'd recommend coming early.
33:31
It's actually for some it's a holiday weekend, but you can
33:35
certainly come out and enjoy the the setting at the resort.
33:38
There will be some activities on even starting after Sunday,
33:42
kicking off Monday afternoon. We'll have great social
33:44
activities. It's just a really fun time and
33:47
fun place to worry about all things about it.
33:50
Yeah. I can see the three of us, of
33:51
course. Yeah.
33:52
I could definitely vouch for the weather.
33:54
In fact, when you say it's a warm environment, I see.
33:56
Yeah, San Diego's warm, especially compared to Seattle,
33:59
where it used to be. Yeah.
34:01
Well, I, I got a big kick out of it, you know, last because last
34:03
year's our first year in that, that that venue, Frank, I wasn't
34:06
sure I was going to go. But what made me so happy was
34:10
walking around and seeing what it's called, a bunch of
34:11
authenticators. Yeah, all the authenticators
34:13
tend to use, like, sitting, like in the little groups, like
34:15
throughout the resort. Like, you know, there's all
34:17
these cool places to hang out and like be in the sun, enjoy
34:19
the outdoors in between sessions and just getting to know each
34:23
other and, and comparing us. And so it's really, it's a
34:25
really cool environment. There's a word that comes to
34:27
mind that I was thinking about this the other day.
34:29
I was kind of describing the Authenticate conference with
34:31
someone else encouraged to come out and it was the word
34:34
fellowship. Yes, it's very much a community
34:37
and I think a lot of people in the identity.
34:38
Community. Really start to recognize this.
34:40
You're here at Identiverse and it's, it's almost like a high
34:43
school reunion every year, right?
34:44
You're seeing the same faces and the names like, hey, how you
34:46
doing? And maybe you don't know each
34:47
other's names yet, but you start to recognize the same people.
34:50
It's. It's very similar to that.
34:52
And we've to be clear, we've had a nice collaboration with that
34:56
Universe team on this as well. So when we first came up with
34:58
the idea of authenticating, the first people I'll talk to were
35:01
Andre and Andy. And I want to make it very
35:04
clear. We want this to be complimentary
35:06
to what's happening at the universe, be part of that
35:08
community. So we have a really nice working
35:10
relationship with this conference announced CRA as
35:12
well. So I think it really does help
35:14
continue the conversations that are happening there, you know,
35:17
six months down the road. Yeah, definitely.
35:19
And taking on to what you're talking about seeing all phase
35:22
high school reunion, making new friends, couple of our friends
35:25
here from Tyson Foods. And then we're talking about
35:28
before we start hit record, we're talking about, you know,
35:32
the different types of work environments that exist.
35:36
They've got a plant with like or they speak forty different
35:39
languages within one plant. And so that gets me to thinking
35:45
about these different scenarios I've run into overtime, like
35:48
clean rooms. And one of the odd ones I
35:52
remember was like a prison. You can't bring your phone into
35:55
a prison, right? So how?
35:57
Do you? Manage that from an
36:00
authenticator standpoint. And that's why there has to be
36:03
this wide variety. And I wouldn't say Federal
36:07
Alliance is a platform, it's a standard, right?
36:09
But it allows companies to go out and innovate in that area,
36:13
come up with an authenticator that meets a need that others
36:18
don't. And one of the coolest ones that
36:20
I run into. So here goes the question.
36:22
The the cool thing that I run into was an authenticator that
36:27
used your brain waves through your ear so you'd wear some kind
36:31
of headphone. How deep in your ear?
36:35
I don't know the answer to that, but it's pick up on brain waves
36:39
and I guess they're like an individual signature.
36:43
I thought that was like innovative.
36:45
I wasn't sure what the use case would be, but then I heard about
36:48
other different ones like bracelets and things like that.
36:52
I'm wondering, Andrew, what authentic bio authenticator have
36:57
you run into? That really rings a bell.
36:59
It's like, wow, that's something different.
37:01
So yes, we don't, we don't specify bio metric modalities,
37:05
but like like early on, there's one bracelet that looked at like
37:07
your, your, your pulse, which I believe is different for
37:11
everybody. Wow.
37:13
So pulse temperature, like things like that.
37:17
There's all sorts of, I'm not an expert in biometrics, but
37:19
there's all sorts of things that you can pick up on.
37:22
And I think it but, but since we don't specify modalities, it
37:25
allows for this innovation in the informed factors for
37:30
different use cases. And so, you know, I think
37:33
there's a lot out there. If someone brings something
37:35
totally new and off the wall, they haven't come a process for
37:37
making sure that this actually can be quantified.
37:41
But generally it's, it's, it's pretty open to both for people
37:43
to innovate on top of. But some of the scenarios we're
37:46
talking about the OT or in the prisons or things like that.
37:48
These are real scenarios too, like NCCOE, which is an effort
37:52
out of NIST a couple years ago did some of your first
37:54
responders and then they'd like, you know, Fido having multiple
37:58
modalities because you know, if you are a first responder and
38:00
you get gloves on, you can't use your gloves to get your finger
38:03
grip, but you can't use your IRS.
38:06
So like there's certain scenarios where you need to have
38:09
other, you know, various modalities to be available for,
38:12
for Senate. I think it's so cool that like
38:14
there's a standard out there and it enables innovation to build
38:19
around the standard, build your own business around kind of like
38:23
this innovation that you come up with that solves certain use
38:27
cases. Yeah.
38:30
Another question from the audience.
38:32
Come on up. It's fun, yeah.
38:35
Yeah, Sarah, Robert also with festive dudes to us, some of the
38:39
some of the challenges I think to adding paddle keys into the
38:42
environment is this other device that's that's being added and we
38:46
talk about adding layers to passwords or just adding more
38:49
layers of devices that people have to carry with them.
38:52
Is there any efforts to be added to less embedded into wearables
38:56
things that you've already have? And that can now become.
38:59
The authentication factor instead of, oh, here's another
39:01
key for your company and a key for this company.
39:03
Yeah, we have to have obviously 0 efforts into helping simplify
39:06
that. Yeah, that's a great question.
39:08
Yeah, I think so, yes. Yeah, I think in general, if
39:12
you're looking at your workforce, redundancy might be a
39:14
good strategy to have, right. So you give someone a security
39:17
key. They could also use your if your
39:18
Windows shop use Windows low, some of the functionality builds
39:21
into like Windows level business, stuff like that.
39:24
In addition to security key, we have a lot of companies now
39:27
offering these these mixed-use badges.
39:30
So if your badge gets you in the door is also your badging signs
39:33
you into your computer. So you're not necessarily adding
39:35
something else in. You could also use your devices
39:38
security key docs or rings. Like there are variables, you
39:42
know, for the workforce setting. A lot of this comes down to
39:45
policy and permissions, but there certainly are ways to to
39:50
manage this. But you know, in the workforce,
39:52
the best practice is to have reviews and security keys to
39:55
have two shows that two security case case you lose 1.
39:58
So have one on you 1A safe place.
40:02
That's also part of where Cassie's going like sink pass is
40:04
going to play the sensor synchronizes that.
40:07
But you you have you know you get lower, lower assurance
40:11
associated with that, but more redundancy.
40:14
And the choice is good, right? You would, we need to have
40:17
choices to be able to address different parts of the market
40:20
and people and you know, accessibility, right and all
40:23
that stuff. So even the brain wave stuff,
40:25
which I kind of joked about it, you know, there's, you know, the
40:28
neuro like patient right is doing amazing things with that
40:31
technology. Like there's a use case for
40:33
something like that. And everyone's like especially
40:36
talk about the enterprise, like Tyson's a huge company.
40:40
Shane Wheaton from IBM is giving a talk tomorrow.
40:42
But IBM going pass through this and you know, and they support a
40:45
range of things from from sync capacity to security keys to
40:49
Windows alone and apps and things like that.
40:52
So I think and even Sean's age for BMA talking about, he didn't
40:55
get the details on what they're doing, but I know they have a
40:57
blend of apps and keys and badges.
41:01
So I think the idea is kind of meet, meet your users where they
41:03
are as much as you can, let them use, you know, so long as it
41:07
stays in compliance with your own corporate requirements, try
41:11
to meet them where they are with a better chance than actually
41:13
using it and, and, and de risking.
41:16
The whole goal here is from the workforce standpoint, the goal
41:19
is to get rid of risk and, and we have better security with
41:24
better usabilities. So meeting them where they are,
41:26
that's really important. That's a good question.
41:30
Thanks guys for for coming up and stepping up to the mic.
41:32
For sure. We're going to wrap things up
41:35
here. You know, we end on a lighter
41:37
note. So I want to ask you a question
41:40
that I've been dying to ask you for a long time.
41:41
Usually you give me these. Advanced I do, but not today.
41:44
Not today, yeah. What's your favorite song by the
41:46
Band of Heart? Oh, come on, I'm just kidding.
41:49
This is a call back. You have to go back to listen to
41:51
episode one if you want to do that, right?
41:53
Exactly. No, but what's been the most
41:55
memorable Identiverse experience for you this year?
41:59
Is there something that sticks out?
42:07
The whole show has been, it's been a blur.
42:09
Just remember. I'll have to think back on
42:11
memories as I get chances. This is why it's A at the end.
42:13
It's kind of like a gut reaction.
42:15
Visceral type of thing. One of my favorite things was
42:17
sitting in the Andrew cameras talk about GM and the Andrew.
42:20
He's talking every year about how GM does identity, but he
42:24
mentioned past keys. Like of course you're doing past
42:25
keys. Yeah, like it's of course like.
42:27
What do you mean table stakes, right And to me, like for
42:30
someone like Andrew to say something like that was was was
42:33
Israel will see that where if we come table stakes or become an
42:37
expectation. So that that that actually that
42:40
was that was a one of the first sessions I sat in, if not the
42:42
first one I sat in and was a very early thrill for me on the
42:45
inside. You're like.
42:46
Yes, yeah. And.
42:48
Again, it comes back to, you know, people have worked so hard
42:52
inside the lines and again, there's so much passion, so much
42:56
dedication. And so to see all that work
42:59
transferred into people using the outputs of of all that labor
43:04
is just extremely. Rewarding.
43:07
Yeah. It's a fantastic, fantastic
43:09
alliance. The people in our top notch.
43:12
We've been following it for the last couple of years right as
43:14
part of the podcast and to see to see the adoption go from we
43:19
think this might work to Oh my gosh, it's working.
43:25
Yeah, exactly. And it becomes the of course,
43:27
yeah, it's like no brainer type stuff.
43:30
That's great. So we're happy there's still
43:32
work to be done still, you know, there's always ready to improve.
43:35
And I mean, there's work to be done, a lot of work to be done.
43:38
But like I, I, I say, you know, we're making past fees
43:41
inevitable. I firmly believe that and we're
43:45
we're committed to making that happen.
43:47
Excellent. Should we wrap up or do you have
43:49
a lot of grants? No, I've got, I don't have
43:51
something, but I wondered, I just had a question bubble up in
43:55
my mind. Do you guys have your naysayers?
43:59
Yeah, but not like, hey, we think passwords are, well, there
44:02
are those. Two, that's a big password for
44:04
you people like. People like passwords, right?
44:08
Any survey you do consumers around 30% I got this password
44:12
thing to mail. I have a great formula.
44:15
You know, you're going to pry my passwords from my, you know,
44:17
cold fish tans. So those there's those
44:22
naysayers, but people like naysayers about what final
44:26
license do not not so much. But there's some confirmation
44:29
around again, the syncing of the private key and was that meant
44:32
for with from a security posture.
44:35
But again, I think that's just a, you know, something we're in
44:38
we're going to work through and improve upon.
44:39
It's it's interesting that's talking to some people this
44:41
week. You know, if the if the five O
44:45
story, the web auth N story the arc began two years ago when we
44:49
introduced passkeys. We started there with yeah, of
44:53
course by default they sync and that was the expectation.
44:56
You know the thing about consumerized IT, things
44:59
generally start simple and get more complex.
45:01
So this all started two years ago.
45:02
People will be thrilled. There wouldn't be any
45:04
consternation at all. But there's a prehistory to this
45:07
of course, which is all the great work we did with five O2
45:09
beforehand. Go off in where you you had some
45:12
of those you know a little more assurance and and and more
45:15
details on on the device and on the user.
45:18
So it's that prehistory that people want to get back to you.
45:21
That's understandable. And and we'll get there again,
45:24
there's deep commitment to fully supporting these high assurance
45:27
scenarios by the platforms and by the passkey providers and we
45:31
will get there. And so again, any naysayers are
45:34
more about like that, like that. So that frustration that we had
45:37
this, you know, in, in their mind, the perfect scenario for
45:41
part of a security standpoint. But ultimately what we saw was
45:44
that that was not the perfect scenario for usability
45:46
standpoint, right? And and the the data proves that
45:49
out and we're talking about 13 billion accounts being capable
45:53
to use fast keys that would not have happened if we never
45:57
changed this model. And our goal is to reduce
46:00
reliance on passwords at planet scale and so as simply as not
46:04
possible without allowing this key to be more rarely built.
46:09
Jeff, I'm going to give you a shout out my group, my most
46:13
memorable moment was it's not a moment really, but I was just so
46:18
impressed with the panel that you those, I think it was a
46:20
microcosm of what the various sessions were like.
46:25
You're right. You got into kind of that level
46:27
of detail and people were geeking out and talking about
46:30
this Cape. Protocol Continuous access
46:34
evaluation protocol. And what I thought was so cool
46:40
is like the level of geeking out.
46:42
And the room was pretty packed. And like I said, microcosm of
46:47
what's going on. I think advice out there for
46:51
folks who are considering this conference next year is, you
46:55
know, you can go anywhere from engineer level all the way up to
47:00
business executive level. And there's content for you, for
47:04
everyone. Yeah.
47:05
Well, that panel was all. You asked great questions.
47:09
Yeah, Tim and Atul, I was just the good looks.
47:13
For it. Well, I was going to say that,
47:15
but I was going to say you asked the right questions.
47:17
No, it was a lot of fun and hopefully people learn some
47:20
things and I think there's probably a replay somewhere out
47:22
there. I think they're doing stuff
47:24
around that. But yeah, it was a good time.
47:25
I'm happy to do that. It seems to be start to become
47:28
my thing is moderating panels, which if you'd asked me a year
47:32
ago, like no way am I getting on stage.
47:34
I'll talk in front of a microphone or a pod, you know,
47:36
do a podcast. But yes, stand up there.
47:39
No, you're crazy. So we all are working on
47:42
something. But thank you very much and you
47:44
were in the back in your red jacket.
47:45
You're. Very easy to.
47:47
Spot shot out and people are like, well, I'm just going to
47:49
send the ovation for the jacket. Yeah, yeah, yeah, yeah.
47:53
Yeah, it was a good time. All right, let's go ahead and
47:55
wrap it up there, Andrew. Thank you so much.
47:58
Thank you so much. We'll have links in our show
48:00
notes to fidoalliance.org. Check out the great work, the UX
48:05
guidelines. All that stuff is out there.
48:07
We're on the web, IDC podcast.com, yes, the YouTube
48:10
link, youtube.com slash at IDAC podcast, Mastodon at Infosec,
48:17
I'm sorry, at IDAC at Infosec dot exchange and then Twitter X
48:22
whatever it's called now at IJC. Podcast or if people need like
48:26
the easy vert easy button yeah go into your podcast app or go
48:29
into YouTube and search for it then it's.
48:32
Yeah, man, like subscribe to a lot of fun stuff.
48:34
We're starting to do video. This is our first conference
48:36
with cameras and stuff like that.
48:38
And thank you for people showing up and and actually watching how
48:43
this madness, you know, looks like behind the scenes, that
48:45
kind of thing. So with that leaving there,
48:48
thanks everybody for watching and or listening.
48:49
Thank you, Andrew again and we'll.
48:51
Talk with everyone in the next one.
48:55
You've been listening to Identity at the Center.
48:59
We hope you've enjoyed the show. Make sure to like, rate and
49:03
review, and we'll be back soon. But in the meantime, hit the
49:07
website at identity@thecenter.com.
49:11
See you next time on Identity at the Center.