Latest / Identity at the Center / #310 - Personhood Credentials with Eve Maler

Transcript

#310 - Personhood Credentials with Eve Maler · Identity at the Center

0:05
This is Identity at the Center. If it has anything to do with
0:10
IAM, this is the go to podcast now.
0:15
Your hosts, Jim McDonald and Jeff Steadman.
0:25
Welcome to the Identity at the Center podcast.
0:28
This is Jim McDonald. I'll be podcasting alone with
0:31
our guest today. Jeff and I have both been
0:34
displaced by Hurricane Helene. I've been a little bit less
0:39
displaced than Jeff. I'm currently in South Dakota
0:42
where we have free air conditioning.
0:44
It's only 65° and and lovely and we have Internet and
0:49
electricity. Jeff is back home with me, safe
0:52
and sound. He didn't suffer any real
0:54
property damage, but he's still without electricity.
0:57
So he's highly inconvenienced and not able to make it today.
1:00
Hopefully this episode goes out on time, but the optics uses if
1:05
we miss our normal every Monday publication.
1:09
So today we have a very special guest.
1:11
But before I get into introducing our guests, going to
1:15
go over a couple things with conference codes that we've, you
1:19
know, set up specially for our listeners and our viewers on
1:22
YouTube. So the first one is a conference
1:26
that begins I think next week based on when this episode will
1:30
drop. So if you're a last minute
1:33
registrant for the South Point navigate conference October 21st
1:38
through 24th and it's in Orlando, FL, we have the code
1:43
IDAC that gets you a $400.00 discount.
1:45
So if you're last minute going use that code, save some money.
1:51
Two other those that we have. So first is Sempress's Hybrid
1:55
Identity Protection conference or the HIP conference for short.
1:59
That's November 13th through 14th in New Orleans, very cool
2:03
city and it's a very cool agenda that they have laid out.
2:07
We have the the code IDAC pod IDACPOD that gets you 20% off.
2:14
And this is the first announcement of this.
2:17
We have a code for the Gartner IM Summit, the Gardner IAM
2:22
Summit is in December. It's in Grapevine, TX, and
2:26
you'll save $375 on your registration with our exclusive
2:31
code, which is ID AC-375 S. With all of that, we're saving
2:38
lots of money. We love it if you use the codes
2:42
because it gets recognition from the conferences that you're
2:45
actually listening to podcasts, and we definitely appreciate
2:49
that. I wanted to introduce our guest
2:52
today, Eve Mailer. Eve has been on the show several
2:56
times before. She's the president and founder
2:59
of Ven Factory. Hey, Eve.
3:01
Hey, it's great to be here, Jim. I think this is the 5th and 1/2
3:05
time. It very well maybe I think I
3:08
might have yeah, we have a definitely 5.
3:12
And then you helped us out with the episode on what's the
3:18
difference between I am and digital identity, right.
3:23
And now I want to change that question.
3:25
I want to add what are the differences between I am digital
3:30
identity and identity security? So in other words, through the
3:34
curveball of what is identity security and how's that
3:37
different? Oh, that's a great one.
3:40
Yeah. Yeah.
3:41
That's. Are you asking me?
3:43
I I. I mean, why don't we come back
3:45
to that at the end if we have time, because we have such a
3:48
full agenda of things I wanted to talk to you about.
3:50
And I, you know, going all the way back, you're, I think one of
3:54
our first big name identity guests on the podcast back in
4:01
episode 48. I recommend for folks to go back
4:04
if you want to hear like how rough the podcast was when we
4:07
were just starting out five years ago.
4:10
June of 2020, Episode 48 Eve is on.
4:13
You went over your identity background story.
4:16
You've been on several episodes since 1/16, 1:51, two O 2 and
4:22
262. So this has been four years
4:26
since you gave us your full identity Argent story.
4:29
How did you get into identity and is this something you picked
4:33
or did it pick you they? Kind of picked me.
4:37
I mean it was a little bit accidental.
4:39
I had joined Sun Microsystems and I was in the XML technology
4:44
Center and that was a big thing then and Web services started to
4:49
be a bigger thing. And a colleague and I
4:52
determined, hey, you know, we web services security would be
4:55
really important. We had a partner that came to
4:58
Sun folks to say, hey, we have a spec that we did to kind of
5:01
outsource authentication and we want to standardize it.
5:04
Can you help us with that? And there was a sort of a
5:07
competing vendor that had their own spec.
5:10
I brokered bringing both of those specs to Oasis.
5:13
That became the group that produced SAML because I was kind
5:17
of like the Switzerland of people involved because I wasn't
5:21
really in the space, which we don't think of it as identity so
5:24
much. Then it was kind of like
5:25
security and directory. I was an XML person, so they
5:29
chose me as the first chair. And I found myself with a new
5:33
livelihood somehow after that. Yeah.
5:36
And I mean, bringing things forward to Sanders, I can't
5:39
imagine the industry without SAML.
5:42
I mean, it would look totally different.
5:44
I think back to those early days of identity and you know it.
5:48
The the way of the walk was really proprietary.
5:54
Web filters that filtered out access to applications and saw
5:59
if you had a cookie or not and then forced you through an
6:03
authentication. Everybody did it a little bit
6:05
differently. It was very proprietary.
6:08
Yeah, it's I think the cross domain part of single sign on
6:11
was, you know, obviously the the innovation there and it took
6:14
some doing right because if you're trying to securely
6:17
flaying identity information across the Internet, you got to
6:19
think harder about it. So that's that's what we worked
6:22
on and it seemed like we solved a problem that had a good, I
6:25
guess product market fit. It's still used today.
6:28
It's not, you know, much built upon in addition to the original
6:32
stuff, but you know, it's it's well used.
6:33
I don't think I like to say nothing deployed ever goes away.
6:37
So I think Saml's not going to go away.
6:39
And so it's a nice, it's a nice feeling to know that it's been
6:41
useful. Well, I think the other thing
6:43
about SAML, at least I was a practitioner when it came out.
6:46
And I'll be honest with you, you know, I wasn't the big picture
6:50
thinker. Must say I am now, but I, you
6:54
know, I look more at the limitations and I kind of
6:58
thought to myself, well, how's this going to solve all these
7:01
complex problems? What I didn't realize was that
7:05
companies and, and application teams would change their
7:08
applications to work with the standard and solve part of the
7:13
problems that were like the limitations is some other way.
7:16
You know, I looked at it like, OK, we've become dependent on
7:20
all these proprietary methods for doing authorization, things
7:27
like that, or we need to have working XY to Z, you know, our
7:33
special way. And I didn't think the
7:35
engineering community would adopt SAML in the way it did,
7:39
and I was wrong. It's one of those tough bets you
7:43
have to make if you're working on something really new.
7:45
And I've worked on a bunch of, you know, I worked on XML, which
7:47
was kind of a, we carved away parts of SGML that didn't look
7:51
like XML, and that's how we made XML.
7:53
So it was an easier proposition to adopt it.
7:56
But in the case of SAML, it was really just de Novo.
7:59
And the bet that you're making is that multiple parties in an
8:03
ecosystem will change their behavior.
8:05
And it's by no means assured. But we, you know, we had some of
8:08
the big vendors at the table when we started working on SAML
8:11
2, IBM came to the table, which was a big tell.
8:15
Microsoft started sort of, you know, signing up for things.
8:20
I was at Sun at the time that Microsoft and Sun had that the
8:23
big settlement and worked on kind of mutual WS fed SAML
8:28
interoperability, which is kind of a big deal.
8:30
So you wouldn't think those little things would make a big
8:32
difference, but they really do so.
8:34
Yeah, yeah, for sure. And I, I think the big lesson
8:37
that I got from that in my career is that as these new, you
8:41
know, collaborations are happening to come up with the
8:44
standard is they may at the time seem like, OK, this doesn't
8:48
solve the full problem that I have.
8:52
That may be by design SAML. Not yeah.
8:57
Exactly. SAML 1, we actually, you know,
9:00
we debated how many use cases to take on and just doing IDP first
9:05
single sign on it seems like not sufficient, but it's sufficient
9:08
for is a lot of workforce use cases like logging into your
9:11
benefits provider and things like that from your employee
9:14
login. So it tended to have a bit of a
9:16
workforce vent versus a Siam bent, though it's not
9:18
necessarily specific to that, but that's true.
9:21
Bite off more than it could chew at 1st, and it turned out that
9:24
we won the right to keep going with SAML 2 after that.
9:27
Yeah, no, that's great and a great point on the Siam, Ben,
9:31
because that's kind of where I was coming from, was looking at
9:34
it as like these real complex applications and etcetera.
9:38
So Eve, I reached out to you recently because you posted
9:44
something that was like clickbait for me.
9:47
The title of a blog that you wrote was called Personhood, the
9:52
Killer Credential, and I wanted to hear more.
9:55
I wanted to learn more. I did read your blog.
9:58
I'm not sure if everyone did, but we'll put it in the show
10:01
notes. But Eve, could you kind of
10:03
summarize what this is all about?
10:06
Yeah. And, you know, that title had a
10:09
question mark on the end of it. And that's it's, you know, sort
10:12
of part and parcel of my inquiry about, OK, if we're going to
10:15
have verifiable credentials, what is going to make that
10:20
ecosystem successful? And really, I think of it as
10:24
each different kind of credential representing a
10:27
different product that could have its own ecosystem.
10:30
Because for folks who've been following the the decentralized
10:32
identity story, you've got, you know, you've got a lot of
10:35
players in the picture just talking about standards, the
10:38
need for all parties to change their behavior.
10:40
So in this ecosystemic economic view of the verifiable
10:45
credentials proposition, you need to get an issuer who's
10:48
willing to play, you need to get a verifier who's willing to
10:51
play, and hopefully most particularly, you get a holder
10:54
of the credential. You know, we're thinking mostly
10:56
in terms of humans willing to play and more than willing a
11:00
killer credentials like a killer app, you know, it just takes off
11:03
and it's kind of viral and it makes the platform that it's
11:06
sitting on worthwhile. And so the last couple years
11:10
I've given a couple talks at superior call events doing this
11:14
kind of analysis around, well, what's the killer credential?
11:17
You know, what could it be? And I looked at a bunch of
11:19
different verifiable credentials as candidate products that could
11:22
go viral. And the personhood one actually
11:26
we're, I was calling it at the time, like, is it a person is a
11:29
person or alternatively not a bot, But that turned out to have
11:34
some properties that I thought could make it possibly the most
11:37
successful of the bunch. There's a lot of others, you
11:41
know, age, you know, your or, or like age assurance or age
11:44
estimation, that kind of thing. There's some other more fanciful
11:46
ones. So it looked like it had some
11:48
good prospects. But then recently there was this
11:52
research paper that came out about personhood credentials
11:56
written by a whole bunch of identity and privacy and AI
12:00
people who are, you know, some of them are famous, some of them
12:02
are known to us. And I was really interested in
12:06
do a research on that and like, OK, let's deepen this analysis.
12:10
Is it working? And so my blog post was
12:12
basically just a, a meta analysis of this PHC paper to
12:18
go, do I believe what it's saying?
12:19
Where do I think there are parts that are squishy?
12:21
You know, I'd love for there to be success.
12:23
How can we get to success? So one of the topics that is
12:29
getting a lot of attention right now is identity verification.
12:34
How much of the personhood credential is about the identity
12:40
verification? I mean, identity verification in
12:44
my mind is mostly about are you the same person in the real
12:48
world that you are representing online?
12:52
Absolutely. So that, that that's a big part
12:55
of it, but you're also bringing up the the AI element to this,
12:59
which is almost like CAPTCHA version 1000 or something like
13:05
that. Yeah, oh gosh, let's hope
13:07
captcha doesn't get that far. Let's hope it gets better and
13:09
better and doesn't go in that direction.
13:11
But you know, part of the reason why this THC research paper was
13:15
written was the the threat that we're facing from AI with deep
13:18
fake synthetic identities and the rest of it.
13:20
And you know, if you're in 100% remote, 100% digital
13:25
interaction, like here we are talking now and I just assumed
13:28
you were really Jim and I could tell from various cues that
13:30
there's a human sort of operating the whatever the meat
13:34
puppet, the stalking, to me, like 1 of it is connected to
13:39
identity verification in a sense, because a lot, this is my
13:43
take, a lot of the candidate issuers of verifiable
13:47
credentials in the world who might be in a position to say
13:50
that is not a deep fake. That is really Jim sitting
13:53
across there from me. They're also in a position to
13:57
know exactly who you are and to map you to the real world,
13:59
right? To do real IDV, do do real
14:02
verification, real proofing. And the idea with this PHC
14:05
notion is you don't have to reveal as much as that.
14:09
You can reveal. It's a real person sitting in
14:11
front of you right now. And that's all you really need
14:13
to know. And there's privacy preservation
14:15
characteristics as well as maybe in social networks where people
14:20
like the ability to be, you know, relatively anonymous to
14:25
know that they're dealing with people just like them and not
14:28
us. And this is where, you know, I
14:29
brought up Reddit in my post. I'm a big Redditor.
14:32
And I like, you know, knowing some bots declare themselves and
14:36
Reddit, but other bots obviously don't and we don't like them,
14:39
right. So, so personhood as a, as a
14:44
piece of information, as an attribute that you can convey,
14:47
it's kind of a subset of true identity verification.
14:50
And I've learned through my kind of further research, talking to
14:53
people out there, there's, there's some vendors who are
14:55
also providing a space in between, just, it's a person,
15:00
not a bot. And all the way to verification,
15:02
which is, yes, they connect to a real world person, but we're not
15:07
going to tell you who. Yeah.
15:09
But I I think that is one level of of testing that's important
15:14
is just OK, it's a real person now do our other authentication
15:19
mechanisms. Work right?
15:24
So. It's, you know, the whole notion
15:25
of this like 0 knowledge proofs and selective disclosure that
15:28
you get into with, with verifiable credentials comes
15:31
into play with this. Oh well, it's a person.
15:33
That's all you need to know. Yeah.
15:35
Well, you know, and, and maybe I was thinking about this with the
15:39
limitations of what I think the technology is today, but I
15:44
started thinking about the NIST, you know, levels of assurance
15:48
framework and the idea that, OK, maybe on Reddit, you don't need
15:53
this. I hate to, to say that, you
15:56
know, but like Reddit access is not like going into your bank
16:00
account or filing your taxes or changing the bank that you're
16:05
hopefully refund is going to go to, right.
16:08
So have am I being limited by the technology when they think
16:13
that or is that part of this, you know, for the foreseeable
16:17
future? I think, I mean, I think we have
16:20
opportunities to go outside the, you know, low assurances.
16:23
I don't know, I'm going to say just a password that seems like
16:25
not even sufficient anymore for for, you know, LOA one or we
16:29
used to call LOA 1, you know, authentication assurance level
16:31
1. I agree.
16:33
But for a long time, I think there's been a parallel
16:36
discussion to the NIST levels along the lines of look, you,
16:43
you just want to know they're not a dog.
16:45
You want to know they're the same dog as yesterday.
16:47
I heard about this in my blog years and years ago.
16:50
And you know, there was, there was an effort that Justin Richer
16:52
started called Vectors of Trust, which enabled there to be kind
16:56
of multiple dimensions. Ultimately, ultimately NIST
17:00
800-63 went in that direction as well so that you have identity
17:04
assurance level, you have authentication assurance level,
17:06
you have federation assurance level.
17:08
People talk about other dimensions and then they you can
17:11
imagine them starting to float, although quite often we still
17:14
imagine them in lockstep. But if you imagine that you
17:17
could have strong authentication without receiving information
17:22
that gives you a strong identity assurance like, or that you can
17:25
get identity assurance that's anonymized, you know, that's the
17:28
kind of thing that credential world seems to make more
17:31
possible. And so, you know, I was
17:33
interested to look at that proposition and see if it holds
17:35
up. Yeah, I think that's a good
17:37
point there with 800-63 having the, you know, AB and C which is
17:45
what is it, federation authentication and identity.
17:49
So you could be it like a Level 2 identity or Level 3
17:53
authentication, which is essentially unfishable
17:56
credentials. It kind of feels to me like the
17:59
person who had kind of at least conceptually, combines identity
18:04
and authentication. Or do you still see them?
18:07
Differently no, it's in the cracks like, you know, a good
18:09
Blues note it's it's sort of playing both sides one of the
18:13
things that I think people don't think about quite often and I
18:16
didn't see this recognition in the paper so much verifiable
18:20
credentials are a delivery mechanism for I'm going to call
18:24
them atrophies, right they're not the thing that does the
18:28
checking about whether you're a person or does the checking
18:31
about true deep identity verification.
18:34
So you still need to do that work and those, you know, let's
18:39
say a bank or a government agency still has to have methods
18:43
of doing the checking, doing the authentication checking that's
18:47
necessary, doing the binding to the device that we happen to be,
18:50
you know, all the devices we're talking through and, and doing
18:53
maybe verification to the NTH degree before releasing just a
18:57
little teeny bit of that information as a personhood
18:59
credential. So, you know, I don't, I think
19:01
the work doesn't go away and the threat from AI doesn't go away.
19:05
There's folks who are working on that and you know, doing a
19:08
pretty good job in in that arms race.
19:11
The credentials ecosystem, it doesn't really have much to say
19:13
as far as I can see about the doing of that work.
19:17
Yeah. You know, I want to talk about
19:19
the AI component because I really feel like this is kind of
19:24
the driving force behind a lot of this.
19:27
And I think we spent a good bit of time talking about it from
19:32
the person or potentially a bot accessing a resource.
19:39
I think the other side of it is AI is required to do that
19:43
detection. I don't know.
19:47
I guess here's what I'm kind of thinking is that smaller firms
19:52
are not going to be able to keep up and writing their own AI
19:57
engines that would keep up with an open AI or what Microsoft or
20:02
Google are doing with AI. And that could be.
20:07
A major influence around what the industry looks like 1020
20:11
years from now. I mean, I kind of feel like I or
20:16
I shouldn't even say. I feel like, I guess my question
20:19
is, is how do you see this playing out in terms of, OK,
20:24
you've got these major AI organizations building AI, now
20:31
you have companies that build authentication technology.
20:35
Do they kind of get forced out of the picture or do they
20:41
somehow adopt these major AI engines, let's just call it an
20:46
engine, and leverage that technology so they can keep pace
20:50
with all the big players? Here's what I think.
20:55
I hope they don't get sort of forced out.
20:57
There's a couple of options. One option is, you know, the
21:00
actual mobile devices that we use are doing, I believe
21:05
they're, they're an under analyzed resource for how we can
21:09
get pure personhood, not necessarily with all the KYC
21:14
type of stuff because they're bristling with sensors.
21:18
They have accelerometers. You walk around with your phone,
21:20
my watch is telling me, you know, how fast I ran or
21:22
whatever. So those are elements of, you
21:26
know, not a bot kind of entity moving about in the world.
21:31
And so I kind of feel like that that level of access that a
21:35
small company might have to information that gets rid of
21:39
overt bot activity might be available through those
21:43
platforms, the OS, the device, the browser.
21:46
Now on the other hand, there's a lot of vendors who are, you
21:49
know, there's big ones and small ones who are pushing ahead on
21:52
this kind of improvement of liveness detection as an example
21:56
of where you need to improve. And a lot of where those vendors
22:02
play is with the financial institutions and the government
22:07
agencies who kind of are responsible for knowing who you
22:10
are in the real world for various reasons.
22:13
And so one of the things I, I've anticipated for a while and I've
22:17
seen as we've seen the, the growth of password list and then
22:21
sort of true pass keys is the places where those are getting
22:24
adopted tends to be like retailers who can rely on
22:29
payment rails where that's helping to have that happen for
22:34
them. And you can be quite a small
22:36
retailer and work with Shopify, for example, and you know, they,
22:40
they can give you a pass key. And so I think there's kind of
22:44
an ecosystem that can be strengthened in terms of its
22:48
resilience to the AI threats around deep basic synthetic
22:52
identities and everything. It also kind of helps make the
22:57
experience of being a smaller player quite efficient and
23:01
scalable. The other maybe downside from a,
23:04
from a decentralized identity perspective is it's centralizing
23:08
things. You know, everything tends to
23:09
roll, roll towards the center, not just identity of the center,
23:12
but you know, all, all business tends to sort of roll towards
23:16
these brokers, these exchanges, these things in the middle.
23:19
And we have to see what the result of that will.
23:23
Because I mean, first of all, the OS device and browser makers
23:26
are kind of, you know, that big tech right there and it's quite
23:28
centralized as well. I kind of feel like the the
23:33
level of competition in the market is what keeps the price
23:37
as low as it is. And sure, I might get some hate
23:40
mail over this. Like, are you kidding me?
23:41
This is not inexpensive. But look at what's happened with
23:45
like ticket brokers. You can't go to a concert for
23:49
under 100 bucks, let's just say, and it's because the limitation
23:54
of space. If you have to run your retail
23:57
operation through a Shopify, if you have only a couple of
24:01
players in the identity space, I always see the price going up.
24:05
Yeah, yeah, certainly. Yeah, consolidation has some
24:08
some cost to it. The nice thing is that there's a
24:12
whole bunch of innovation among some of those smaller players.
24:14
And so there's a kind of cycling that that's going on.
24:17
You know, I've talked to a bunch of folks who are doing some
24:19
interesting stuff and, you know, biometric technology and
24:23
protecting that and various kinds of verification
24:27
techniques. It's it's improving.
24:30
OK, well so this is a fantastic discussion topic.
24:33
I'm going to put your blog posts in the show notes and people can
24:38
reach out to you. Keep the discussion going.
24:41
If you decide to move it on to Reddit, move the discussion on
24:45
to Reddit. That's fine as well.
24:47
You recently did another, well, I shouldn't say recently.
24:52
This is one of that, one of the ones you did a while ago, right?
24:55
Going back talking about consent is dead.
24:58
And I think you did a blog post on it that we'll link to in the
25:03
show notes as well. Can can we come to start with
25:06
that consent is dead shtick, if you will?
25:09
What is that all about? There's a lot kind of underneath
25:13
from them, yeah. I mean, so I, I had the great
25:16
opportunity to appear at EIC this year in Berlin and I gave a
25:22
keynote talk on Consent is Dead because they asked me, you know,
25:25
months prior for a title. And I picked the most
25:27
provocative thing I could think of.
25:29
And then I had to, you know, do the work, do the research,
25:31
decide, you know what I really think and just and find out just
25:35
how bad it is, how bad it is out there for like, if you are, you
25:38
know, clicking, I agree. And so on.
25:40
We all have this suspicion that that's kind of meaningless.
25:44
And based on some research that I found through Internet safety
25:49
labs where disclosure, I'm a board member, there's just some
25:54
great work that they did themselves and found elsewhere
25:57
showing just how identifiable we all are online and how much our
26:02
wishes are ignored online. And just just how bad it is even
26:06
in Europe, even in the EU, like, you know, you'd think that GDPR
26:10
was going to save everybody and it hasn't really.
26:12
And so I, I got told, you know, from somebody who was
26:15
appreciative of the talk, they're like, yeah, but it was
26:17
depressing. And like, you know, I'm trying
26:20
to figure out well, how how can we make things better?
26:23
And where I went with it was, and I did, I did a four blog
26:26
post series because I basically wanted to make sure that that
26:28
kind of thinking was accessible to folks who aren't cooping or
26:32
coal subscribers necessarily. I'm happy to share the deck for
26:37
for people who want that as well if they if they just write into
26:39
me. But I think you could EIC or
26:41
Cooping or Coal's website and watch the video of it you.
26:45
Have to be, you have to have attended or be a subscriber or
26:48
something like that. But but you know, I wanted to
26:50
just share the thinking and I wanted to share particularly a
26:54
window into this world that has the word identity in it that IA
26:58
lot of I am people have no idea exists.
27:01
And that's the world of identity resolution, which is about that
27:05
kind of heuristic checking using big data lakes without a direct
27:09
relationship with a person, you know, the end user at the end of
27:12
all this. And that's the stuff that fuels
27:16
the customer data platforms and the data brokers and the data
27:19
monetization that, you know, big enterprises are doing
27:22
everywhere. And they're hiring these folks
27:24
to identify you from the tracks that you leave from your exhaust
27:28
data rather than going straight to, will you please, you know,
27:32
register for a login with us. So it's kind of that whole world
27:35
that starts before or without, you know, the cookie that says
27:39
you have a session or that relationship that you might
27:42
forge, you know, directly with a company.
27:44
And so you know what I found when, when I spoke to this
27:47
audience at EIC, you know, I asked the audience, you know,
27:50
who's ever heard of identity resolution and that like
27:52
hundreds of people, two people raised their hands.
27:55
So I feel like it's called identity.
27:57
It's it has something to do with identity.
27:59
We need to be aware of it so that if we want to mitigate
28:01
those as threats, we'll be better prepared to do so.
28:06
Feels again, has a lot to do with privacy as well, but you
28:09
know, I, I kind of feel like the first time there's this really
28:13
irritates me and like you said someone said it's depressing to
28:17
me it's very irritating every website you go to it's like
28:21
accept our cookies or beat it and it's like, OK, well I want
28:28
to obviously I want to go to the website otherwise I wouldn't be
28:31
here so I accept the cookies now I'm accepting what to be tracked
28:36
and then it's sign up for an account either even if it's go
28:40
through and use your Google account like, hey, we're going
28:43
to have access to all this information normally but I do
28:47
think that at least puts you in the power because it's
28:50
simplified and kind of like you can say all right well they're
28:54
going to have access to my e-mail address for my birthday
28:57
and I might not like that, but at least I know I can make that
29:01
decision. What really bothers me is when
29:03
you go through a whole process and you say by continuing, you
29:07
agree to our policies. And usually our terms and
29:10
conditions aren't policies. And once in a while, I get like
29:14
the crazy idea. I'm actually going to click on
29:16
it. And then I see it's, you know,
29:19
an hour's worth of reading on a bunch of stuff that there's no
29:23
check boxes. Like I agree to this.
29:24
I don't agree to that. It's.
29:26
Yeah, you can't change it. I mean, it's, it's a contract of
29:29
adhesion as the lawyer lawyers would say, right?
29:31
It's you don't have much choice about it.
29:33
And thus it's, it's not really, you know, the lawyers would call
29:36
it defective consent if they weren't all sort of defending
29:39
GDPR and doing all the other work that they're doing, which
29:41
I'm sure is important work. Many of my best friends are
29:45
lawyers. I don't have to say, but but you
29:47
know, these are the the factors. Sometimes the regulatory
29:52
environment makes businesses go down this track of doing things
29:56
as they do like the whole sort of cookie consent regime, which
29:59
is pretty meaningless by the way.
30:01
Some of them will track you even if you say don't.
30:03
Sure. These things do not result in,
30:07
they might result in compliance, but we know they don't result in
30:10
customer trust, privacy, particularly security.
30:15
But you know, they're, we can ask ourselves after six years of
30:18
GDPR enforcement, actually, you know, what's what's changed,
30:21
what's gotten better? And that's kind of why I, why I
30:24
wrote all this stuff and why I've been sort of talking with
30:26
everybody about it going, all right, how do we do better then
30:29
what would, what would be the first thing you do?
30:31
And it's, you know what, I came to the conclusion of it.
30:34
It's rooting out those beliefs that were sort of limiting us
30:36
and starting to get real about what it is we believe about
30:40
what's possible. Yeah.
30:42
You know, I kind of, I feel like I came to a pessimistic
30:47
conclusion about GDPR, which is that it's basically a system to
30:51
find organizations that are breached, which I guess there's
30:56
something behind that. And maybe I'm just being overly
30:59
negative. And again, I'll get roasted
31:02
online for this, but it's kind of like that's what seems to
31:07
really drive people is they don't want to get fined.
31:10
So that makes sense. And I don't think that the
31:14
companies that are always breached are just the ones that
31:17
are asleep at the wheel. I think there are others that
31:19
are asleep at the wheel who don't get breached.
31:22
And I think sometimes organizations that get breached
31:25
are doing a good job. It's.
31:28
I think your comment about, you know, what GDPR is for is it's
31:31
incisive because you're observing what they actually do
31:34
and going, well, I guess that's their purpose.
31:36
And that was that was one of the schticks that I used in the
31:38
talk. There's there's a famous saying
31:40
by this guy Stafford Beer, who was known as the first
31:43
cybernetician. And he says the purpose of a
31:46
system is what it does. He also said there's no point in
31:50
saying that the purpose of a system is something that it
31:52
consistently fails to do. So, you know, you can look at
31:56
the results of a system and and I think in fairness say, well,
31:58
that's what it seems to be there for.
32:01
Right, right. So what were when you look at
32:07
the consent is dead kind of shtick, what was the
32:11
recommendation that came out of that in the end of the at the
32:14
end of the day, what were you saying?
32:17
You mentioned like looking at data leaks.
32:20
And so is the idea that you can infer a level of consent based
32:26
on some kind of like meta profile that you've created.
32:30
You can infer who's in front of you even if they haven't shared
32:34
that with you, or even if they've only shared a very tiny
32:37
amount of data. Like tiny in the sense of
32:39
verifiable credentials, you know, sprinkling on top of the
32:43
relationship. So I am, I'm actually working on
32:47
a white paper so I could just sort of hand people, you know,
32:49
it doesn't have to be a four part blog post.
32:51
You could just sort of read the whole thing at your leisure,
32:53
print it out, whatever. And and I'm going to be making
32:56
some recommendations so that people could take action so
32:59
that, you know, identitarians can take action most
33:02
particularly. And I think one of the things
33:05
is, is to discover to uncover just how deep the data
33:10
monetization system goes in your business, because that's going
33:15
to determine the purpose of your system.
33:19
If a company is making money off of personal data, whether it's
33:22
directly through, you know, interacting with somebody or
33:25
whether it's going and buying the opportunity to target ads or
33:28
buying data that re identifies them in, you know, quite awkward
33:32
ways. Like find out how strong that
33:36
ecosystem is in your company so that you can start to make
33:39
decisions about what your privacy and consent and even
33:45
part of your security stances can even allow you to be.
33:51
So is that that's like one thing that I'm thinking of, you know,
33:55
that's the kind of conversation you need to have internally
33:56
because those are stakeholders who, you know, they live in
33:59
marketing, they live in maybe a chief digital officer land.
34:03
And that's why we were talking earlier about your your mention
34:07
of Gigya and Jan Rain recently, you know, as last for the past
34:11
from the past for me, because those folks specialized in that
34:14
kind of consumer facing market marketing enhancing identity
34:20
system. And you know, those things have
34:23
existed. They've they were closely
34:26
aligned with social sign in, but they really go beyond that these
34:30
days. And it's quite sophisticated as
34:32
a kind of martech ad tech ecosystem.
34:35
Yeah, it's really, but I still think it's the like the chief
34:38
marketing officer who's behind making the investment in a
34:43
digital transformation or customer identity and access
34:46
management. So I think Gig and Jen Rain,
34:50
we're on the right track. I just feel like what happened
34:54
was when they're about to kind of like achieve that big
34:58
picture, they both got acquired, but it doesn't feel like that's
35:03
the that the, that pole that they left in the market was
35:08
completely filled as a void by other players in the space that
35:12
they didn't take as much of A marketing focus.
35:14
They said what you really needed was security.
35:17
Do you agree with that? I mean, you were right in the,
35:20
in the heat of it. So if I'm I'm I'm sitting here
35:22
in the peanut gallery watching. Reflecting on it actually you're
35:27
making me think that the IAM industry has actually pulled
35:31
back from the brink a little bit and engaging with the marketing
35:35
colleagues who are so keen to get that information and in a
35:40
Siam context, right. One of the downsides of having
35:45
pulled back a little bit, I think just thinking about it
35:48
right now is we have maybe over rotated on how privacy sensitive
35:55
we are and how privacy sensitive we're being.
35:57
And it's led to a very robust conversation and a lot of
36:02
solutionizing around some of the decentralized identity solutions
36:06
in the name of privacy and user control and consent.
36:10
And yet one of the things I point to in various places in
36:14
the series is the work that's done by Sam Smith.
36:17
So Doctor Sam Smith, he's the creator of Cary, the key event
36:22
receipt infrastructure, I think where his most recent research
36:27
is, honestly, it's damning. It's damning against the notion
36:32
that selective disclosure helps the situation.
36:36
And so if that's the case, I'd be advising people don't spend a
36:40
lot of money on selective disclosure technologies
36:44
specifically if your aim is to keep people from being re
36:48
identified because, well, don't trouble yourself.
36:50
They're very easily re identifiable, particularly with
36:52
all the new AI in the picture. So, you know, maybe there's cost
36:55
savings there and you can be honest with your with your
36:58
users. Yeah.
37:00
I, I kind of feel like from my very entry into this industry,
37:06
there's always a line of this is identity data.
37:09
And this over here is not identity data.
37:11
I'm sure there was some Gray area, but the Gray area was
37:15
pretty thin. So in other words, you know your
37:19
credentials, those are definitely identity data.
37:23
Your transactions are definitely not identity data.
37:27
The state and city that you live in, I don't know.
37:30
Some people treat those as identity data in certain
37:33
contexts. Others are just shipping
37:35
addresses. And so when you start to look at
37:40
big identity projects, usually the first thing you need to
37:43
solve is like, how do you deal with identity data?
37:46
How do you kind of like, who is Eve?
37:50
It's not just her transactions, but that becomes very important
37:54
if like Eve goes on and all of a sudden is buying some things
37:58
that are like out of her price range and are things that she
38:02
doesn't buy anymore. We can certainly infer from a
38:05
security context this might not be Eve.
38:09
You know, this is you're getting at something really important.
38:11
You know, for a long time I was saying that identity is small
38:15
data. You know, there was this big
38:17
movement towards big data and now we just talk about data
38:19
lakes and whatever warehouses. But the information in your
38:24
profile anyway is it's relatively small in amount, it's
38:31
relatively well bounded. But all the business systems
38:34
that have other information about you, I mean, there's a lot
38:37
of value in integrating IM systems so that those other
38:41
business systems are, you know, they're all connected to the
38:44
right person for not just upsell, but also fraud
38:48
mitigation, you know, opportunities And a lot of the,
38:51
you know, the GDPR rights that I would for I'm go around talking
38:55
about and how you can implement them.
38:57
And with a with a good Siam system that's valuable to do.
39:02
But I think we're not going down the right Rd. if we think of the
39:05
identity data, the profile data, you know, just the account data
39:08
all by itself as everything there is in the universe.
39:12
There's a huge other universe out there.
39:14
And that's where I think getting to understand how that larger
39:19
graph is being used, it's critical for prosecuting your
39:24
aims of privacy and trust and even security as an identity
39:29
practitioner. I want to transition because I
39:32
think there's a great transition point for authorization.
39:36
Kind of like what can be done with authorization, What can be
39:39
done with data to infer authorization.
39:42
But before we transition there, one other thought that I had was
39:46
we were talking about a lot about artificial intelligence,
39:49
AI, not Allen Iverson artificial intelligence.
39:53
So so here's the balance that I've been kind of struggling
40:01
with or thinking is like the real question that's going to
40:05
have to be solved with AI. It's like there are certain.
40:10
IM approaches that are, let's take the paper and pencil
40:13
process. Jim requested access for Eve on
40:20
such and such a date. Somebody else approved it,
40:23
right? There's like all these things.
40:24
You could pass a piece of paper around and people sign if we all
40:28
worked in the same small office and you put it in a filing
40:31
cabinet and then somebody could go back later and pull that
40:34
piece of paper out and look at it, right?
40:36
That's what an IM system is. And then also Eve went to a
40:41
website, she typed in eve@xmlgirl.com and she put it
40:47
in her password, which is password 123.
40:50
It was. Accepted.
40:51
You told everybody. I told the world, all right, so
40:54
now all you're you're in trouble now your AOL account is going to
40:58
be hacked. The the, but OK, that was
41:02
accepted and we put that in the filing cabinet.
41:05
Now Eve goes and does what she's going to do.
41:07
Oh, she bought something. We put that in the filing
41:10
cabinet. But there are very specific
41:12
actions. Now we have risk scores which
41:16
are being created. And I think that's still
41:19
something the human brain can compute.
41:21
It's like these factors, these 15 factors go into a risk score.
41:26
So, and we can maybe look at the piece of paper that tells us,
41:31
oh, she scored with this association.
41:33
She was logging in from North Korea and she was, you know,
41:38
logging in with a headless browser.
41:40
So we denied the access. So when we're in court someday
41:44
and why couldn't she transfer the money she needed to transfer
41:47
at that time? We say we get this piece of
41:49
paper. She was, you know, our policy
41:52
stops that. But now my concern is that we
41:54
get into this AI world and Eve is permitted or denied access.
42:00
We made the wrong decision and we go to court and we say, well,
42:05
I don't know, software just decided not to let her in or
42:08
letter in or whatever. And my concern is like, we don't
42:12
really, if we don't know how the AI made the decision, then
42:17
we're, we're, we're getting away from that paper and pencil,
42:21
which I'm not saying is the right way, but it kind of feels
42:24
like it's the tradition behind by day access management
42:27
technology, just kind of automating those things.
42:31
And this does connect to authorization.
42:32
So we'll be sure to do that next.
42:34
But, you know, the signals have become more diffuse.
42:39
I actually had, I was talking to somebody who was saying that
42:42
COVID, the pandemic where people were no longer moved about the
42:45
planet the way they normally do, messed up those signals a lot
42:49
and made them a lot more uncertain.
42:52
We, we like determinism. So there's something that looks
42:54
like a, you know, library book with a record and you go look up
42:57
the workflow for approval that we're on paper that's very
43:00
deterministic and you know, who did everything.
43:03
But going to that more heuristic world where you're taking these
43:06
signals and deriving decisions that might have had a kind of
43:10
automated component to them. I mean, one of the things that I
43:13
think is a great idea is trying to work with explainable AI so
43:17
that you it functions more as a recommendation engine and can
43:20
explain itself. You know, just like when you go
43:23
to buy something and you know, Amazon says because you looked
43:26
at this, we're recommending this, you can get a sense of,
43:30
you know, because you access that, we're actually
43:32
recommending you get an entitlement to that other thing.
43:35
That would be a nice consequence if it were right, You know, So
43:39
we're in, we're in land of many more signals, many more fine
43:44
grained signals, many more uncertain signals.
43:47
And we're in this world where decision making is taking a new
43:50
turn, You know, the authorization decision making.
43:53
We've got new tools, but they are, but they're finer grained
43:56
themselves. So you know, need to be able to
44:00
explain ourselves when it, when it comes to an auditor's
44:03
question, for example. Yeah, yeah, I, I think that's
44:07
auditor. And some of these things could
44:09
be court cases or forensics of, hey, someone just stole millions
44:14
of dollars from an account. Why?
44:18
You know, maybe we could trace what happened, but can we trace
44:21
why it happened? Why was the account given
44:24
access? Well, the AI approved the the
44:30
access, approved the level of entitlement.
44:36
Now, can we explain why that that was some kind of
44:40
predictable event? OK.
44:43
So. Yeah.
44:45
Yeah. I think we go back and forth on
44:47
that, but I do think that ultimately that's where we're
44:50
going to end up is that it can't be a complete black box.
44:56
I did want to talk about the Auth Zen working group.
45:02
Maybe you can give us an update on that.
45:05
Yeah, I'm, I think this is hopefully going to air around
45:09
the time of authenticate and there will be an Auth Zen
45:12
presence at authenticate with some interop activity.
45:16
There is a first implementers draft of the Auth Zen 1.0 spec
45:21
out. There's a 1.1 floating around
45:24
that has kind of an extension to the API.
45:27
What Auth Zen does is it's it's kind of a very modern take on
45:31
stuff that we expected Exactmol to do a long time ago with PDP
45:39
that can answer questions coming from APEP.
45:41
So policy decision point, policy enforcement point.
45:44
And so that's kind of the starting point for all this.
45:47
The the 1.1 addition is to allow for asking the box, caring the
45:53
the requests and the responses. That's really cool.
45:57
I mean, so I'm going to ask you a question about authorization
46:03
that I'm getting a lot these days because authorization has
46:06
become such a hot topic and it seems like P back and to the
46:14
lesser extent, but let's say P back is blistering hot.
46:18
A back is something people are very interested in and the one
46:23
that nobody wants to talk about it anymore, but it's still the
46:26
most widely used as far as I can tell are back.
46:29
I've actually had some of my clients ask me like you're,
46:32
you're telling us that we need to do RBAC and isn't that kind
46:38
of going out of style or not just going out of style, but is
46:43
it becoming irrelevant? So in other words, we put all
46:46
these years of investment into RBAC, are we going to then have
46:50
to just switch it out for feedback?
46:53
And I don't see most of these as actually mutually exclusive.
46:57
Like if you state your policies, I still can't get a clear answer
47:02
on like, you know, policy as data, policy as code.
47:05
Anything written down, you know, in digital form can be managed
47:07
as code if you want to. So policies are not antithetical
47:14
to roles. Roles are not antithetical to
47:17
attributes. Since Gartner I am happens to be
47:21
taking place quite near to where I live.
47:22
I'm I'm thinking about having an authorization aficionado
47:26
gathering and I've been talking about BBQ based access control.
47:31
So you'd asked about IDAC back and I say why not?
47:37
But I yeah, you don't want something to become perceived as
47:43
no longer operative. It really is operative.
47:46
And I think that role based access control really is
47:49
operative. We've learned a lot about how to
47:50
make it a little bit more efficient.
47:52
We don't want to lose those gains.
47:54
At the same time, we know that it kind of has limitations at a
47:59
certain point. And you know, as soon as you
48:02
could probably just do a kind of an evaluation of like how many
48:06
roles you have. And if you have roles for more
48:09
than about, you know, 70% of your positions divided however
48:13
they are, you're going to start reaching the end of its
48:16
efficiency for what you want to do and you have to start looking
48:19
for additional approaches. You didn't mention Reback, which
48:23
is the even newer hotness that's relationship of course.
48:29
So I think that these are all these can all play in a space
48:33
where people are really trying to solve problems of making
48:36
their authorization more externalized and more of a
48:40
shared service than it ever was before.
48:43
We had a show where we talked about this before and someone,
48:47
someone I think Jeff asked, or I asked Jeff the question, what's
48:51
your favorite back? And he said baby back ribs.
48:56
So that goes your your BBQ back. But let me give you my quick
49:03
rundown of all the facts. I I know less about Reback, but
49:07
what it I have an idea in my head of what I think it should
49:11
mean or what it does mean. But OK, so our back I think is
49:16
really two different concepts, but it's they're both using what
49:22
is considered at least by the organization as identity data
49:28
and it's not authentication time, authorization time in
49:34
force. These are groupings that are
49:35
going to drive provisioning. So the first is a member of
49:40
something and therefore I get certain authorizations or
49:46
entitlements given to me. So that's kind of like the
49:49
Birthright rolls. And then the other benefit in
49:54
our back or the second area is the roles that are, I'll call
50:01
them business roles. So they're groupings of access
50:05
patterns that make sense for me based on the job that I do, but
50:11
they would be assigned to me and kind of, let's call it ad hoc.
50:15
In other words, they're not being driven automatically.
50:18
A manager is going to say, Jim does this job and somebody else
50:23
is going to approve it. I'm going to get a bundle of
50:25
entitlements. But the, the driver there is
50:28
that it's business friendly language grouping multiple
50:33
entitlements, which may or may not be business friendly, but
50:37
the grouping of those should enable me to do some job
50:40
function. So, but I think that the big
50:43
thing with RBAC is, is not enforced at the time of
50:49
authentication. It's a, it's a provisioning role
50:53
in my book. A back is authorization time or
50:58
authentication time applied. In other words, Jim is in this
51:02
department. When that F Jim logs in, it
51:06
checks I'm in that I have that attribute, I get that access.
51:11
In my mind that's what a back is because if a back was
51:15
provisioning time, that's really the 1st.
51:19
That's first rate RBAC. And, and the whole point of a
51:23
back really is to get finer grained and more dynamic, right?
51:26
So that speaks runtime versus admin time.
51:30
And I kind of like that dividing line actually, because if you
51:33
need to know a role at runtime, it's expressed as an attribute
51:37
and then you happen as an attribute.
51:39
So it's actually kind of clean. I think I like it.
51:42
I think that's clean. And so the third area and I may
51:45
be missing the boat on this, but P back to me this the difference
51:50
between AP back with A back or R back is it can work with data
51:57
that's outside of identity data. So in other words, here let me
52:01
give this use case example. I have a combined account value
52:09
of over $50,000. So I'm a high net worth client
52:13
and therefore I have access to the high net worth client
52:16
portal. That is not an identity data.
52:20
Nowhere in my identity profile or in, in some kind of, you
52:25
know, LDAP doesn't say what my account balances are, right?
52:29
Those might be in the data leak, but they're probably operational
52:33
data within some kind of banking system.
52:38
The feedback would have a policy of 50K or more give access.
52:44
So it checks the account balance table, it's over 50K or maybe it
52:49
hits some API or something like that, right?
52:51
And it says yes, you're in. So to me that's where the policy
52:55
back differs because it's using non non identity data.
53:01
Does that make sense? Does, I mean, you know, I,
53:04
there's obviously policy that is much more simplistic than that
53:09
and only relies on data that you have lying around in your old
53:12
app. But I think that being able to
53:14
mix in data from other sources and most particularly
53:18
environmental conditions, like my example is always phase of
53:22
the moon, like maybe there's more fraud at a full moon and
53:26
knowing that is you're just going to grab it from, you know,
53:29
I don't know the The Weather Channel something.
53:33
So so yeah, I would buy that. I think that they all can be
53:36
used in concert in a well thought out access control
53:41
system. And then then you have another
53:43
overlay where you ask questions like how close to least
53:48
privilege do we want to get? How do we measure that?
53:51
And are we going for a 0 standing privilege?
53:53
You know the new slogan where for my money, making decisions
53:59
about giving access should be easier to grant, easier to do
54:05
make because the consequences are lower.
54:08
They're for smaller amounts of access and you're OK if they
54:11
expire, the person loses access soon enough and they won't mind
54:17
having to ask again because the process is so so that that's
54:22
like a whole other level of sophistication that would
54:24
require probably all of the above.
54:26
And you know, including that that relationship based access
54:29
control where you're deriving policies from real world
54:34
relationships that could have other stuff, other important
54:38
decision making derive from them as well, not just authorization.
54:41
Yeah, that's real interesting. I, I started to think about
54:44
Reback and they don't know much about it, but it came came to my
54:48
mind that in the CIA M scenario, especially at B to B, it's like
54:53
Jim works for RSM Corporation. Our company has a relationship
55:01
with RSM, we have certain contract codes and XY and Z and
55:06
then based on Jim's relationship with that parent organization,
55:11
he inherits certain entitlements.
55:14
I mean, I know that's a very specific example, but to me that
55:18
relationship requirement has been around for a long time.
55:23
And, and the more dynamic you need to get about relationships.
55:26
Like I once worked with a customer back, one that managed
55:32
thermostats, smart thermostats in all the rooms of an office
55:37
building that had many tenants. So you've got like the energy
55:41
company and you've got, you know, the thermostat making
55:44
company and you've got the tenant and you've got the
55:46
building owner. And if a tenant is in one month
55:50
and out the next and they want access to the thermostats or
55:54
need to pay the energy bill for their portion or whatever, like
55:56
suddenly you've got this kind of API ecosystem that is extremely
56:00
fine grained and the relationships are changing fast.
56:02
So wherever those relationships kind of have a high velocity of
56:05
change, that's just a great use case for that model.
56:10
I'm not going to bring up this this topic completely because
56:14
Jeff's not here and he and I don't agree on it.
56:18
And you're probably going to ask, people are probably going
56:20
to ask themselves like you've been an identity for 20 years
56:23
and you're asking what is an identity?
56:26
But to me, you bring up that thermostat topic.
56:29
And to me it's like it brings the question of, OK, are those
56:33
thermostats identity identities? Maybe they have a credential,
56:36
maybe they have a certificate they log in with.
56:39
I think no, they are not identities.
56:42
I think they are devices or they are knows.
56:47
I don't think they're identities.
56:48
I think the person that they belong to, it's their identity,
56:53
but. My favorite topics and yeah, I
56:58
don't know. I don't.
57:00
Yeah, I think. We.
57:01
Can save it for another time. Yeah, we have to have Jeff here.
57:04
We have to prepare because we, you know, that would be
57:07
potentially, if we're talking about World War Three happening
57:10
again, that could be it. I will tell you though that
57:13
there's this whole non human identity conversation and it's
57:15
just zoomed up really fast. NHI, the first case of non human
57:20
identity that you know, I dealt with was I mean, in addition to
57:24
things like a lot of clients and yes, services and people talk
57:27
about workload identity, but IoT never seems to come up and it's
57:31
weird to me because you know, devices need unique identifiers
57:36
and they do need to have, you know, controllers who would be
57:38
human at some point when you go back for far enough in the
57:40
chain. So.
57:41
Are they identity? Exactly.
57:44
Yeah. You're great.
57:44
You're bringing up exactly. OK, So that's exactly where I
57:47
am. And then I think the the the
57:52
further or one of the other points you brought up is like
57:54
dust become hot and I'm like, OK, but that's been an issue as
57:59
long as there have been, there's been an Internet and as long as
58:02
there's been devices, which is forever.
58:05
And we don't talk about OT because I am very much and those
58:10
are topics that I want to explore at the podcasts and you
58:13
know. Maybe they'll have their day.
58:15
It'll be like the the whole Tulip bulb fever thing from
58:18
whatever it was the 14th century.
58:20
It'll have its day. Yeah, suddenly be very hot.
58:22
Yeah, absolutely. Well, I was disappointed to hear
58:25
you're not going to be at Authenticate.
58:28
So we'll, we're going to be doing some stuff with the
58:31
podcast at Authenticate. We're going to be part of the
58:35
keynote on Monday. We're going to get a recording
58:38
of that and drop it as an episode sometime this year.
58:41
So everybody gets to enjoy it, but it made me think also we're
58:46
going to San Diego. I'm trying not to gloat about
58:49
that too much. I'm excited about the, you know,
58:52
being out there. I love the weather and the
58:54
resort that the conference is. That is just super nice.
59:00
Have you, So this kind of the lighter note question is what's
59:04
the the last personal trip that you've taken and where'd you go?
59:11
Yeah, the last one was a kind of a long weekend, Labor Day
59:15
weekend in Vegas. So some people really hate Vegas
59:19
and they go there under duress, I think.
59:21
I think Jeff really likes Vegas. Every time I hear him talking
59:23
about, he's so excited and we just ran away to have some fun
59:28
and got to the sphere for the first time.
59:30
That was very impressive. Yeah, Yeah, I did.
59:35
And you saw Postcard from Earth, which is what I saw when I was
59:38
there. Yeah, I mean, here's my question
59:41
for you, because I didn't think I was going to have to do this,
59:45
but I had to keep taking my eyes off of the screen and looking
59:50
down at my feet because I would get almost like a what they call
59:55
that when you get like real dizzy.
59:58
Vertigo maybe? Yeah.
59:59
Yeah, yeah, that's how I felt. Like I felt almost uncomfortable
1:00:03
and it took me like only like 15 minutes and I didn't have to do
1:00:06
that anymore. But it's so immersive.
1:00:10
It's super immersive. I mean, there was, you know, not
1:00:13
giving anything away, I think. But you know, there's certain
1:00:15
times where they're they're in like the jungle with these
1:00:17
animals and they just appear like in your peripheral vision
1:00:21
and you really feel like there's a very large animal, you know,
1:00:24
standing over you, looking at you.
1:00:25
It's it's really wild. Do you remember I think the
1:00:29
elephant? Yes.
1:00:31
Gosh. I mean, the whole thing is what
1:00:33
we in the 70s would have called it Sensoround, right?
1:00:35
You know, there's all these experiences that they're adding
1:00:38
to just the visual and the audio.
1:00:39
And it was. It was pretty darn cool.
1:00:42
Well, shoot, I mean in the 90s we're going to laser light shows
1:00:45
and how low tech is that compared to what is?
1:00:50
I mean, so anyway, the elephant in that show, anybody who goes
1:00:55
to it will know what I'm talking about.
1:00:57
It's like you can see every wrinkle in its skin and they do
1:01:02
something with the sensory so that you maybe it's like the
1:01:05
smell that they bring in. You just feel like you're on
1:01:08
the. Smell and vision, yeah, there's
1:01:10
breezes, there's things they do. Yeah.
1:01:12
You do have to sort of anchor yourself in your seat to, to not
1:01:15
get sort of swept away. It's, it's quite, quite neat.
1:01:18
I will say, I was telling you earlier, there's one place that
1:01:20
I love to go when visiting Vegas and I didn't get a chance this
1:01:23
time, but I just have to tell people about it.
1:01:25
The the atomic testing museum, which is a little bit off Strip
1:01:28
to the east a few blocks away is really cool and historical and
1:01:34
interesting. And the gift shop is really cool
1:01:36
as well. So just imagine lots of things
1:01:40
with the atomic symbol on them. It's it's nice.
1:01:42
Yeah, I mean, I'm a Vegas fan. I think it's, it's when people
1:01:48
go to, the first few times they end up on the strip and they
1:01:51
stay on the strip the whole time.
1:01:53
I love going to the Fremont Street Experience.
1:01:57
To me, that's a, that's a real blast.
1:02:01
They felt like overhead, I don't know, some kind of vision thing
1:02:06
and there's a lot of conscious going on.
1:02:09
It's all free. And I think that's where a lot
1:02:11
of the locals go is when I've talked to the locals, they're
1:02:15
like, we don't go to the ship even for the restaurants,
1:02:18
because even for a weekend, yeah, you leave and you're bro
1:02:21
and. You know, Speaking of
1:02:24
personhood, you know, one of the senses I got from a Fremont
1:02:27
Street Experience because it's, it's dirty and messy and
1:02:29
whatever, but it's real. There's like a realness to the
1:02:33
people and I just appreciate. That, Yes, yeah, totally,
1:02:37
totally. Well, Eve, thank you so much for
1:02:41
doing this. Really appreciate having you on.
1:02:45
I'm going to close out the show now, unless there's anything
1:02:48
else that you wanted to throw out there that that comes to
1:02:51
mind. Thanks for inviting me back.
1:02:54
It is always a pleasure and I'm sending Jeff good vibes in his
1:02:58
circumstances and everybody who's been affected.
1:03:01
It's just really terrible. Yeah, good vibes for Jeff and I
1:03:05
know he'd be upset if I don't get this next part in which is
1:03:10
this is the show on www.idacpodcast.com or on X or
1:03:18
Twitter at IDAC Podcast. If you want to visit our YouTube
1:03:23
channel, and I really would appreciate that, go to
1:03:27
idacpodcast.tv or go to YouTube and search us up.
1:03:32
And you can also find us on Mastodon at IDAC Podcast at
1:03:37
Infosec Exchange and connect to us on LinkedIn.
1:03:41
Eve will have all of your information, the show notes.
1:03:45
I know that you're open to networking with others in our
1:03:49
industry. When you go out to our YouTube
1:03:52
site, please subscribe like this video with Eve, and then other
1:03:57
people will find it as well. For now, thank you everyone, and
1:04:02
we'll talk to you on the next one.
1:04:05
You've been listening to Identity at the Center.
1:04:09
We hope you've enjoyed the show. Make sure to like, rate and
1:04:13
review, and we'll be back soon. But in the meantime, hit the
1:04:16
website at identity@thecenter.com.
1:04:20
See you next time on Identity at the Center.