Latest / Identity at the Center / #270 - A Public Conversation About Privacy with Hannah Sutor of GitLab and IDPro

Transcript

#270 - A Public Conversation About Privacy with Hannah Sutor of GitLab and IDPro · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity at the
0:23
Center podcast. I'm Jeff and that's Jim.
0:25
Hey, Jim. Hey, Jeff, how are you?
0:26
Oh, not so bad yourself. Doing great.
0:28
I've been thinking about in advance of this episode.
0:32
I've been thinking a lot about privacy, thinking about, you
0:35
know, the privacy statutes within higher education and
0:39
within healthcare. And it's funny.
0:42
Usually when you start picking at those use cases, a lot of the
0:46
use case surrounds famous people.
0:48
You know you don't want to give out health records for famous
0:51
people or the class schedules for famous people.
0:55
And I was wondering, does that apply to you and me doing this
0:58
podcast? I don't know if I can because I
1:00
don't ever actually really went to college or higher education.
1:03
I think I have an economics class to my course or to my
1:06
credit. So if you're looking for my for
1:09
my records or my class schedule, it's gonna be pretty light.
1:11
I don't know about I I don't know.
1:13
I I I don't feel like that's something that should be
1:15
publicly available. But maybe that's just me, Some
1:17
people. Got out that you had high
1:19
cholesterol. I mean, just one look at me.
1:21
You probably already guessed that.
1:24
Well, anyway, I don't know. But that's, that's what was
1:27
going through my mind was, you know, the famous people thing
1:30
and what is the line between famous and not famous?
1:34
I think on the Identity at the Center podcast not famous.
1:39
Decidedly so. Netflix or on broadcast
1:42
television, that would that would make make you famous.
1:47
So you know that would be a a momentous achievement if like we
1:50
ended up as like a Netflix special, the making of identity
1:53
at the center and hopefully it's a positive story and not one of
1:55
those like, you know bizarre like Murder or we try to do our
1:59
own conference and ends up like Fyre Festival or something like
2:01
that it. Would be like identity at the
2:04
center is a joke. Yeah, that's what it would be
2:07
called. I did something yesterday and
2:10
usually you hit me with something.
2:12
I'm gonna hit you with something.
2:13
I did something yesterday that I've done in the past and went
2:18
and watched at a local brewery here in Asheville.
2:20
I saw UFC, Not the UFC that you're thinking of, but a
2:26
wrestling kind of thing. Obviously for show here in
2:30
Asheville they put together. I don't even know what UFC
2:32
stands for. It's like urban.
2:34
Universal Fighting Championship. Well, that's what most people
2:37
would know it as. But it's actually wrestling and
2:40
it's like a local Asheville, NC type thing.
2:45
And we went, and my wife and I went, got tickets paid $10 to go
2:48
watch a bunch of people have a good time in a in a ring set up
2:52
inside of a brewery. And so, you know, we're
2:54
watching, like, people come off the top ropes and, you know, the
2:57
fights and quotation Marks and the wrestling or whatever you
3:00
want to call it, spilling out, you know, along the sides of the
3:03
of the brewery ring and then into the brewery itself and then
3:07
outside. It was absolutely nuts, but it
3:10
was, it was a good time. I think you would have enjoyed
3:12
it, 'cause it was just kind of like, you know, stupid fun.
3:14
Yeah, yeah. I don't even know what to say
3:17
about that, Jeff, but I'd be surprised to find you there.
3:21
I'd probably be at the corner of the bar drinking and be like, is
3:23
that Jeff? Urban combat wrestling.
3:26
That's what it was. UCW.
3:27
No, I'm sorry. What did I say before?
3:29
UFC. Yeah, UFC, no UCW, urban combat
3:33
wrestling, but it was fun. It was like a, you know, Saint
3:36
Patrick's Day, you know wrestling thing.
3:39
And there were several chants that I cannot repeat here on a,
3:44
you know, show friendly for kids, 'cause we know I had a lot
3:47
of those kids tuning in for that I am talk.
3:50
But it was, it was a good time, you know, beers, burgers and and
3:54
wrestling. That does sound fun.
3:56
You know what would make it even more fun Was if you had a
3:59
discount code. If it was the best discount
4:02
code. If it was 100% off discount
4:05
code. Unfortunately, those things
4:08
rarely exist, but we got some good discount codes.
4:12
Yeah, we got Identiverse not 100%, but 25% off.
4:16
We have IDV 24-I D AC25 that gets you 25% off your
4:21
Identiverse registration stacks with early Bird.
4:24
So use early use often. Good way to show show support
4:27
for the show. Having a hard time talking
4:29
today. The words just aren't coming
4:30
out. May 28th, the 31st, it's at the
4:34
Aria Resort and Casino in Las Vegas.
4:36
I'll be there, you'll be there. We'll be doing podcasty things
4:41
to be determined. Our last episode is with Andy
4:43
Hindle. He says we're gonna be doing
4:45
podcasty things. I trust him.
4:47
I trust that we'll be doing podcasty things.
4:50
And that's the only thing is if if the past is any indication,
4:55
so where are you staying? Are you gonna stay at the Aria?
4:58
Yeah, I think right now I know you're trying to get me over to
5:00
the Vadara, but you know, it's like an extra like 10 or 15
5:03
minute walk from from there it's.
5:04
Like an extra 10 or 15 steps, but OK.
5:08
But I I'd have to go outside and you know, I mean I can stay.
5:12
I get my record is five days indoors in Vegas and I feel like
5:16
3 days is nothing for me. Yeah, there you go.
5:19
The other conference we've got going on is Identity Week.
5:22
We're actually gonna be at Identity Week America later this
5:24
year, but they also have Europe which is in Amsterdam, June 11th
5:27
and 12th. And the America one that Jim you
5:30
and I will be at is September 11th and 12th.
5:32
That's the one in Washington DC and Asia and Singapore October
5:36
22nd, 23rd. We have a conference code for
5:38
that one as well, IDAC 30 that gets you 30% off of that
5:43
registration and that code is good for all of the identity
5:46
work. Identity Week.
5:47
See. Told you can't talk today.
5:48
Identity Week conferences, not just the American ones.
5:51
So if you're in Europe or Asia and you're heading to Identity
5:54
Week, another conference code that you can use and hopefully
5:57
save a little bit of hard earned local currency insert
6:00
denomination here, whatever that might be for you and looking
6:03
forward to. That Yeah, fantastic discount
6:05
codes. So what's our main topic today?
6:07
Yeah, so I kind of joked as we were hitting by hit record here.
6:10
It's like, here's what I'm thinking is what we're going to
6:11
call the show, and it's a public conversation about privacy.
6:15
And to that end, we've got Hannah Souter.
6:17
She's the principal product manager at GitLab and an IDID
6:20
Pro Board member. Man, I am struggling today.
6:23
Welcome to the show, Hannah. Hey, Jim.
6:25
Hey, Jeff. It's great to be here.
6:27
Well, I'm the words are probably gonna come a lot better from
6:29
you, but let's talk a little bit about your origin story.
6:32
This is the first time you've been on our podcast and one of
6:34
things I'd like to do is find out identity origin stories.
6:37
How did you get into the wonderful world of identity and
6:40
access management? Is it something that you chose
6:42
or did it choose you? I think like most people, the
6:46
identity and access management world chose me, but I think in a
6:49
way I chose it as well, because after my first job and identity,
6:53
I chose to kind of keep going down the path of identity,
6:56
whereas I think I just as easily it could have pivoted elsewhere.
6:59
But I really liked the niche. I really like the people I
7:04
started to get to know. And I really like that it felt
7:07
to me it feels very important in terms of, you know, you're kind
7:11
of protecting an ecosystem, you're protecting people's
7:14
information, you're protecting potentially proprietary
7:17
information. And so I think there's a larger
7:19
meaning behind it, which is part of the reason why I think I
7:21
chose it. My first job in Identity so I
7:27
was a developer way back when and eventually I started asking
7:31
too many questions about why are we coding this and can I talk to
7:35
the customer and are they happy with this or what do they think?
7:39
And they're like you might like products.
7:42
Most most of our developers don't ask this these kind of
7:44
questions, so I ended up switching to product about 8 to
7:50
10 years ago now. I've been there since and I was
7:54
in developer tooling at one point just because of my
7:58
developer background. So I worked mainly product
8:02
managing developer APIs for a cloud platform and then one of
8:07
the services that I inherited as part of the cloud platform was
8:11
Identity. So it started as kind of a
8:14
fraction of my job, and then the next role I ended up getting,
8:17
they saw my Identity experience at the 1st place.
8:20
They said we need someone fully in Identity.
8:23
And then now I'm on my third sort of foray into Identity,
8:28
specifically devoted to it now at GitLab.
8:31
So I mentioned when I introduced you that you're a Principal
8:33
Product Manager. And I think for one of the
8:36
things I find really interesting about the identity field is the
8:38
variety of roles that we have. Can you talk a little bit more
8:42
about that role of a principal product manager, take us through
8:45
sort of like your day-to-day looks like a normal week for you
8:48
or are they all different? You know, kind of shed some
8:50
light into that role? I product is really varied,
8:54
which is part of what I like about it.
8:56
So day-to-day I work with engineering counterparts.
9:00
I have about six or seven engineers I work with.
9:03
I have an engineering manager I work with.
9:06
I also work with other product managers.
9:10
I've talked to customers a lot, at least a few times a week in
9:14
customer meetings. These usually originate with
9:17
sales or customer success. If a customer has a question
9:20
about user provisioning in GitLab or, you know, how do I
9:24
most securely authenticate? Personal access tokens seem like
9:28
the wild Wild West. Should I turn them off or what?
9:31
I so it's a lot about security honestly and keeping what's the
9:36
best way that people can keep their GitLab instance secure.
9:40
Of course I handle you know this doesn't work the way we expected
9:44
or we need this extra logging information to make this really
9:47
much more robust. And one of the bigger projects I
9:51
did recently was we had gotten a ton of customer feedback that
9:55
our static roles and permissions that we had built in were not
9:59
sufficient anymore. People were having to grant too
10:02
much privilege just for like one small permission.
10:06
So we knew we had to make our model more flexible.
10:08
So we did a deep dive. Technically, my engineers did
10:12
that in terms of how could we take our current authorization
10:16
model and really rip it apart and make it something that
10:20
customers can build from the ground up and only grant the
10:24
amount of privilege necessary to accomplish a certain task rather
10:28
than to have to assign roles out-of-the-box.
10:32
So that's been something I haven't had the opportunity to
10:34
do before any other job. That's, I think that's kind of
10:37
the power of the product manager, right?
10:39
Being able to sort of inflict your desires and what you're
10:43
hearing from customers, right? Say, hey, these are the features
10:45
that we want to put in there, which I find a little bit of
10:47
empowering. Maybe maybe it's just me, but
10:49
it's like, hey, it'll be a neat idea if we could do this.
10:51
And you've got like the ammunition from like, yeah, the
10:53
customers are saying they want this, like we should be doing
10:55
this, right? Yeah, it's about customer
10:58
interest and then you know also revenue, right?
11:02
That's a powerful story to be able to tell if there's perhaps
11:06
identity or authentication related feature, we can tier to
11:09
a more expensive tier of our product and try to get more
11:13
revenue in the door. That's really powerful.
11:15
The security and compliance use cases usually tell a powerful
11:18
story. But the one thing about being a
11:22
product is that, you know, my engineers are my peers.
11:24
I'm not, I'm not their manager in any any shape or form.
11:28
So you do have to get their buy in.
11:30
And what I always tell them too is I want you to push back on
11:34
me. It's like my least favorite
11:35
teams that I've worked with are ones that just take whatever I
11:38
say and go execute. I'm like, no, I want your
11:41
pushback. If there's something that you
11:42
know is going to take a really long time and it's a ton of
11:45
effort, maybe it only delivers, you know, 5% of what we need.
11:49
I'm open to skipping that, you know?
11:51
So I really like engineering teams and the collaboration that
11:54
goes on with a strong team of engineers.
11:56
I also introduced you as a member, actually a board member
11:59
of ID PRO. Can you talk a little bit about
12:01
that role? What are you working on from the
12:03
ID Pro perspective? And I guess just for Full
12:05
disclosure, right, I'm a member, Jim, you're a member.
12:07
I also serve on a couple of different committees for like
12:09
CID Pro and the nomination committee for board members.
12:13
So I remember seeing your name on that list a couple years
12:16
back, but tell us a little bit about your role with ID Pro.
12:20
Yeah. So being on the board of ID Pro
12:22
has truly been an honor. I never thought that board
12:26
member would be, you know, on my resume.
12:28
So it's been, you know, hugely encouraging for me that others
12:32
believed I I was capable enough. ID Pro.
12:35
We are a a network and a certification body for identity
12:40
professionals. I found out about ID Pro because
12:44
my roles in Identity, I've been sort of the lone soldier of
12:51
Identity expertise in addition to my engineers, but more from
12:54
like a product or a business side.
12:56
I've never worked for an Okta or a company where Identity is the
13:00
product. I've always worked somewhere
13:01
where Identity is part of a bigger product, right?
13:05
And I think there's a difference there.
13:06
And you can start to feel like, well, do I really work in
13:08
Identity if, you know, I, I've never worked for one of the big
13:11
names of the booths that you see at Identiverse.
13:15
But I think a lot of companies have, you know, every product
13:21
has identity in it, some more customized or home grown than
13:25
others. And there need to be people that
13:27
oversee that. So I think there's plenty of us
13:29
out there, but I was struggling to find them and that's when I
13:31
found ID Pro and was really excited about, Oh my gosh,
13:35
there's actually hopefully going to be people here that I can
13:38
talk shop with and I won't feel like the only one.
13:41
So that's when I joined ID Pro. And being on the board, we work
13:46
together in a team as the board. We kind of set our yearly
13:50
strategic initiatives. We kind of decide, you know,
13:54
this is who we are. This is our value proposition.
13:57
Here's what we want to provide to our members so to make sure
13:59
they're getting benefits out of their membership.
14:03
And we kind of do strategic initiatives for the year.
14:07
And then we, along with our Executive Director, Heather
14:10
Flanagan, execute on those priorities.
14:13
We check in on them every month at a meeting.
14:17
And one of the things I'm excited about that we've done so
14:20
far this year is I think a huge part of our value prop is our
14:24
Slack. And I would have never been one
14:27
to be like, Oh yeah, like really excited about a Slack network.
14:31
But I can't even tell you to be able to pop a message on Slack
14:35
in one of the channels, ask a question and then you know get
14:40
get the author of the SAML standard to reply to your
14:43
message. And then ten other people who
14:45
are have years and years of experience implementing these
14:48
technologies. That alone is worth the price of
14:51
membership I think in in one Slack chat.
14:54
And it's the more active you are, the more you get back.
14:57
And so our history used to only last, I think for 90 days and we
15:02
recently upgraded our Slack plan and we can now have historical
15:06
knowledge and and have all of those conversations that have
15:10
been so valuable and now they're searchable, you can find them.
15:12
And so I think that's one of the things I've been excited about
15:15
so far this year. Jeff and I couldn't agree more.
15:18
I mean, we're both ID Pro members.
15:21
We talk about the Slack channels, like the number one
15:23
benefit because not only can you benefit from your question, but
15:28
Jeff and I can benefit everyone as an ID Pro member can benefit
15:33
from your question and all the people who wrote responses.
15:36
I also think one of the great things is like, sometimes you
15:39
get these questions that kind of stir the pot.
15:42
And I get the sense that you like to stir the pot a little
15:45
bit too. And that was kind of one of the
15:47
things you wrote in the December newsletter for ID Pro, an
15:53
article called Privacy is a Human Right.
15:56
I thought that kind of stirred the pot a little bit.
15:59
Wonder why did you say that? Privacy has been super important
16:04
to me over maybe the past year and a half.
16:08
I remember it identivers, I guess it was three years ago,
16:11
probably back when it was in Denver and we were all wearing
16:14
masks. I heard.
16:15
I just went to Jamie Danker's talk Introduction to Privacy and
16:21
I remember just like scribbling down notes and being so
16:23
interested in this topic that I went back home and I it kind of
16:30
jived with some things, actually.
16:32
My friends, you know, like non-technical folk, my friends
16:36
who I sit down and watch. We have a group that watches The
16:38
Bachelor when it's out. We get together once a week and
16:43
we watch it together and they would always be like, you know,
16:46
you work in tech. Like is my Alexa listening to
16:48
me, like, why did I look at that toothpaste at Target?
16:51
And then it started getting an ad for it like is, are things
16:55
spying on me? And I realized, like I I don't
16:58
have a great answer for that. And yeah, I've worked in tech
17:00
forever and it's weird. And so I'm going to start to try
17:05
to understand that and share my learning along the way.
17:09
So that's really how my interest in privacy came about in terms
17:14
of sharing it with others. I wanted to do a very low
17:17
barrier way to share, so I started an Instagram account.
17:21
But yeah, that's where. So my interest in privacy has
17:24
blossomed over the past year and a half or so, leading me to
17:27
write that article. Because I do think identity and
17:31
privacy are interlinked at this point in our journey as a
17:35
species that lives a lot of their lives online.
17:38
So I was really excited to write that.
17:41
Yeah, yeah. And I think my whole point on
17:44
like questions that kind of store the pot is more that
17:47
different people can end up on different sides of that issue or
17:50
find themselves. And I'm going to bring up a
17:52
topic that I think is one of these topics, but I think it's
17:55
OK. I think it benefits us all to
17:57
have those conversations, hear both sides of the argument and
18:01
then figure out which one we align with.
18:03
As I know this one, this next question that I have for you is
18:06
something that not everybody agrees on, maybe not everybody
18:10
has formulated an opinion on, But I mean, we hear about, you
18:14
know, the Internet was created without an identity layer and
18:18
that was the big mistake. So it's kind of like, well, had
18:22
there been an identity layer in the Internet, all of our
18:24
problems would be solved. And I don't think that's
18:27
necessarily true. I think we're also moving toward
18:30
different ways to have more of our identity able to be enabled
18:34
on the Internet. My question is, do we have a
18:37
right as humans to be anonymous on the Internet?
18:40
I think out of all the questions we talked about today, let's
18:43
still be the one I'm most fuzzy on.
18:44
My answer on right? But this should make for a good
18:47
discussion. I think I would lean more
18:50
towards your right to have anonymity on the Internet than I
18:55
would on, you know, every single thing should be tied back to
19:00
your identity. I think that people are fooling
19:06
themselves, quite frankly, if they think they can be anonymous
19:09
on the Internet. And I know that sometimes if
19:13
people put enough up, enough blockers, VPN, whatever, they do
19:17
everything right to. Yes, you can maybe be anonymous
19:21
on the Internet. And I I think there's a a tough
19:25
line here because you know, I think about all the bad things
19:28
that can happen on the Internet that people are much more likely
19:31
to do if they know I can be anonymous, right.
19:36
But I also think that potentially, you know,
19:40
exercising your right to free speech, if that's tied to your
19:43
identity and the wrong party gets a hold of that data, what
19:45
could possibly happen? I I really do worry about if
19:50
everything is tied to This is Hannah, which a lot of it is,
19:55
right? Even like what we watch on our
19:57
smart TV's, they know it's me. I worry a lot about the fact
20:04
that our worlds are so influenced by what we see.
20:09
The ads we see, the order things are shown in the news articles
20:12
were shown. Everything is influenced by
20:15
like. Here's what we think Hannah
20:16
wants to see, here's what we think she's going to click on.
20:19
And so I think it's really hard to get an unbiased view.
20:23
And that is my concern with not being able to be anonymous on
20:27
the Internet, is that there's no way to get out of this sort of
20:29
like tunnel vision that's created for you by by the
20:34
algorithm. What do you?
20:35
Think well, tremendous point. Let me kick the Jeff first.
20:39
It's like anything else. It's a tool and there are good
20:42
and bad when it comes to a non anonymity and privacy and being
20:47
able to, you know, tribute things to people.
20:50
I don't have the answer, that's for sure.
20:52
I mean I my, I'm man. I cannot talk today, man.
20:56
Context switching all the time. Things that I want to be
21:00
private, things that I don't care and things that I can't be
21:03
private about because they're required by law.
21:05
I have a driver's license, or I have to pay a bill, or I have to
21:07
do XYZ right? Or maybe I think having the
21:12
option to toggle that flag is important.
21:14
I don't know who controls that flag though, because I don't
21:17
think it's something that can be on the hands of the user 100% of
21:20
the time, the same way that it can't be in the hands of the
21:24
service 100% of the time. So I think it's kind of like
21:27
this wishy washy consulting depends answer.
21:30
And I don't know if we have a good infrastructure from an
21:32
identity perspective to be able to enable that broad of a
21:36
thinking because right now for the most part, we're all using a
21:39
variety of different identity providers and services and
21:42
things like that to log in. And if I look at my, you know,
21:45
my password wallet, I probably have a 1000 different IDs in
21:48
there. How am I supposed to manage
21:49
privacy without some sort of centralized tool to do that?
21:52
Who's going to management and would I trust the person
21:55
managing that or the persons or the company managing that to not
21:59
do things with the data that I might potentially put into that?
22:01
So I don't know where to go with it, but I I see both sides of
22:05
the coin and I think there needs to be some flexibility there
22:07
somehow. I'm not smart enough to solve it
22:09
though. What do you think, Jim?
22:10
Well. I think Hannah brought up a a
22:12
fantastic point, which is do you really think you can be
22:16
anonymous on the Internet? That might raise the question,
22:20
But here's kind of my concern is if you took away the ability to
22:24
be anonymous, you might get away from people who are human rights
22:31
activists in countries where you don't have the right to free
22:34
speech. Right.
22:35
And where these things are tremendous threats.
22:38
And if, you know, the government finds out who posted that, that
22:43
person might not live another day.
22:46
So yeah, I think it's important. I think it's, you know, at the
22:50
state of where our society is today and it's too easy to get
22:53
trapped into. OK.
22:55
In the US we have like online bullying and like believe me
22:59
that's where I would love to just take away anonymity but at
23:03
the same time I think there's other issues and and how the the
23:08
evolution of the of the world needs to happen in terms of you
23:12
know oppressive regimes or you know etcetera etcetera.
23:18
The the those things trump, you know, issues that the other
23:24
issues I guess because it look, it's not a black and white
23:27
issue, but I think I fall down on the side of we need to have
23:31
anonymity on the Internet. And I that's why when I hear
23:34
like, OK the Internet was built without an identity layer, I
23:38
think OK, I can agree with that to the extent that there there
23:42
still could be anonymity. All right.
23:45
Next question for Hannah. And I think that was a good one,
23:48
right. And that might have been the
23:49
hardest one, but I'm wondering like, so Hannah, you talked
23:53
about privacy as a human right. And I'm wondering is an
23:57
inalienable in now it's going to be my turn to not be able to
24:01
speak in in in inalienable right.
24:12
In other words like a God-given right or is it based on or
24:16
depend on where you happen to be or where you live or where
24:19
you're from. So in other words, like, is it a
24:22
human right in the United States?
24:23
But if you're in North Korea, you don't have that human right.
24:28
Well, I think that's certainly the way it is right now.
24:32
I mean I don't even think that we have, we don't have any, you
24:36
know, legislation here in the US that does make privacy a human
24:40
right. That's why I felt like, you
24:41
know, worldwide this is still just very much in its infancy
24:45
and that's why I wanted to bring it up in the, in the article I
24:47
wrote. In my opinion, it is an
24:50
inalienable right. It should not be available to
24:53
certain people. I've seen a trending towards,
24:56
well, we're going to, you know, if you want to use a certain
24:59
social media platform and you want to use it with more privacy
25:03
controls, then you're going to have to pay a certain amount a
25:05
month. And then anyone who can't afford
25:08
it gets, you know, their data, you know, taken away and sold to
25:13
brokers. And I don't think that's right
25:15
either. I don't think it should be
25:16
something that only people with a certain financial privilege
25:19
can afford. So I feel pretty strongly on
25:22
this one that it should be an inalienable right.
25:24
I just think that we're far away from that.
25:27
What do you think, Chuff? Again, depends, I think are you
25:32
know, are we saying that you don't have the right to privacy
25:34
as a consumer or as an enterprise worker or in what
25:37
context? I would say, again, it's not
25:40
black and white. Some contexts I do not have that
25:43
right. I need to be, you know
25:45
accountable for whatever actions I take.
25:48
And there are other situations where you know, I I can't or I
25:51
shouldn't be to preserve physical security or emotional
25:55
or mental security, right. Things like that.
25:58
I I, I don't, I don't even know. I don't know how to answer the
26:00
question because I think it's against that contact switching.
26:02
And Hannah, you keep throwing me for a loop here and say, OK,
26:04
well, I agree with that. I don't agree with them.
26:06
So wait a second. Which context are we talking
26:07
about here? You know, how do we, how do we
26:10
even think about something like this where, you know, we're very
26:12
fortunate the three of us live in the United States and we're
26:16
able to have a certain amount of free speech.
26:18
Not every person has that benefit or that luxury, and that
26:23
has varying degrees of repercussions depending where
26:26
you're at in the right How do you protect somebody?
26:28
Yeah, and I think even just thinking to my day job at
26:31
GitLab, right, it's another context specific thing.
26:34
Because if you want to push, you know, code changes to production
26:39
for example, we're gonna need a very high level assurance that
26:43
you are who you say you are. And maybe you have to go through
26:45
several step up authentication methods to prove, hey, that's
26:49
actually Hannah behind the keyboard.
26:51
And the further those go, the less privacy perhaps you could
26:56
say you have. But it's all a trade off, right?
26:59
It's like, is it worth it to have the level of assurance to
27:02
do a potentially destructive action?
27:05
Yeah, I kind of feel like there's certain privacy that is
27:10
a human right. I think that you can put
27:14
yourself in certain situations where you give up privacy.
27:20
So for example, you walk into a store, it's a privately owned
27:24
store if they are doing some kind of eye or they're watching
27:29
your eyes in terms of like what you're looking at and then
27:33
feeding that information to a third party.
27:36
But here's where I think it breaks down.
27:38
If you're doing those things and the person doesn't know you're
27:41
doing those things, I think that's where it should break
27:44
down. You know, and I think that's the
27:47
problem with like, privacy policies, for example, is like,
27:50
OK, if I'm going into a store and they're scanning my face and
27:55
saying, oh, there's Jim McDonald and, oh, he looked at the Crest
27:58
White strips. And now we're going to sell that
28:01
information back to some marketing firm and we're going
28:04
to tie his e-mail address to it. And we're just going to start
28:07
and they're going to do whatever they want to do.
28:09
Now they know he wants Crest or he's interested in Crest white
28:12
strips and they're just going to start spamming him or something.
28:16
I don't think that's right. So that that's kind of where I,
28:19
I I think if people understand what they're getting into.
28:25
But I also think that the counterbalance to that is that
28:29
sometimes like, oh, you know, if like you go to the airport,
28:32
we're going to start like, you know, scanning your face and
28:36
knowing who you are as you're walking through the hallways or
28:39
if you're on a public St. we're going to do those things.
28:42
So we're always going to know where you are at any given time.
28:44
I don't think that's, you know, if even if you know that's
28:48
what's happening, you don't really have a choice of not
28:51
walking on the streets. You know, what are you supposed
28:53
to do to go live in the woods? Yeah, exactly.
28:57
And I that's one of the things as I've been sort of talking
29:00
about privacy in public that I've tried to be very clear on
29:04
is that it's not all or nothing, right.
29:07
Just because you you like you can share your photos on
29:11
Facebook, right? But just understand what the
29:14
implications of that are and maybe it's worth the trade off
29:17
to you, right? Like maybe it's, you know it's
29:19
really convenient to share the photos of your kid with the
29:21
grandparents on Facebook. But hey, maybe you should make
29:24
sure they're at least private, right.
29:25
So there's like a balance, and it doesn't have to be all or
29:28
nothing. And just because you use a
29:31
certain platform doesn't mean that it's all a lost cause for
29:36
your privacy. And oh, what does it matter?
29:37
They can know everything about me because, you know, that's
29:40
fine. I'm boring, right?
29:42
It's like the common, you know, who cares?
29:45
But I think, I think it can get potentially hairy, right?
29:48
We were talking about walking into stores.
29:50
You're looking at white strips advertising it to you.
29:54
Yeah, that seems fairly benign. And I, some people even love
29:57
those targeted advertisements. Like, yeah, I wanted to buy
30:00
that. So thanks for reminding me.
30:02
But what I'd be worried about is, oh, let's, you know, oh,
30:06
gosh, Based on her last visit six months ago.
30:10
Yeah. She's gained weight.
30:13
What does that mean about her health?
30:14
Right. And can we combine that with
30:15
some other records from an online therapy place that's
30:19
gotten hacked? And now we can tell that, you
30:22
know, I postulate that a certain thing is going on.
30:24
And now my health insurance company knows, and they that's
30:28
what I worry about, is kind of like a next step into how this
30:31
could go wrong. Yeah, I can see that, Jeff, your
30:33
love of chicken and waffles is causing your your cholesterol to
30:37
go up, right? Things like that.
30:42
So Hannah, you had mentioned about the Amazon election,
30:46
whether or not it's listening to you.
30:48
And I've had conversation with people, so I don't really have
30:51
the inside information. We did have a guest on the the
30:54
show at one point who's like, absolutely, it's listening to
30:56
you and I, here's the the dots that I've connected.
31:00
It's like, does it require some human being to sit there and
31:03
listen to what you're saying? No.
31:06
With artificial intelligence, they can do speech to text, load
31:09
that into some big data database somewhere and like just scan
31:14
through it in seconds, right. So I think it definitely could
31:19
be. Whether or not it is, I don't
31:21
know. I don't think we know for sure.
31:23
It is the person who mentioned that was not speaking on behalf
31:25
of Amazon. So if you're Amazon listening,
31:27
don't sue us, we don't know. But the same thing applies for
31:30
any of these services, right, That has a Voice Assistant And
31:33
it just seems like the correlation of different points
31:36
of data is what's taking place. And they think about Jim,
31:39
earlier you said choice. And I think that's one of the
31:41
big parts of this is if you're walking to a store to get Crest
31:45
White strips, we'll just stay with that thing and you don't
31:48
have a choice. It's the only place that you can
31:50
go to sell it. And the only way you can buy is
31:52
by going in and giving up your information.
31:56
In this case, is that really where we want to be where you're
31:59
in a position where you only have, you don't have a choice.
32:02
Essentially this is the way you have to do that versus maybe
32:05
there is an alternative method, right?
32:07
Maybe you have to drive an extra 2 miles to get to a location
32:10
that doesn't do that. You made the decision to go into
32:13
that private enterprise that theoretically told you what it
32:17
was doing. But we had a conversation with a
32:19
few weeks ago with Laura Gomez Martin and from our team here
32:22
about privacy. And I kind of got on her case a
32:25
little bit not, you know, not mean or anything, but these
32:29
Eulas that we see out there, it's buried in, you know, walls
32:32
of wiggle texts, and you really don't have a choice.
32:35
It's really the only viable option.
32:37
Are you gonna drive 45 minutes extra to get Crest White strips
32:40
or milk or bread or gasoline or X thing?
32:45
If you don't have the choice, then I think we run into issues.
32:49
And then the correlation of the data that's being collected, I
32:51
think is the other problem point.
32:53
So yes, you might have all these different, you know, points of
32:56
data, but until they're correlated, that's what truly
32:58
makes it powerful. And that's what concerns me is
33:01
some of these situations where it's like, oh, I know I visited
33:03
this website over here. Of course there's a cookie.
33:05
It tracked that I went to this other website and then I visited
33:09
a physical location and then I drove my car somewhere and my
33:11
phone knew where I was going because I wanted Google Maps to
33:14
run. You put all that stuff together
33:16
and guess what? Now you've got correlation of
33:19
data that can be potentially extremely damaging or
33:23
potentially extremely helpful. Hey, I get an e-mail every month
33:26
of my Google travels. I traveled this many miles
33:29
around the world and I went to these locations and my photos
33:31
are Geo tagged. I love that.
33:33
Do I love the fact that it could be used for other purposes?
33:36
No. But that's that's where we are
33:39
right now. Right.
33:40
And it would be nice and perhaps there is this, I don't know, but
33:43
if you had some granularity and being able to opt out on the
33:48
Google front, it wasn't just like a mass all of my
33:51
information from maps and use it.
33:53
It would be like, oh, how nice would it be if I could get the
33:56
check box that showed me my Pretty Little map.
33:58
But then I didn't have to let them, you know, package it up
34:01
and sell it or whatever they do with it or target me with ads
34:04
for it. So I think we have a ways to go
34:07
in offering better privacy controls to consumers.
34:10
Yeah. My feeling also when it comes to
34:12
human right, we can't look at like, here's how it is, You
34:16
know, we have HIPAA laws in the United States, maybe in Mexico
34:20
or in Canada. They're different.
34:22
Maybe, let's just say they're lesser.
34:23
I don't know, they might be stronger.
34:25
But let's assume that for the sake of argument, they're
34:28
lesser. I think when we talk about a
34:30
human right, we should be talking about the way it should
34:33
be, right. And when we're, we use Crest
34:35
White strips as the example, it's kind of an innocuous
34:38
example. But if you were to go and get
34:40
some kind of medical procedure done or you're buying like birth
34:45
control or something, that it's just nobody else's business,
34:48
right? And you don't want that
34:50
information to become public or you don't want some insurance
34:54
company to use it to say, oh, we're going to deny you
34:57
insurance because you had this procedure, you have a shorter
35:02
lifespan or you have some kind of disease or here's another
35:06
example, You get your DNA worked up, right?
35:09
And you want to know for yourself, OK, am I likely to
35:14
more likely to catch these diseases or whatever, You don't
35:18
want that information to become public.
35:20
You don't want that information to be sold.
35:23
So to me it's the human right pieces about how it should be,
35:27
not the way it is. Yeah, totally agree.
35:30
All right. Let's shift topics a little bit
35:32
because I think we've started to talk about this, but maybe not
35:35
head on. And I think it's just that
35:37
expectation of privacy as an employee.
35:39
I think so far we've been talking about this maybe more
35:43
from a consumer perspective. Typically, we're not a captive
35:46
audience, right? We do have choices for the most
35:48
part. But if you're an employee, you
35:50
may not have as much choice. What are my expectations of
35:54
privacy as a employee and how might that be different from the
35:58
consumer side of things? What do you think, Hannah?
36:00
I think your expectations as an employee go down, right.
36:05
I have found that anytime I'm employed, I'm given pretty
36:09
thorough policies to sign off on that says, hey, you know, here's
36:14
if you're working on the work computer, here's what we're
36:17
recording about you or could in theory record about you.
36:21
So I think it's been at least pretty transparently disclosed.
36:26
Hopefully that's the case for others as well.
36:28
But I do think when you're an employee you have a lot less,
36:34
you need to have a lot less expectations And again, you
36:37
know, balancing sort of privacy and security, a lot of these
36:41
things are kind of, you know, given under the well, we need to
36:46
know exactly what our employees are doing for security purposes.
36:50
And that does certainly have merit whenever you're dealing
36:53
with, you know, intellectual property and keeping it sort of
36:57
within your company's ecosystem. So I guess my personally my
37:02
expectations as as an employee are pretty low, but at least I
37:05
feel like I know what I'm in for.
37:06
What What's been your experience?
37:09
I'll add my my thoughts on it. My concern is that you know IT
37:15
administrators are the ones who have access to your
37:20
communications, at least your electronic communications.
37:23
And my concern is, is like, you know, what if the IT
37:27
administrator says, oh, I'd like to start reading Hannah's
37:30
emails. Oh, she's having a a argument
37:33
with her spouse or something like that.
37:36
And you know, like somebody goes and abuses that.
37:39
I absolutely think that is not acceptable.
37:42
But I do think that the company has the requirement to watch for
37:48
certain things that you're not exfiltrating the company's data
37:52
or you know doing other things that is like corporate espionage
37:57
kind of stuff. But it it I think it stops right
38:01
there. And I think that if the company
38:03
is going to put itself in that position, then it's required to
38:09
make sure that that data is not being abused.
38:11
Otherwise, it sets itself up for potential lawsuits.
38:15
Well, I think this is an area though where most companies
38:17
would have a policy statement somewhere that says, look, this
38:20
is company property. You know, we may allow some, you
38:24
know, adjacent use for convenience and things like
38:26
that. But you know, if you're using
38:27
your work e-mail to do it, all of your transactions, that's on
38:31
you as the end user really not understanding or not adhering or
38:37
even thinking about that type of privacy.
38:39
So what is the responsibility of the individual to say, oh, I
38:42
should probably have my own e-mail account to do this and
38:46
not do everything through my atwork.com e-mail address,
38:50
whatever that might look like. Now if an IT person is snooping
38:54
my traffic, they're running Wireshark and they're putting
38:56
together packets and doing things to get into my e-mail and
38:59
my personal e-mail. Again, bad situation, but my
39:02
responsibility as to myself would be of course I'm not gonna
39:06
use my work account for that kind of thing, but there's lots
39:09
of people who do. I have been in those situations
39:12
from a security operations standpoint, doing the forensics
39:14
analysis and people do dumb stuff all the time.
39:18
I think it's gotten better probably or at least more known.
39:20
But it does happen. You know, you get the the
39:22
occasional e-mail, always sent it to the wrong address or you
39:25
know you're in your address book of my work address, some
39:28
personal address and you know, maybe there's some some you
39:31
know, weird thing that goes to 1 address and not the other.
39:33
But you certainly hope you fix that in subsequent threads.
39:37
But I think there is some personal responsibility when it
39:39
comes to the usage of a company, resources and understanding.
39:42
Like, OK, yeah, like the organization, this belongs to
39:45
them and they could do something with that data if they wanted
39:48
to. And they have every right to do
39:50
that. It is their property.
39:51
Hannah, what do you? Think, yeah, I think that's very
39:52
well said that there is a responsibility there on the
39:55
employee side. One thing I'm curious about,
39:59
Jeff, since you mentioned your sort of forensic background
40:03
there. What I've always wondered on
40:06
using a work computer for encrypted things like iMessage,
40:10
right? Can your company still read
40:12
that? I'm honestly not sure.
40:14
There are ways to get around it now.
40:16
It's been 15 years before I message was around that I was
40:20
doing this type of stuff, but there are still ways to do that.
40:23
To break the encryption on it. You typically need the device or
40:27
at least a forensic copy of the device to do that.
40:29
But I don't want to like say yes or no as of now, because the
40:33
last time I did it we were still using Lotus Notes for e-mail.
40:37
So that just goes how far back it was.
40:40
Yeah, OK. There's also situations where,
40:43
like on your desktop hard drive, you might have your W twos or
40:49
other kind of tax forms that you downloaded from the the
40:54
company's HR portal, so there's ways that people could access
40:58
that. I guess your point though is
41:01
well taken. I can see why companies say
41:04
don't use your personal device for any personal stuff.
41:08
Yeah, 'cause they don't want to be responsible for it, and maybe
41:10
it's they don't care. They're trying to protect the
41:12
users who maybe just don't clean up after themselves.
41:15
A a company device to me is a public portal.
41:18
I wouldn't do anything on my corporate computer that I
41:21
wouldn't do at a kiosk, in a library or, you know, whatever
41:24
it may be. Not that I would ever use any of
41:26
those. But that same idea right?
41:28
Of this is not a a trusted device for my personal
41:32
information, that kind of thing. Yeah, I completely agree.
41:36
I think that's I think people should be careful and and you
41:39
know be judicious with what they do on their on their work
41:42
computer for sure. There's another saying out there
41:45
that if you aren't paying for a product, then you probably are
41:49
the product. And this is one that I I
41:50
definitely believe there is some truth to and I point back to my
41:53
own experiences. I don't pay for Google.
41:55
Well, I do, but not not the services I use like Google Maps
41:58
and things like that. So they're clearly collecting my
42:02
traffic information, right, to make sure that traffic, you
42:06
know, they can show the green line or the red line in Google
42:08
Maps. And I'm sacrificing that bit of
42:11
privacy to enhance the map, the map application.
42:15
My benefit, no, can't talk again.
42:18
My benefit from it is I don't have to go to you know a AAA
42:22
store and buy a triptych to do a cross country, you know, journey
42:27
like we have to, you had to do like 20 years ago.
42:30
Do you believe in that statement?
42:31
Does that make sense that if you're not paying for a product,
42:34
then you probably are the product and meaning that your
42:36
data is probably what's being used?
42:39
Absolutely. I think I've said this to my
42:42
Instagram audience and I've put it in a lot of the content that
42:47
I've written as sort of a principle to keep in mind,
42:50
right, that nothing is free. You are giving up your data in
42:53
exchange for a service. And I think as long as you
42:58
realize that and you're OK with the trade off, then fine.
43:03
But it's the fact that the it's so opaque to most people and
43:07
they don't realize exactly what's happening or they they
43:10
know some data is being collected.
43:12
But you know, there's the small text about, oh, it may be shared
43:14
with third parties. And then before you know it,
43:17
your data is replicated copy after copy with data brokers.
43:20
And it's basically impossible to peel back at that point and
43:24
regain possession of. So I agree that if you're not
43:29
buying it, you are the product. I've tried to get away from
43:37
certain things as best as I can. It's really hard to untangle
43:41
yourself from some of these products like Gmail for example.
43:46
I moved over to Proton e-mail address, which I pay for.
43:51
They have a very transparent privacy policy that they're not
43:54
selling your data, but it does. It costs more than even like a
43:59
Google Business account. And you have the pain of, like
44:03
most people don't know me at that e-mail address.
44:05
So do I I can I ever actually get rid of my 10 year old Gmail?
44:09
Probably not. So it's a very powerful, sticky
44:13
thing. And it's, I don't want to act
44:14
like it's, you know, easy. Oh, just switch to all the, you
44:16
know, privacy products because again, you have financial
44:20
barriers. There's usability barriers.
44:23
I'm not familiar with those. For example, I use Google
44:26
Photos, right? I know they're scanning
44:29
everything about those photos. They I take a picture in the
44:32
kitchen, they probably know what's in my pantry door that's
44:34
open, right? But I'm willing to live with
44:38
that because it's easy to use, it's easy for me to share things
44:42
on there. So I think as long as you're
44:44
understanding the trade-offs, I think it is what it is and
44:48
you're definitely the product and maybe that's OK.
44:51
I mean, I think understanding that trade off is probably the
44:52
most important thing. I'm a Google Photos person
44:54
myself, right? And I'm looking at my my Google
44:57
Chromecasts with Google TV, which is a terrible name for a
44:59
product by the way. Google, if you're listening and
45:01
I have an album that is my dog photos, and every time I pick a
45:04
picture of one of my dogs, it's using its Google magic to add it
45:08
automatically to my photo album and it just magically appears on
45:11
my TV, which I think is great. My wife and I love that.
45:16
Yeah, see, it's not all bad. Jim, I know that you've had some
45:21
concerns or maybe some questions is probably a better way to put
45:24
it around pictures and those getting uploaded and becoming
45:28
property. I wanna ask you about this and
45:33
kind of maybe get Hannah's take on this, but we just talked
45:36
about Google Photos, right? You're uploading pictures and
45:39
you're doing something about that.
45:41
And I think this concept of all uploaded pictures become the
45:44
property of that company is a real problem I have with that.
45:50
Unless it's very clearly stated, I'm probably not going to use
45:52
that platform. Where do you see that most
45:55
often? Is that something you've come
45:56
across, you know? What are your thoughts on that?
45:58
Because I'd love to hear Hannah's comments after that.
46:00
You know, I heard this in the early Facebook days, so I'm not
46:04
even sure if it's it's ever true then or if it's still true now.
46:09
But my understanding back in the day was that you agree as part
46:14
of the end User License agreement that any photos you
46:17
upload become the property of Facebook or you know via
46:21
Instagram up the property of I guess meta is the the right
46:26
term. Now my concern is then, OK,
46:29
where might those pictures show up?
46:32
And if there are pictures of like you and your family or
46:36
pictures of you and whoever, could they show up and at some
46:42
point you don't want them to be on the home page of Facebook?
46:45
Now, I think that Meta's probably smarter than just to
46:49
take Hannah's one of Hannah's pictures from her Instagram
46:52
profile and throw it on the instagram.com website, But I
46:57
don't know. I don't know if that's true.
46:59
I think the language that I typically see is transferable,
47:03
sublicensable, royalty free, worldwide license, all this, you
47:08
know, legal gobbledygook, where it's OK.
47:11
I uploaded a picture of one of my dogs and I'll just use Google
47:14
for that example. I don't know if they're doing
47:15
this or not, but I uploaded a picture and part of that service
47:19
says, OK, I have one of these things.
47:20
Can they make a copy of that picture, then do what they want
47:23
with it? Who owns the copy of the
47:25
original? I don't know.
47:26
And are they with? Maybe.
47:28
But I agreed to that when I took advantage of, you know, having a
47:33
dynamic photo album with my dogs in it.
47:36
Right. I've got cute dogs.
47:37
I mean, I hope I get it, you know, a little bit of kickback
47:39
from Google if that happens, But.
47:42
But I think that's the issue, right?
47:43
It's a copy of the original. It's not.
47:44
Oh, we didn't use the original. We used a copy of it.
47:47
Does that make? You sold.
47:48
What if they sold pictures of you and your wife and millions
47:53
of other people to a retailer, and then they used AI technology
47:59
to do facial recognition. Now you walk into that retailer
48:03
and they knew all this stuff about you or they say, Oh well
48:07
now Jeff was looking at the Crest white strips and they they
48:10
start pushing those ads to your your profile.
48:14
Yeah, they use this podcast. They heard us talking about it.
48:16
It's the part of the training data.
48:19
Who owns the podcast, Jeff? Is it really you and me or is it
48:22
actually the each podcast platform?
48:24
People own it. This is a podcast for the
48:26
people, by the people. Come on.
48:28
Man, I'm with you. I'm with you, man.
48:31
Well, and I think back to what I said earlier, right, is that
48:33
it's the images. And then even if they're not
48:37
selling the images, they're probably inferring attributes,
48:40
right, or things in our images about us.
48:44
And then these huge data profiles are built up by the
48:48
data brokers who then, you know, package this information and
48:52
sell it. And then I think you know it
48:55
like, like I said at the beginning, like the fact that
48:58
perhaps when I try to go look at the news and try to get an
49:01
understanding of what's going on in the world, and I'm seeing
49:04
some version of it that is different because they think,
49:08
oh, this is the, this is the version Hannah will interact
49:12
with, right. But my friend opens the computer
49:14
and says what's going on in the world and they might get a
49:16
completely different sense of what's going on because the
49:20
output is all influenced by the data that is they had about us.
49:24
So that's one thing I think is unique to sort of the past five
49:29
to 10 years in terms of how tailored our experiences are
49:33
that we may not even realize it. So I think you bring up early
49:35
interesting point because I feel like we're going into an
49:37
electric an election cycle here in the US right.
49:40
And it's pretty clear that there are red states, blue States and
49:42
purple states. And I do find it interesting to
49:45
say, OK, well, you know, if someone has leans towards these
49:48
specific sites or whatever, could that data be manipulated
49:52
to show me things that would put me either for or against, right.
49:55
Those situations. I do think that's interesting
49:57
idea of, you know, maybe this is an AI thing.
50:00
I don't know. But people are constantly trying
50:02
to tailor their marketing, right.
50:03
I mean, we use this for the podcast as well as like, hey,
50:06
how do we get content that people want to listen to or
50:08
watch or whatever it may be? You know, and we're just a
50:11
stupid little podcast about identity.
50:13
You know, I have to imagine that the larger media networks are
50:16
probably doing their own analytics to say, oh, we know
50:19
that, you know, this age demographic in this region that
50:23
also looked at Crest White strips, you know, watch this
50:26
sort of, you know, thing. Right.
50:28
And I think I think that's an important point is, you know, if
50:32
and and sometimes maybe it's not even changing the facts of the
50:34
story, it's how the story is worded or other things right.
50:39
They can kind of move you in One Direction or the other,
50:42
depending on, you know, the goal of the of the service.
50:45
I think what you're what you're fed online, definitely.
50:48
I mean, I noticed it myself and I I feel like I'm pretty aware
50:51
of it, but even I can notice like, OK, you know, oh, it seems
50:55
like every I'll notice myself saying things like, oh, it seems
50:57
like everyone is talking about, you know, this And I say that to
51:01
someone else and they're like, what?
51:02
Like, so I often times I catch myself wondering like, how much
51:06
is that really true or how much is it just like continually
51:09
feeding what I'm being shown and it's making me perceive things
51:13
in a different way. And we're all living our lives
51:15
so much online now that I think everyone sort of has their own
51:19
perception of things that are going on, what's important,
51:21
what's not. And it's really hard to know the
51:23
truth. Would you know you were being
51:25
radicalized one way or the other?
51:27
However you want to find that if it was a slow progression over
51:30
time based off the data coming in about you and your other
51:33
activities, it might start with just a small little thing.
51:35
It's like next thing you know, you know you keep reading about
51:38
how Quest white strips actually turn your teeth black.
51:41
It's like, Oh well, must be true, right.
51:43
I see 1000 different articles about that and only one that
51:46
says it's good versus someone else like Jim who's out there,
51:49
he's buying them. He's like, yeah, these are great
51:50
And he's in, you know Crest white strip fan club, these are
51:53
things that the Crest you know the the best thing sliced bread.
51:55
And he's in the maybe he gets one article.
51:57
He's like, oh, that's nonsense. Like, how would you even know
52:00
that you're being pitched one way or another?
52:02
I find that really scary. And now I've got my tinfoil hat
52:05
on. So I should.
52:05
Probably say, yeah, I know, me too.
52:07
I know it can quickly veer into that.
52:08
And I don't like when I start to sound like that.
52:10
But you know, it's it's an interesting question.
52:13
It's an interesting thing to ask yourself, right?
52:14
And maybe just become more aware of it.
52:16
Yeah, such such a cool topic. I think we go for another hour.
52:19
But Hannah, you've been such an awesome guest, and I wanted to
52:23
finish with, you know, you've been kind of this privacy
52:26
evangelist for over a year now, and I'm wondering, like, what
52:32
have you learned? What's been your biggest take
52:33
away? I think my biggest take away on
52:37
privacy evangelism is that people care about human the
52:43
human side of it. They don't care about a specific
52:46
technology like. All of my most engaging and
52:49
sticky things that I've done were like videos, little reels
52:54
of me doing things like, oh, I this is what, like I logged in
52:59
without a password and it's like I'm looking at me and then I
53:02
flip the camera around and I touched my Ubikey, right?
53:04
Like that was so popular. I don't know why, but I think
53:08
talking about, you know, Fido and talking about Ubikey didn't
53:13
connect nearly as much as seeing a person not have to put in a
53:16
password and just touch something and now they're logged
53:18
in. And that's what really drives
53:20
the point home. I did another post where I took
53:24
a photo of my Christmas tree and I said, you know, if I posted
53:28
this photo of my Christmas tree online, what would I be giving
53:31
away about myself? And then I put a little tag that
53:34
went over each ornament and it was like my favorite vacation
53:36
spot. How many people are in my
53:38
family, the ages of people in my family, like one of my favorite
53:42
foods. It's like all the different
53:44
things you can potentially be showing about yourself just in a
53:47
in an innocent seeming picture. So I think taking things out of
53:51
like digital and technology and putting them into humanity and,
53:55
you know, just everyday objects around the house and framing
53:58
privacy that way seems to have resonated the most of people.
54:01
That's a great experiment, being able to like, use those tracking
54:04
tags right and pixels the opposite way, 'cause they think
54:08
maybe people are familiar with it, but maybe not.
54:09
But you open an e-mail or whatever website, there's
54:12
usually a tracking pixel somewhere in it that is tracking
54:15
what you're doing. It's just a little pixel.
54:17
You would never note it. It's white on white background
54:19
probably, or black on black background.
54:21
And yeah, that data gets correlated, stored for somewhere
54:25
and then correlated back to something about yes.
54:28
So when you're answering those secret questions, right, It's
54:31
like, OK, either use the truth or make sure you remember your
54:35
lie, whatever that is, right? Yep.
54:38
Yep. Exactly.
54:40
All right, well, this. I feel like we got pretty heavy
54:42
here, but I really enjoyed the conversation.
54:43
I want to lighten up the mood. As we kind of wrap things up,
54:46
we'll end on a lighter note. I've actually got two.
54:48
One's from Jim, one's from me. Jim, I'm gonna go first because
54:52
I think yours is more fun maybe than mine.
54:55
But Hannah, question for you, what's the most unexpected thing
55:00
that we would find if we looked at your music playlist right
55:04
now, whether you're using Apple Music, Spotify, or something
55:07
else? Like, what's the most surprising
55:09
thing where it's like, well, that's not Hannah Hannah's
55:11
changed. I think to anyone who doesn't
55:16
know me, it would be surprising that I have a ton of really
55:21
hardcore late 90s and early 2000s rap in my playlist.
55:27
Super hardcore. I still really like rap and hip
55:29
hop. But you know, back then it was
55:32
just super hardcore rapping. And I still love that music to
55:36
work out too, and I think most people would probably be
55:40
surprised by that at first. All right.
55:42
Give me some artists. So you're talking about late,
55:44
late 90s, two thousand? Yeah, like Snoop.
55:49
Dogg, Eminem, Doctor Dre, the old Lil Wayne.
55:55
Yeah, all things like that Kid, Cudi, Chamillionaire and Nellie.
55:59
Oh yeah, I could go. I could go on and on thinking,
56:02
thinking back to my CDs in the CD player of Nellie.
56:06
I I I can get behind that. That's not bad, Jim.
56:09
How about yourself, 'cause I feel like it's all country music
56:11
and I'm hope, I'm hopeful that there will be something good in
56:13
there. There's lots of good country
56:17
music in there. There's lots of good old classic
56:21
rock, new rock, medium rock, like, you know, like the, what
56:26
do you call that, grunge rock. But here's one that's going to
56:31
stand out. The Ambien Zone.
56:34
Just Music Cafe Volume four. And the song is called
56:39
Weightless by Marconi Union and it's just one of those like New
56:44
age kind of like sounds with no, no vocals and you just play it
56:49
and just like when you want to meditate and it puts you into a
56:53
meditative state. And I love it.
56:56
I I use it just for that very purpose.
56:58
But I don't have, I have a few songs like that.
57:01
But I think everybody should check that out.
57:04
They need some way to relax and get into its own.
57:08
I use that for focus because I can't, you know, read and write
57:12
while also listening to someone sing or talk.
57:15
So I need the. I need the ones without lyrics
57:17
as well to. I use it for focus though, when
57:19
I really need to do something and concentrate.
57:23
What about you, Jeff? Man, I am all over the place
57:26
when it comes to music. I don't.
57:28
I'm trying to think it'll be shocking.
57:29
I mean, I listen to a lot of rock.
57:34
I I like EDM, even though I can't dance for crap.
57:38
I think part of that is like instrumental, like dance music.
57:43
I love Lady Gaga. I think she's great.
57:45
I don't. I like her old stuff better than
57:46
her new stuff. I know, controversial, but like
57:49
the song Telephone with Beyoncé and Lady Gaga, that's my jam,
57:52
right? I could do that all day long,
57:55
but maybe that's the most controversial.
57:57
But the one thing I just. I can't get behind is like
57:59
country music bothers me. You don't like Chris Stapleton?
58:02
I don't. I'll tell you, I do have
58:04
Mexicoma on my playlists. From who sings that it's what's
58:09
the country guy sing. Name me country artist.
58:12
Cause it's Mexicoma. Tim McGraw.
58:13
I think it is. Oh yeah, that's it.
58:16
You're right. It's Tim McGraw.
58:17
I just looked it up real quick. OK.
58:18
Yeah. So you're quicker on the on the
58:20
scrolling I was that's Jim maybe that surprises surprises you
58:23
that I have a Tim McGraw song on my list.
58:26
Yeah, even 1 surprises me 'cause you're pretty, you're pretty
58:29
firm in your hatred of country music.
58:31
And it's not for lack of trying, 'cause my wife is a big fan, and
58:34
we play this game every once in a while where we'll just like,
58:37
hey, what do you want to do? I don't know.
58:38
We're just kind of sitting there begging for the TV.
58:39
We'll fire up the Apple TV or whatever it may be, and just
58:42
start playing music for each other and telling each other why
58:46
we like the song that we're listening to.
58:48
So it's like. Do you like Texas hold 'em by
58:51
Beyoncé? Because that's kind of like lady
58:53
pop rap slash country. Is that the new one?
58:57
Yeah. I have not listened to it yet,
58:59
OK? Maybe that'll be another country
59:01
song you like. I'll.
59:02
Have to listen to it, yeah. And see.
59:03
Yeah, I don't know. I haven't listened to it yet.
59:06
So. And we we won't play it here and
59:07
get a copyright strike. So we've tried that before.
59:10
We've run into issues. So yeah, yeah, I.
59:14
Don't know. All right, Jim, So my lighter
59:16
note question is very brief. Are you a pineapple on pizza
59:20
person? Let's start with our yes, let's
59:23
say you, Hannah, Pineapple on pizza.
59:25
Yes. All right, my turn.
59:27
So I say I had pineapple on my pizza last night.
59:30
I actually enjoyed it. But here's the deal.
59:33
I woke up like a bunch of times with heartburn last night and it
59:36
was kind of unusual for me. So I'm not sure if I can
59:41
attribute that to the pineapple, but I'm kind of attributing that
59:44
to the pineapple. So while it tasted good, I don't
59:48
know if I can deal with the heartburn.
59:49
What about you, Jeff? I'm glad that we asked this
59:52
catching last because we're just gonna have to close out this
59:54
conversation with Hannah because pineapple does not belong on
59:57
pizza. Sorry, I have a traditionalist
1:00:00
'cause everybody knows how traditional I am.
1:00:02
But no, I I'm not a pineapple on pizza person.
1:00:07
I respect your choice, Hannah. I do not agree with it.
1:00:09
How about that? So at Identiverse, I should
1:00:12
approach you with a giant slice of pineapple pizza.
1:00:14
And I would, I would be very polite to say, oh, thank you.
1:00:16
And then I'd like fake eat it like so it's like, I can put it
1:00:20
like, you know. Take a picture of.
1:00:21
People and then go right into the garbage or hand it out to
1:00:25
the next person I find. Hey, Hannah, got you this pizza,
1:00:28
Hannah. There you.
1:00:28
Go and then pass it along, yeah. So I would be very, you know,
1:00:32
diplomatic about it. I just, I don't know, There's
1:00:34
something about the combination sweet and like greasy.
1:00:37
Salty just doesn't do it for me. I just think that's the whole
1:00:39
point of it. Yeah, I like that combo.
1:00:42
Yeah, well, hey, teach, throw. Not everyone can be perfect,
1:00:44
right? All right, let's go ahead and
1:00:48
wrap it up. We're up over an hour again.
1:00:49
We always try to keep these like, closer to 45 minutes and,
1:00:52
like, fail miserably. But when the conversation.
1:00:54
An hour and 3 minutes is the perfect episode length.
1:00:57
And by the time I get this cut down a little bit, we'll
1:00:59
probably be like 101, maybe 60 minutes, but I'll keep talking
1:01:03
to inflate that number. But no, when the conversation's
1:01:06
flowing, right, we just keep on going with it.
1:01:07
So, Hannah, thank you so much for taking the time with us.
1:01:11
Thank you for all you do for ID Pro as a regular old member.
1:01:15
Let's keep the Slack channel going because definitely, I
1:01:17
think we're all fans of that. I'll put a link in our show
1:01:20
notes to your profile. And I think we talked about that
1:01:23
article, which originally appeared as an ID Pro kind of
1:01:26
e-mail. So there's really not right now
1:01:28
a public way to get to it. But hopefully by the time this
1:01:31
goes, this episode goes live. I think we talked about maybe
1:01:33
putting on like on your LinkedIn channel or something like that
1:01:35
so people can go and check it out.
1:01:37
So keep an eye out for that. Let's see what else we're on the
1:01:41
web. idacpodcast.com. We're on Twitter or X or
1:01:44
whatever it's called when you listen to this at IDAC podcast,
1:01:47
if it even still exists. By the time people listen to
1:01:48
this, we'll be on Mastodon at IDAC podcast.
1:01:53
You think so? Elon hasn't run into the ground
1:01:55
yet. Yeah, he's got enough money to
1:01:56
make it through sheer dollars and cents just to make it
1:01:59
moving. As long as I keep buying
1:02:01
Tesla's, let's see, we're on Mastodon, at IDAC podcast, at
1:02:06
Infosec, dot exchange, connect with Gemini and LinkedIn, like
1:02:09
subscribe, do all that cool stuff that helps us get great
1:02:12
guests just like Hannah. And with that, we'll go ahead
1:02:16
and leave it for this week. Thanks everyone for listening
1:02:18
and we'll talk with you all in the next one.
1:02:21
You've been listening to Identity at the Center.
1:02:25
We hope you've enjoyed the show. Make sure to like, rate and
1:02:29
review and we'll be back soon. But in the meantime, hit the
1:02:32
website at identity@thecenter.com and find
1:02:36
us on Twitter at IDAC Podcast. See you next time on Identity at
1:02:44
the Center.