Latest / Identity at the Center / #167 - 2022 Gartner IAM Summit - Vittorio Bertocci with Auth0

Transcript

#167 - 2022 Gartner IAM Summit - Vittorio Bertocci with Auth0 · Identity at the Center

0:09
You're listening to the identity of the center podcast, this is
0:13
the show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:24
sender podcast, I'm Jeff. And that's Jim.
0:26
Hey, Jim. Hey, Jeff, how are you?
0:27
That's a bad yourself. I'm doing great.
0:30
I well, I am a little bit sad. There's the last day of the
0:33
conference. We're here at the gardener.
0:35
I am Summit in the RSM podcasting, sweet.
0:39
The sweet sweet. We've talked about that, that
0:42
total joke. Yeah, that's the joke.
0:44
That's getting a bit too old, but fortunately we won't tell
0:47
them any more times. And I had a thought today.
0:51
Oh boy. What?
0:52
Is or what makes a person part of the identity arathi?
0:58
That's a good question. I don't know.
1:00
I think probably being part of the speaking tour, contributing
1:05
back to the identity body at large, right?
1:09
Although people were in it. So I'll be honest, I don't know
1:13
if I like the name because it feels like it's elitist a little
1:16
bit, but I get the concept of it.
1:18
I think anybody can be part of the identity riding.
1:23
But to do that, you have to be, you have to be contributing some
1:26
way back, right? You can't just be a consumer.
1:29
You need to be a producer of something.
1:31
That's how I would Define it. So who gets to determine whether
1:36
your, the identi Rowdy other people, or you, it's like a
1:39
nickname. You cannot pick your own
1:41
nickname. It has to be bequeath upon you.
1:44
Someone has to tell you that. You're part of it and there's
1:47
consider it. I think it's probably something
1:49
where I'm not worried about like you know it's not like a one off
1:51
thing. Like oh I gave us Once at nine
1:53
part of it, that's how it works. I think it's continued
1:56
repetition and continued production of things back to the
2:01
identity community at large. That's how I would think about.
2:03
It was just to bring It full circle.
2:06
So our guest today is Vittorio Bertucci and I asked him the
2:11
same question. What makes a person part of the
2:14
identity Rowdy and it's Vittorio Bertolucci.
2:18
Come on man. Show some respect.
2:20
Hey, have I pronounce anybody's name rights today?
2:23
No, no. Thanks for having me, guys.
2:27
Well, it's a very, very difficult question.
2:31
I'd say, you know, that scene in The Matrix in which the article
2:35
tells knew no one can tell you. If you're the one is like being
2:38
in love, only, you know, where it's porn, right?
2:41
You know, when you see it. Yeah, you know, he's when you
2:43
see it, but I think that there are two to meet two definitions,
2:47
come to mind. One is if you have a one degree
2:51
of separation from Ian, Glaser the SVP on Salesforce, then you
2:57
can call yourself an identity, right?
2:59
Even if you are a, he is to say baker.
3:03
I think that the hair if a nosy are and they are on a first-name
3:06
basis, you can call but perhaps and I don't care about you,
3:09
that's one little steps but another, which is a more
3:14
verifiable. I think that the whomever has
3:17
spent enough time and engaged enough with the community to
3:22
have opinions, on on identity matters, that will be considered
3:29
and respected by others as valid opinions, as opposed to just
3:34
like parroting the talking points that actually someone
3:38
that connects the dots in the context of identity and delivers
3:43
a statement which we might agree or disagree but you You see that
3:49
it is a competent and relevant and you see the rationale behind
3:54
it. So to me, anyone that is in that
3:56
position is an identity. Now, I agree that often that is
4:01
correlated with contributing to the community because it's rare
4:05
that people can be a lurker for a decade.
4:08
And then suddenly one day, wake up and say alright here is my
4:10
statement. Usually it's a dialogue, it's a
4:13
conversation. But yeah, that's that's very
4:16
Criterion. I use I think that's pretty
4:18
fair. R.
4:18
And for those who don't know, Vittorio definitely part of the
4:21
ident Irani. You've probably seen him
4:23
striding the Halls. He's been on the show a few
4:25
different times. So if you want to learn more
4:26
about his background, I would encourage you look into our back
4:30
catalogue with with that how. So, we're here at Gartner, I am
4:35
Summit. 2022 in Las Vegas. Jim said, sad to be done.
4:39
I feel like I'm more, like, relieved that it's over.
4:43
How is the conference been for you?
4:46
For me, this was a very good assistance of a God.
4:50
Yeah, the last one I attended was in 2019 and it was good but
4:56
this one was better. I think that maybe we're two
4:59
years interleaving or like lots of other details which I cannot
5:03
share but it's Vegas after all. But there it was good.
5:07
Like I came here specifically because I was lucky that I was
5:12
able to participate to a number of conferences.
5:15
Similar few But all of us conferences, apart from are say
5:19
they were all very technical. And so I felt this that's to be
5:23
farther toward what happens on the wire and like details that
5:28
as blue colors, pay attention to and a big part of my job is to
5:33
advise my feature teams and I felt I needed a full immersion
5:38
with Buyers people that to think about getting the job done,
5:43
rather than how orbit. I think in medium to longer time
5:49
Horizons running than the Tactical.
5:51
Yeah, I need to do X and on that respect.
5:54
It really delivered. I'm lucky that I'm fairly
5:58
recognizable like longer here, long ago.
6:00
So long chin everything long and people like, I'm not try to stop
6:05
me miles, and I just had so many impromptu conversations, which
6:11
delivered exactly on this. And I'm also very lucky, but I
6:15
know what? Number of enemies.
6:17
And so, apart from their 101 switch, we had scheduled as part
6:21
of a conference adjust that again in number of impromptu
6:24
talks with Felix with a henrique where with Eric.
6:28
So those were really good like was guys are super insightful
6:31
and it's a privilege to have a chance to speak with that.
6:35
And finally, these will be familiar with every conference
6:38
goers. You have a chance to catch up
6:41
with your colleagues colleagues. Which sure.
6:43
Now they are in the zoo. Zoom error and so we are used to
6:48
interact in remote, but having your legs, under the same table
6:53
is an entirely different level of Engagement.
6:55
And I very much enjoy that, it has been very cool if the
7:00
hallway conversations reconnecting with people.
7:02
You maybe haven't seen in person for two years, ten years,
7:07
whatever it may be. That sort of thing.
7:09
I mean Jim and I've been doing this thing for three years now,
7:11
the podcast and we work together all the time, but we don't
7:14
actually see each other. Real world all that often
7:17
especially over the last couple of years.
7:18
It is it is very cool to like have that camaraderie.
7:21
I almost felt like it was almost like a little bit of a
7:24
celebration of kind of people. I saw you on the street at RSA,
7:29
we were probably both going different directions and
7:30
different, you know, things and stuff like that.
7:32
But I also felt our essay was a little bit of something like
7:35
that to where it was like, okay, you know, we're back that sort
7:39
of that feeling like okay, we're kind of under the same roof.
7:41
Again, we're seeing people in person and I felt like this
7:44
conference as well had the same type of ideas.
7:47
I was I this is something I point out.
7:49
I think last week when we were kind of getting ready for the
7:52
podcast, was the Keynotes seem to be focused, not on
7:57
technology, or the market or anything like that.
8:00
It was focused on a lot of human-centric things
8:03
storytelling, you know, communication and taking into
8:07
account other people's perspectives.
8:09
And what are the things that have been happening throughout
8:11
the year? You know, the last couple of
8:12
years, you know, from from a health perspective Are there any
8:16
things that surprised you from a conference standpoint was like,
8:20
oh, that's interesting. I wasn't expecting that or
8:24
things along those lines, maybe hallway conversations or other
8:26
interactions. You might have had.
8:29
I stood there are two main things.
8:31
That, that surprised me and perhaps they shouldn't have, but
8:36
they didn't one was a, the session on the, on the hype
8:42
cycle from Felix and Felix. X is an excellent speaker and a
8:48
great analyst but I was somewhat surprised by how matter of fact
8:56
he was when he described some of those things.
8:58
Like I mean they have to cycle have so many things to talk
9:02
about and the time is short and he has a to take into account
9:06
that some people aren't familiar.
9:07
So there is this little introduction to what it is.
9:10
So he didn't have a lot of time left for every item.
9:13
But in general, he He was very, very direct and I really
9:18
appreciated that and think that so many people look at the
9:22
Garter for guidance, and that was good.
9:25
Okay. It was really good.
9:27
Again, it's not that I was expecting it to be bad.
9:30
I just didn't expect it to be so direct which was great.
9:34
And the other thing that I really liked, so it's fries
9:38
model like a marveled rather than a surprise.
9:41
It was a session yesterday from the attic.
9:46
About the identity fabric. The basic idea is that there are
9:52
you can think of like a maturity model between Vector connects
9:57
via traditional. I am with what we have been
10:00
calling modern identity and basically he interpolated to
10:05
what's next and he has this concept of identity fabric which
10:10
is basically a collection of capabilities into is.
10:12
It isn't really a product and the way in which the character
10:15
This was capabilities just hit it on the head for me, like, it
10:19
was a it was a very good way of describing what we should
10:24
expect. Like what we need to do for
10:27
moving to the next level and that was a vet was very good.
10:31
I plan to explore that aspect father.
10:35
I think when I heard terms like identity fabric I get concerned
10:38
around okay zero trusts itd are all these other things is like
10:44
every product. Chuck seems to like, glom onto
10:47
whatever the term du jour is, you know, I see products like oh
10:51
we are the zero. Trust blah blah blah.
10:54
We are the you be a blah, blah blah.
10:57
And I see things like that and it's like I'd any fabric.
11:01
I've been hearing it for years and I'm concerned that at some
11:04
point we're going to see we are the identity fabric blah blah
11:07
blah. I think you can best do that.
11:10
They could happen. Unfortunately, a marketing
11:15
event. Ali, Khan's, everything and even
11:18
Concepts that have technical Mary will be strained and
11:23
tortured and their arms Twisted to fit a particular, go to
11:28
market, because that's the way it is.
11:31
Like capitalism rewards, people could sell and so people sell, I
11:37
think it's on us. The more fantasy technical
11:41
people to try to keep our Our our own marketing's honest.
11:48
And she's like, I think everyone tries to do that.
11:52
But the other is also when we engage on actual projects to
11:56
make sure that we do use those Concepts Beyond hype that when
12:03
we are working with our customers or with people that
12:05
aren't as deep as us that we help guide them through like
12:10
we've objective things like this.
12:12
Think about zero trust reminds me like a bit of a growth
12:15
mindset. Sestero like a Visa mandala
12:18
keywords that people use for and, and very often as just
12:23
abuse. And the way to diffuse that is
12:26
to just break down into fundamental components.
12:29
What makes something zero trust and then say, okay, let's test
12:34
this thing with you just said, is it really easier trust?
12:37
And you can't always afford that because Vector requires a high
12:41
bandwidth conversation in a lot of people just go with short
12:44
hands, because We are just doing things on passing, but maybe
12:49
it's okay that I could think of like a how people of torture
12:52
also things like a seesaw or Federation, like sometimes a in
12:58
discussions, you just have to let it go.
13:00
You're like you have to choose your bottle.
13:02
So the say that there is a cure, it's probably going to be the
13:05
same. I've only so much energy.
13:08
Is that what is that about? I want to fight.
13:10
Yeah, exactly. So let's talk.
13:14
Let's see, we're kind of there. Two different things I want to
13:16
get to. For those who don't know though
13:18
you are a fellow podcaster, we have the distinction of you
13:22
actually announced your podcast a couple years ago on our show,
13:26
identity unlocks. And for those who haven't heard
13:28
it is fantastic, you get to hear Vittorio having conversations
13:31
around. Really the mountainous grab this
13:35
like the meat of identity, the specs, the standards that are
13:40
being put out there that are so important to the
13:42
interoperability of so many different identity things.
13:45
Things I'm probably butchering how you would probably explain
13:48
to someone else. So tell us about it.
13:50
I unlocked certainly go and catch.
13:52
It will have a link in the show notes so go check it, it's
13:54
everywhere. But how is that?
13:56
Any locked doing yeah. Far too kind and you gave a
14:00
very, very good description on the show.
14:03
Like, the idea is largely the fact that standards have such
14:11
impact on so many things in the context of a day.
14:15
He and Beyond and at the same time they are just like these
14:20
are hard things to deal with people very often deals with
14:24
them at their wrong layer. Like they think that we have to
14:28
re-implement stuff from scratch. And so we need to read the spec
14:31
as opposed to knowing what the particular spec unlocks in terms
14:35
of scenario and then just using tools like sdks and services
14:38
that will take care of the low-level stuff.
14:41
And the other thing is that they standards like the
14:44
specification, Is typically are very obscure and also very
14:50
essential like, every sentence is debated by experts for
14:54
literally years. And so the end result is precise
14:59
but it's a bit like the Ikea instructions in which if you
15:03
don't follow them. Exactly to the letter you'll end
15:06
up with something that rickety and some extra pieces saying
15:09
what did I forget? So the thing is that the so much
15:13
goodness so much knowledge A part of the process of building
15:18
standards and that gets completely lost.
15:20
If you are not part of the discussion.
15:23
So the idea behind this show, which we don't always manage,
15:26
but we try is it to take the experts, like the offer spec,
15:31
which share of the working group and talk with that the same way,
15:35
which we would talk at the bar here.
15:38
At the end of the day, talking about what happened, what we
15:41
found interesting. And with us, we are very someone
15:45
He's not an expert and so we know that we needed to not use
15:50
too much jargon and somehow go to the real meat to the value
15:54
proposition running than the how more of like a y and the
15:58
context. And so we try to do is we try to
16:02
democratize. The substantially was specs in
16:05
front of people about what they what is their significance.
16:08
Like, for example, we use a better tokens everywhere and we
16:13
covered these New ways of securing tokens, you don't need
16:19
to know the details of how it happens.
16:21
But you need to know that now where is this capability?
16:23
That allows you to have more secure interactions and a bit of
16:28
a context of like how this thing came to be in what situations
16:31
you can use it in what situation you can't.
16:33
So we try to do this and it's a privilege.
16:37
It's a privilege because I speak with such incredibly smart
16:41
people which are very generous with their time and I think it's
16:46
going really well, let's say that there was expecting these
16:48
to be ultra Niche and he said the numbers are surprisingly
16:52
good. Like we have a lot of people
16:55
listening to this thing and it generates a lot of good
16:58
discussions. Good questions.
17:00
It helps the people that are developing or standards to get
17:04
the attention they deserve which often they get lost in the
17:08
noise. So it's going really well.
17:11
Yeah, fattori. I totally agree that people that
17:14
you're getting on the shores, For smart, sometimes I listen to
17:17
it just to try to get myself. Smarter, what I'm wondering is
17:22
for the, I am practitioners or maybe they don't need that level
17:28
of detail. If you kind of pick a few of the
17:31
major topics that are happening in the, you know, in this space
17:37
of Standards Evolution, maybe top two or three and just kind
17:41
of tell us what thing, where we're at with each one of those
17:46
Sure. Absolutely and fought at least
17:49
some of those. We actually have also episodes.
17:52
So if people want to double click, you can go there at see
17:56
that. The one Earth is top of mind for
17:58
me, is 5.0, Multi-Device credentials, which is the
18:05
scientific name of a more common name, passkeys.
18:09
And in a nutshell, that's in a new type of credential, which
18:15
Sure takes, if you're familiar with the platform of indicators,
18:20
in a fight or two, we're both on, which are basically using
18:24
the secure elements on your devices.
18:26
So the TPM on your laptop or like this viewer Enclave on your
18:31
phone and basically use that to authenticate using public key
18:36
cryptography unlocked by the Biometrics of your device and it
18:41
takes this idea, which was an extraordinary achievement.
18:45
The file Alliance but that was mostly adopted by either
18:50
administrators or key were information workers.
18:54
So not by the consumer because everything being tied to the
18:59
device, makes it complicated for enrolling multiple devices or if
19:04
you lose your device, you don't know how to record it.
19:07
So obvious was, always mostly either for administrators or a
19:11
second Factor because you need the first Factor if you need to
19:15
retrieve. And finally, I'm getting to
19:18
watch. Passkeys, our past is basically
19:20
are taking the same mechanism but allowing the keys to Rome,
19:26
let's say that what has the traditional platform of
19:29
indicators. Tie the key to that particular
19:32
device by Design. That's gonna diminish traitors
19:35
might want to say, I want to know it's coming from that
19:38
device because that device as my security policies on it.
19:42
And so, they, it it has its its own part.
19:45
Opposites. But at the same time, it made it
19:47
difficult for consumers and so vendors, like apple, Google and
19:51
Microsoft had this idea of making this finger wrong.
19:56
And so what happens is that now and just it today literally we
20:00
published a blog post on the other Ciro blog and wherever we
20:05
also have a little demo of our integration.
20:08
What happens is the vector? If you are in a particular
20:10
ecosystem, say the Apple ecosystem and a you got your Mac
20:15
which day you Ready, do if you install Ventura, you go on a
20:19
website. Let's support spassky's you can
20:22
and run in the same way in which were running before with a
20:26
platform of indicator. In fact, if you look on the wire
20:28
it's almost exactly the same that could be called, the
20:31
already have will work and you can sign up to your website,
20:36
basically creating a local key. And then as soon as you do, that
20:40
your iCloud will start roaming the skin on your other devices
20:44
and then you can pick up your IPhone with iOS 16 land on the
20:49
same website and as soon as you get on the website that I can,
20:52
one of the really interesting things of these is that there
20:55
are so many Primitives that make the integration of this
20:59
capability. Very, very easy in terms of the
21:02
user perspective. So if you would just stop on the
21:06
username field and if your website use the new apis that
21:11
are u.s. offers this finger sees that there is a passkey For that
21:16
particular domains and then just offers you a little pop up
21:19
saying, hey, even if it's very first time that you land on that
21:22
website on that device, you already have anything available,
21:25
you just put your thumb or do your face ID and you are sadly
21:30
very dangerous Real Game Changer in terms of getting away from
21:33
the password, right? That's what I was just thinking
21:35
that if that's the word I was literally going to say was the
21:38
is roaming, is the game changer here because this concept
21:42
already exists, but is very limited being able to move Of
21:45
from device devices. I think that that's the part
21:48
that's going to really take off. That's absolutely, right.
21:51
I think you're absolutely right. And this is above convenience
21:55
for Multi-Device, but to me, the main, the main thing is the
22:01
recovery because again, today, if you use platform
22:06
authenticators, you can't just use that as one factor.
22:10
The only thing you do for authenticating, then there is
22:12
always with discussion is in its both.
22:15
You have in something you are or something, you know, because it
22:20
has to be a key with leaves on your device and the way in which
22:23
unlock the key is either by knowledge the pin or biometric.
22:28
So one might say it's to say it is multi Factor but various
22:35
controversy about like you need to use attestation in order to
22:38
know that these actually happened.
22:39
So let's pretend it's just one Factory or although it's
22:44
actually too. But the thing is that because of
22:47
that and because of the fact that this side of the device, if
22:50
you lose what it was, if you buy new device, there is nothing you
22:54
can do to recover your access to a website instead of now that
22:58
this thing is back to the cloud. Basically, in that scenario,
23:02
apple is the party responsible to help you do a recovery or
23:08
like you buy your device and you just restore everything just
23:11
like today. When you buy a new iPhone, you
23:13
put them side-by-side and The just transfers everything, so
23:18
that's powerful and it Game Changer and a big Improvement.
23:23
If your starting point is passwords.
23:26
Now, the controversy here is that, if your starting point is
23:30
platform authenticators, then it's kind of like a step
23:33
backward because a now you can no longer prove that that
23:39
particular authentication is coming from that particular
23:42
device or you are no longer in control.
23:45
The way in which account recovery is done.
23:49
So if you are an Enterprise or if you have like a federal
23:52
government, first things might not be good things.
23:56
In fact that I could very are lots of discussions about it and
24:00
the thing is this is going to be very vendor dependent.
24:04
Let's say that we were saying standards like a standard part
24:07
is multi multi device credential on the fighting side but then
24:12
where is how the values platform?
24:15
Is choose to implement this stuff.
24:17
Anyway, particular case of Apple, they decided that once
24:20
they will release the new virtual server operating
24:24
systems, which is just about to happen here.
24:27
Then we will no longer make it possible to create Keys bound to
24:32
advice. So Passkeys will basically
24:37
everything will be a passkey even if you have a key that is
24:41
on that one device and did a ROM yet, you will have a bit.
24:45
When you receive a key that says, yeah, I am back up a ball
24:48
device credential, and I haven't been wrong yet.
24:52
So, you have some chance of checking, but the thing is that
24:56
you can't prevent this from happening, let's say that the
24:59
true. Now I received this thing and I
25:03
know that it hasn't Don't. But one second later, this thing
25:06
might wrong or apple has this feature in, which you can
25:10
airdrop credentials, just like you do with passwords today and
25:15
I remember seeing like WWDC happened at the same time as
25:19
their say and we were like a couple of black watch parties.
25:22
People like watching these things happening and I've seen
25:25
people in horror because that very say audience is clearly
25:28
actually what he did, what is it just like a haircut rough inner
25:33
and private key. He basically to a different
25:35
device. So again I'm a if you read that
25:38
blog post with I mentioned which I tend you see that the our
25:43
position is is a fantastic Game Changer.
25:46
In our war with two passwords for consumers but so much
25:51
remains to be figured out on the 14 side, so good news but with
25:57
moderation with once so what else and of course I want you to
26:02
hit on the digital drivers Son says, one of the items on your
26:06
list. Yes.
26:08
So let's make sure that we don't, we don't lose that.
26:11
The mobile driving license is also something which is
26:15
happening in this space is being driven by ISO, which is a bit
26:20
less familiar for us in the identity space and to myself as
26:24
well. Like I am participating as a
26:27
liaison on behalf of opportunity like the openid connect
26:32
Foundation is Working with them. And in particular, for example,
26:38
Christina yes, udah from Microsoft is one of the main
26:41
people that is one thing with that and basically they're
26:44
trying to make the use case of a mobile driving license, used on
26:50
the web rather than impaction with devices to be done with the
26:56
experience that many years of about you connect brings but
27:00
just to summarize what this thing is this thing is a
27:04
Different of you are joining license in a format that can be
27:08
used with digital devices. So IG digitalization of your
27:13
driving license and a Visa is defined as c bar, which is like
27:19
a digital digital Json set. The batter in not digital,
27:24
sorry, binary, binary format, which contains the least of your
27:30
claims say and then it has a mechanism, which ties Sighs was
27:34
claims to one key which is only yours and only belongs to your
27:38
device. And so whenever you use these
27:43
with driving license, you can basically use the data that you
27:46
have on your device and disclose was proving that you are the one
27:50
disclosing it because you use your local key without the need
27:54
to go to any Central Authority, like if you'd be doing these
27:57
with ID token. So let's say, then every time
28:00
you have to present your driving license for some reason, you'd
28:03
have to Back to the provider and the provider with issue stuff
28:07
just in time. And then the provider would know
28:10
to whom you're going to disclose his finger.
28:13
And when and in what terms and instead by using this mechanism,
28:18
which is conceptually the same as the one is verifiable
28:22
credential, which is another of the things which is being talked
28:25
a lot about. But when people say that 50
28:27
credential, they often think about things, like the w3c
28:31
standard, which is a specific standard With a specific
28:35
structure and the mobile driving license is similar but not
28:39
exactly the same. What we concept is the same and
28:43
so it is a very powerful privacy-preserving capability.
28:49
There are challenges. Let's say that the in order to
28:52
do a trick that I just described you need a client software.
28:56
Like if you just do this with an ID token, you just do a couple
28:59
of HTTP redirects and you'd be done instantly not in here.
29:03
Now, Need one it and follow it. Right?
29:08
Where scan it. Seemed I quote because a while
29:10
it is such an overloaded term recently, but basically you need
29:14
a piece of software that runs on your device, which is capable of
29:18
requesting, but it's things. Those are like, verifiable
29:22
credentials /. Mobile, driving license.
29:25
Save it in place. So you keep it stored protected,
29:30
and whenever you need to present it, You do with three curved,
29:35
selecting the subset of things that you wanted to disclose, and
29:39
use the key to prove that it's actually coming from you.
29:43
And then, once in a recipient receive this think, there are
29:47
two parts in which you have to verify that this thing is
29:50
actually coming from you, so they need to check the signature
29:55
and they're typically the signature as a reference inside
29:59
the part which is sign it from your with claims that the ties
30:02
was the things together. I know.
30:04
I am getting in the Weeds now but unfortunately, some of these
30:07
things are just like advanced level if we were able to apply.
30:11
Well, let's just say that you need to have active software,
30:14
which runs on your device. The software is absolutely
30:17
critical, and it's not there. Like mobile driving glasses is
30:22
not the only reason for which has people might want to have
30:25
these software in there, which is why we had so many different
30:29
definitions of wallets which are largely interoperable and non
30:33
interoperability. This time and so they're like
30:36
they're in number of nascent groups or a number of electoral
30:40
alliance between companies that are trying to make things
30:42
interoperable. But at the same time, a lot of
30:45
the issuer's of us Wings want to retain a high level of control.
30:50
And so you can expect that some of those credentials.
30:53
Maybe not my mobile driving license, but some of that ilk
30:58
will give you also the application.
31:00
So basically it's like having a wallet for every card you have.
31:04
Didn't anyone if we multiple cards?
31:06
So we see that early days we need to see what happens but
31:10
like a lot of things are happening in this space and we
31:12
spray that last point you made makes me think I'm going to make
31:16
a statement in which is from everything you just described.
31:18
It doesn't sound like the mobile driver's license is going to be
31:24
following decentralized ID. In other words putting it on the
31:27
blockchain. Is that right?
31:30
Is that Not the direction that things are going so is far as I
31:38
know, there is no need for anything decentralize.
31:43
This simply are you dissing blockchain just kill it.
31:47
But if this is the case, if this if it's not going to happen for
31:54
digital driver's license, where's it going to happen?
31:57
He said landmine aware that I very rarely chooses to venture.
32:02
And this isn't going to be an exception.
32:06
So I'm gonna give you a very non-committal, very high-level
32:10
answer. But in particular, in this
32:13
particular case, this is one of those cases where you have an
32:17
authority, which is the department of driving licenses
32:23
or which is offered it--i've about whether you can drive or
32:28
not and that has been responsible to verify Your
32:32
identity. And it's actually self-defining
32:35
that when they usually think. So, to me, having the
32:40
identifier, or like the key material that you use for
32:45
protecting presentations of the sink wouldn't buy you much,
32:48
because sure you'd have your identifier that is entirely
32:52
under your control, but that would the only protect the
32:55
presentation in which is you show singing.
32:57
Yeah, I am the legitimate owner of this thing.
33:02
All that lack of these identifiers but if for some
33:05
reason they catch you driving High and the revoke your driving
33:10
license. And so the inner part of the end
33:15
of the presentation, which is the one that says yes Jim can
33:18
drive and he's over 21, it's no longer valid then having your
33:23
identifiers to check out won't help you.
33:27
Like if you were presenting with finger because you were banking
33:30
on the or forage or You sure of his attributes, then it won't
33:35
pay you much and internal infrastructure.
33:40
It's non-trivial to choose what use when we're and similar.
33:44
And and that's just on the holder side.
33:48
Then on the very Fireside, things got even more fun because
33:53
in a traditional scenario in which you'd ever like you order.
33:56
ID tokenism mentioned earlier, what would happen is that the
34:00
receiver would be fixed. Let's say that your provider,
34:04
the issuer knows the audience to which you are sending this thing
34:09
too. And so in the in Via Our
34:13
receiver would be in a trust relationship with issue.
34:18
Let's say that the moment in which to establish your
34:20
relationship, your choir with keys that you need to use for
34:23
verifying the, the signature, and all of that stuff.
34:26
Now if his word in which you receive your credential on your
34:31
device, and this credential is not bound to any particular
34:37
verifier, you can spend it with anyone.
34:40
The moment in which you sent your the URL presentation, the
34:44
verifier needed to take this presentation and verify that the
34:49
content actually comes from that particular issue.
34:52
And it's not obvious how to do that, because I guess who's
34:56
going to issue this thing is we're going to be like one giant
34:59
ether for everyone. Already going to have every
35:03
local department of driving glasses.
35:05
Every County that issues is something and then, are we going
35:08
to have all the different Is are an echo.
35:11
How are you gonna handle this like a Visa freedom of talking
35:16
with anyone? And everyone comes at the price?
35:18
So that being less rates it which again, you wouldn't tell
35:22
if you would be establishing trust relationships for
35:24
directions and similar. And so there again, honestly, I
35:28
have reacted to start the digging into the details of a
35:31
spec, but it's perfectly possible, that one solution
35:34
might be bi Ki welcome to 2020 zoo, in which you might have
35:40
Like one CA that issues all was activities and then anyone that
35:44
wants to accept those things. Can you say except I think
35:51
Society, the by that Thief is certificates that come from that
35:54
particular CIA. Even if it works that with be,
35:57
for the US, for one particular document and now multiply 24 by
36:02
these documents with various countries here at Gardener have
36:05
seen one session about decentralized, and I'm not gonna
36:10
say almost anything about that session, but the one thing that
36:14
I've seen, that have seen, which is a lot of entities was Visa
36:17
the of trust Fabric, in which people are just published Sounds
36:21
on these trust Fabric and somehow people put stuff in and
36:25
out. It was very unclear to me how
36:28
that would actually work in practice.
36:30
And unfortunately, it's a pattern because every time
36:32
people talk about this particular aspect, it's kind of
36:35
like, you know, that episode of South Park with the Underpants
36:40
ignorance, which we are big nose.
36:42
It's a step one. Collect Underpants, Step 2
36:46
question, mark. Step 3 profit.
36:48
Is that good? What happened between?
36:50
In was two steps. I don't know.
36:51
And this time also these addition of a graph that I am
36:56
didn't answer these question of mine.
36:58
I think there's so many questions so let's just that's I
37:00
think that's the issue is. There's good questions and there
37:04
aren't any good answers yet. I think like that the identity
37:08
Fabric or mesh that you kind of refer to just now where you can
37:11
publish anything to it strikes, me is basically what we're doing
37:14
is we're creating a Reddit for identity where the people have
37:18
to upvote and downvote. Oh Sources.
37:21
Do they trust? That's a very interesting way of
37:25
looking at it. I think that the challenge is
37:30
that we just like with baskets the exact same technology can be
37:35
an improvement or they can be a step back.
37:38
And so the thing with you just described which is a also pretty
37:41
popular in certain circles, like the social proofs, which wears
37:44
a, it's a clever mechanism, which will work for some
37:47
scenarios and would be completely unfeasible for
37:51
others, what you trusted, 40-acre passport, right?
37:54
Here's the first, here's, you know, here's a government
37:56
saying, oh well, you know, somebody just decide to spin up.
37:58
Our own passport service enough people are using it and say it's
38:01
good must be okay, right? I'm sure that's secure.
38:06
Luckily, that none of these is, is going to be a problem for
38:10
their driving lessons. I think with the the driving
38:13
less is being designed Again by the iso people which are among
38:17
the most rooted in hard, the have the core reality than even,
38:23
you can find. And I think I'm very, very happy
38:27
that the vast thing is happening.
38:28
Okay. I think of it is like the
38:30
paradigmatic artifact that can embody the verifiable
38:35
credentials like anything to be clear.
38:38
But with verifiable credential concept is a great concept and
38:44
it's just that a bit like what we were saying earlier about
38:47
marketing taking over, it's not only marketing.
38:50
Like sometimes also like technical people will get really
38:54
enthusiastic like I'm not saying there is any ill-will from Side.
38:59
But people will fall in love with an idea and push it without
39:04
necessarily having figured everything out and sometimes
39:07
it's fine because that's the way which share Innovation happens.
39:12
Some other times, if you are postulating and here, there will
39:16
be an Antigravity device. Well, if everything hinges on
39:20
you, discovering anti-gravity, that might be complicated.
39:23
So that is my only criticism to that.
39:25
But again, I love about dropping by licenses.
39:29
I love the concept of the sees. What I don't love is people
39:35
ignoring some of those details and then misleading, the people
39:39
that are not in this space because when you sell a really
39:43
nice story, which is, it is a nice store.
39:47
Like the idea of like you are in control of your own credentials,
39:51
you choose when to disclose and to whom and people will not know
39:55
about it. You are a huge truly is a good
39:57
story. But there are complications and
40:01
all this is not the entire story because a lot of privacy issues
40:05
happen at Sun in time but in my experience with bulk of it
40:09
happens when they observe your behavior like you could sign in
40:14
with incredibly secure privacy-preserving system and
40:18
then you buy something and you need to disclose where to send
40:22
me stuff which suddenly can be correlated to lots of other
40:26
things. I can almost see like the zeros
40:30
here live here in the integral here.
40:32
Very solution X4, B problem. Sure, absolutely.
40:35
But is it practical? Are you volunteering this
40:39
detail? When you are saying, this is the
40:41
end of centralized that's very thing that if a credentials will
40:47
unlock new scenarios that are difficult or impossible today,
40:51
but they will not necessarily substitute some of the scenarios
40:55
that are working well today and Said, you like it again, people
40:59
like very bright lines, primary colors, basic shapes, and simple
41:05
messages. And so, the idea of like this is
41:09
the next Evolution, which entails will stop doing what we
41:13
are doing. And we'll start using was tools.
41:15
Instead, again is misleading because some of the things that
41:20
are at has a privacy violations, in the concept of the in the
41:25
context of a consumer. Our activity can actually be
41:29
completed by Design when you are working with two suppliers and
41:34
you do need to share some information.
41:36
So, it's just a complicated thing.
41:39
I think that's where the magic comes in right, when it once, it
41:42
becomes easy enough for people to adopt or there is some sort
41:47
of cohesion between these different concepts.
41:50
You know, I think I met, I'm not sure who said it right?
41:52
But, you know, it's if it's magic or technology, doesn't
41:55
matter. As long as the result write,
41:57
Like that. So it's a 4C Clark.
41:59
It said any sufficiently advanced.
42:02
Technology is indistinguishable from Magic and I agree with you,
42:06
but one thing that I would add them enough.
42:09
So parenting is that most of us things to me are driven by use
42:15
cases as in people have an issue in very life or something that
42:22
they want to make progress in and it doesn't matter how sad
42:27
Something appears on the scene and had spent with that
42:29
particular problem. And in this space we are all
42:34
guilty of being so close to the matter into a domain.
42:38
That we often said, look at the principles and we say, OK, here
42:41
I have these new principal users must be able to control
42:45
absolutely everything. And what these website the saves
42:49
about website. Sure, and the outcome is some of
42:52
us have cookie dialogues that you see for European websites
42:57
that And they're only outcome is people just clicking okay to all
43:02
because like whatever. So if you just start with the
43:05
principal and then when we rubber hits the road, things
43:08
might not pan out the right way. And so I think that the the
43:12
pendulum has to swing a bit closer to the use case for some
43:17
of those things so that we can focus on what we can actually
43:20
do, to help the people using those new technologies.
43:24
Rather than saying, oh wow, this technology school.
43:26
I want To use it. You're such a great point is,
43:30
it's really important to step back and think about things and
43:33
kind of that philosophical way, which I think is always been
43:37
part of our industry, right? You can't just look at the
43:41
Tactical of. How do I do things?
43:43
You have to be thinking about the big picture.
43:46
I read a big picture and the people that will benefit or not
43:52
from what we are creating again. A huge fun of Suggesting to
43:59
Engineers with Award with to spend the time on forums and see
44:04
what people find it difficult, even if it's still at low level,
44:07
it always gives a glimpse of what people are trying to
44:10
achieve when you are using your tools and it's always better to
44:15
start from it rather than starting from technology and
44:18
then at a vadas engineer for me to what people might possibly do
44:22
with it, sometimes you're lucky like a remember the page rank
44:25
with Google. Okay.
44:28
When Google started then the pagerank.
44:30
It's that was incredibly successful, but no one knew how
44:33
to do money out of it. And eventually they discovered
44:37
it and I'd say, they lucked out because they didn't start with
44:41
this idea of making money, but eventually found it.
44:45
So, moving one level below, it's always possible to create a
44:49
technology and by sheer chance land on the create new use case,
44:54
I think pasta it's like we grew up, boss is very Trying to do
44:57
something else. They invented the positive,
44:59
that's fantastic. But those are rare events.
45:03
It's usually envisions better. If you start from a user need,
45:07
rather than a technology or a high horse, principal same
45:11
applies to Identity programs at large, right?
45:13
If know where you're trying to go and what you're trying to do.
45:17
A lot of times just like, okay I've seen before, right?
45:20
I would just bought this thing and that's going to solve our
45:22
problems. But you don't really know what
45:23
your what prime are trying to solve and then you're very
45:25
disappointed when the I know that the investment that you
45:28
made didn't line up with what you're trying to do.
45:31
For me a knife. If you'd rather die, always a
45:33
activate featured spinner, another one featured, Spinners
45:36
were everyone and I can, yeah, why I've got a cool one.
45:41
By the way, it's I have to as a tussle and I have and then I
45:44
have one that has lights at the end.
45:46
Well, I got a conference somewhere because it's like you
45:48
said, they're just paintings were everywhere.
45:49
They were like the swag thing back in like was it 2015 maybe
45:53
something like that. And I was like, all right, also
45:56
come to that one because that one that Was one I hadn't seen
45:58
yet. Then it's all right.
46:02
I think we've wax poetic around a number of different topics
46:06
guitar you're always great with your time and super generous and
46:08
super approachable which is Again part of the thing that I
46:12
love about the identity field itself.
46:14
But before we go I want to tell you that you have enthralled,
46:18
the identity Nation through your Twitter and this undertaking
46:23
that you took, when you before you even boarded the plane to
46:27
get here, you have a Co 2 meter and we're taking readings
46:33
throughout your journey here. First of all, again, in thrall
46:38
does the word of use because I've been following and looking
46:40
at your Twitter, it's at vibro net and you can see, you know,
46:44
the different readings. First of all, how did you come
46:47
out this idea? And then what were some of your
46:50
findings of your research here? So I stole the idea, I am Park,
46:56
okay? I told the person I'm still in
47:01
here so it's ok that if I well I guess the guy did liked the post
47:07
so I guess you have to it was. Okay.
47:10
So I'm part of a few Facebook groups of for frequent Fliers.
47:16
And one guy did this on, on the play energy a day like a, he had
47:21
a meter for proper reasons not to, like, adjust for a being
47:25
funny like I did, he is like his job.
47:27
That is like he had a number. Of it m on board and said, well,
47:31
I would be fine with to see what happens.
47:34
And so I did this post, which I found super interesting and I
47:36
said, dude, I'm going to see if his idea and I'm going to do the
47:39
same when I go to guard Elijah. So I hit Amazon and magically in
47:44
two days. I got this thing.
47:46
It was like 40 bucks, just so not particularly and finest.
47:51
Funny story after I started publishing the sweets they run
47:55
out of it because I kept having people saying oh okay won't run.
47:59
So they actually bought the enough of those from the
48:02
viglink, whether provided that they run out of it, hopefully
48:06
use like an affiliate link or some sort of referral link.
48:09
I'm not sure I might add because that guy do have a affiliate but
48:12
whenever I go on the website and never know everything, that's
48:15
it, but I found it. It's really interesting because
48:19
frankly I was surprised by the number of the things that I
48:22
found out like in particular who burn the Uber, which I took for
48:28
for going from my home. The Redmond to the Seattle
48:31
Airport, I got to almost 2000 which was like the highest
48:35
reading on the entire trip. And so what's let's establish
48:39
because people in a familiar what is Baseline like what is a
48:43
good number or good reading essentially?
48:46
So I started with my first reading outside.
48:50
They saw it was outside in the breeze and the and 400 and 400,
48:56
which like someone said that if I would have done these in the
48:59
cell, 90s. I would have been likely 200-400
49:02
because like there's almost cars.
49:04
And also, why did they do this with CO2?
49:09
They suit you to me is in many crowded places in a proxy for
49:15
exhalations of people. Hence potential potentially
49:20
covid risk. Like a a came back from a
49:23
diverse and a coffe coffee after her dodging, it for two years
49:27
and a half. So now I'm a bit sensitive.
49:29
I was always Stephen matter. But like really curious about
49:32
it, it's an imperfect measure because CO2, comes not just from
49:35
people, but like, in the Uber and convinced it was the exhaust
49:40
or a car at was going inside the car, which is not very healthy,
49:45
but also deck. There, the mass we face mask.
49:48
Want help with that, but I worried anyway, the other thing
49:52
is that you might ask still have a high level of CO2, but you
49:56
might have a keeper filters that take away the bad stuff.
49:59
Of and so high level of CO2 might not necessarily mean high
50:03
levels of potential covid. Let's say but anyway,
50:06
approximation. Also I did it for free.
50:08
No one paid me for doing it, so, whatever.
50:11
So that one was the interesting and and so the design is like
50:16
around 400 and then in an Uber was like, went all the way to
50:21
father as soon as he closed the windows.
50:24
Okay, energy. It was like 600 or so close the
50:27
windows started when soon. Went to do a deposit.
50:31
And then they think that was surprised about was, how well,
50:35
ventilated the airport was like they Lounge.
50:41
They like the public restrooms where, like, 700 800, which is
50:45
not great via the restroom in the lounge elitist.
50:48
It was a much lower. It was like a below 500.
50:51
I think the lounge was like, 500 600.
50:55
The gate was lower than launched with the literally Breeze.
50:58
I posted a little Video of my hair moving on and if a plane as
51:06
you might expect, the values went up during the boarding.
51:11
So during the boarding, if you want to wear masks, let's with
51:14
time in which you should wear it, well, I know it's like
51:17
people so also people can attract organizer which is good
51:21
but then as soon as we close with your and we went up, as
51:25
soon as we were in altitude it drops down.
51:27
Hmm. And then once we started What
51:29
the scent again I guess what we do something with specialization
51:34
and it started climbing back up. So that was that was also
51:38
interesting. And then now I am I I tried a
51:42
chat readings during the conference.
51:44
I didn't publish it because I didn't want a gadget freak out
51:47
this anger. This guy now is get him out of
51:50
here. Yeah but it was actually really
51:53
good. Thank most of the time.
51:55
It was like 500 600, which is a very good for anything.
51:59
Close the place was only one particular session which was in
52:05
it was a vendor session and it was in a smaller room with a
52:09
weird layout, it was a very wide and very shallow and there I got
52:15
to 900 but that was the only place, otherwise talk safer than
52:19
being in an Uber. Oh yes, definitely safer.
52:22
So, it was a fun project. So I think there's like a Snus
52:25
like, seal of approval and I can picture like a little sticker
52:28
with like, Your face on it, maybe the hair blowing in the
52:31
wind and then like a number that's like oh you know this
52:35
this session or this conference or this room is you know
52:38
Vittorio approved or something like that.
52:41
He ho to look low CO2, Vittorio prove.
52:44
Yeah, something like that. And love that.
52:45
I'm gonna go on zazzle.com and get the stickers, ready?
52:50
Yeah, there we go. Make sure you are well, I'm sure
52:52
we'll see like this, the shop link on Twitter?
52:55
Yes, Josh, I want to just follow up with something.
52:57
You were saying about this area being generous with At this
52:59
time, we say that a lot because everybody is very generous to be
53:04
on the show but I also want to just point out that butter is
53:07
not generous with this. I'm only to us but to everybody
53:11
and I sat down at a random to a random table for breakfast this
53:16
morning like I always do and you came up right because they want
53:20
to know who's going to be on the podcast today.
53:22
And I said, if it's Oreo and they didn't really know you, but
53:27
they do who you were. This is just go up and talk.
53:29
On like he's one of the most friendly people out there.
53:32
So this podcast kind of Time Capsule.
53:36
I think if you're listening to it and going to a different
53:38
conference type of tutorial is going to be at and maybe you're
53:42
like I'm a little intimidated because I don't know him and you
53:46
might not be friendly. No, you're wrong.
53:48
He's very friendly. Go up and say hi.
53:51
Thank you. Thank you.
53:52
I'm always happy to talk with people and I have to admit that
53:55
my ego swells. Every time someone comes and
53:58
takes a selfie Be with me and I'm so spoiled because at every
54:02
conference almost every day it happens and I always ask them to
54:06
tweet it but they usually say, yes I will.
54:09
And they don't I always feel about.
54:11
We're going to take a picture and then I will tweet it.
54:13
All right. One down, thank you.
54:15
Oh thanks. Alright, anything else you want
54:18
to cover? No, it can we let Vittorio out
54:21
onto the town? Let him loose upon Vegas, we
54:24
will let him loose, okay? All right, Victoria.
54:26
Thank you so much again, for being part of this really do
54:29
appreciate It looking for the future conversations, check out
54:32
identity unlocked. It is a very good podcast and
54:35
I'm not just saying that, but it is something that adds a lot of
54:38
value for folks, and I think it's good for people to kind of
54:41
see different perspectives, get into the Woody weeds little bit.
54:44
I will admit sometimes I get a little bit lost and sometimes
54:48
I'm learning that little bit through osmosis but at least I
54:51
am picking things up and I feel like I'm more conversant around
54:56
a subject that Victoria is touched on.
54:58
So it's definitely worth it. I don'ti unlocks find it
55:01
everywhere that podcasts are at. Basically, thank you so much.
55:05
You can find us on the web. I don't eat the center.com on
55:08
Twitter at IDC podcasts. Take a look for a further
55:11
picture that will be posted there.
55:14
You'll hear this far later than when that picture will go up,
55:17
but appreciate it. So with that we'll go ahead and
55:19
let everyone go. Thanks for listening and we'll
55:21
talk with everyone in the next one.
55:27
Thanks for listening to the identity at the center.
55:29
A podcast if you like what you heard, don't forget to subscribe
55:32
and visit us on the web and identity at the center.com.