Latest / Identity at the Center / #216 - Identiverse 2023: Identity Proofing and Passwordless with 1Kosmos

Transcript

#216 - Identiverse 2023: Identity Proofing and Passwordless with 1Kosmos · Identity at the Center

0:05
This is identity at the center. If it has anything to do with I
0:10
am this is the go-to podcast. Now your host Jim McDonald and
0:18
Jeff Stedman Welcome to the idea of Center podcast I'm Jeff.
0:23
And that's Jim. Hey, Jim.
0:24
Hey, Jeff, how are you? Oh no, that's bad yourself doing
0:27
great, man. The keynote sessions were great
0:29
this morning. Healthy dose of passkeys with
0:33
our friend. Andrew shaky are from the Fido
0:35
Alliance. I did want to mention, we are at
0:38
identity versus recording. So the month of June is pretty
0:42
much going to be the sessions that we record here this week
0:46
and yeah, let's get it going, man.
0:49
Yeah, so the first of these, Relations that were actually
0:52
second, I should say. We're, we did our open Fest it
0:54
opening festivities, kind of thing last night.
0:57
Turned out pretty well. I'm kind of Happy the way that
0:59
worked out. And now we have a conversation
1:01
with fine gentleman from one Cosmos.
1:03
We've got Jose finale of who's the chief operating officer for
1:06
one Cosmo. So we've got old friend of the
1:08
show. Not that, he's old Mike Engel
1:11
Chief strategy officer for one Cosmos.
1:13
Welcome back to the show. Mike and welcome to the show for
1:16
the first time because Ava, how are you?
1:18
How are you doing today? It was Ava.
1:19
Thank you. Thanks for inviting.
1:21
This is my first time longtime listener first-time on the show
1:24
so I'm excited, right? I did my little happy dance as
1:27
well. Well we're excited to have you
1:29
here for sure. We're going to get your origin
1:31
story. Mike, you've been here before
1:33
you were with us and episode. Well, a few episodes, this
1:36
point, there was one that I think Jim you wanted to
1:38
highlight was episode number 96, is that right?
1:41
Yeah. Absolute 96 you know Mike was on
1:44
the just talking about kind of pastoralists and identity
1:50
proofing. There's another episode where
1:52
you were talking about your role on 1414 Ventures, but do want to
1:56
highlight that because we're going to go back to past for
1:58
Alyssa and identity verification and talk about that as kind of
2:02
our main topic today. Yeah and so we're having a
2:05
conversation Mike we already know your origin story.
2:07
Will Point people back to that episode so we can get right to.
2:10
It has a flaw you're on the hot seat now because it's your first
2:13
time here tradition is that we learn people's identity origin
2:16
story when they join us with the first time.
2:19
So what is your origin story when it Comes to I am.
2:22
Is it something that you chose, or did it Choose You?
2:27
So I did choose I am and but I have to be honest, I didn't know
2:33
the extent of what I was choosing.
2:35
So my first job was out of college and I was employed as an
2:42
admin. I was running back jobs.
2:46
Running endpoint management software that time.
2:50
CEOs, pretty big right on endpoint management.
2:52
So I was, you know, for about a year, I was doing that.
2:57
And then there was an opportunity that came in with
3:00
the great socks for for compliance and said, don't worry
3:03
about these batch scripts. All you have to do is get these
3:06
reports of access for users, you know, you circulate it with
3:10
different managers and tell them that you know, do you is it
3:13
right? Is it not wrong?
3:14
Is it that sounds easy? That sounds exciting and that
3:17
was my first foray into it so I chose and then you know, one
3:21
thing led to another and how do you get the access?
3:25
How do you manage the access? And now look back then.
3:28
So I've never heard the words, great and socks in the same
3:31
sentence before and your Chief Operating Officer.
3:35
One of the things that fascinates me about this
3:36
business are titles and I'm curious.
3:39
What does a chief operating officer do for an identity
3:42
company? Like one Cosmos, nutshell, right
3:45
hand box to the left hand but mainly making sure that you
3:49
know, as organizations and especially startups, we tend to
3:53
grow pretty rapidly and Sometimes our most of the time.
3:58
So there's a lot of chaos right in rapidly growing
4:00
organizations. So how do you try to keep that
4:03
in order? How do you make sure that every
4:07
function, every department is going towards the overall vision
4:11
of the company and making sure that that particular vision is
4:14
also very clear with, you know, every Department, every member
4:18
Mike. I think, for people who aren't
4:21
familiar with one Cosmos, I know you have kind of given the
4:23
should be able for, but what's the like the 30 second or maybe
4:26
Give you 60 seconds to give us the elevator pitch.
4:29
What is one Cosmos do? What's the problem you guys
4:31
self? Yeah, well, starting with the
4:33
Genesis story and including the name Cosmos is Greek for
4:37
universe, and idea is someday, we will have one identity in the
4:41
entire universe, right? So when Ilan lands that
4:45
spaceship on Mars, you'll use your identity to prove who you
4:48
are and get into the little bubble that he builds.
4:51
And so, there's a couple standards that we all know and
4:53
love that we've talked about on the show quite a bit and We're
4:57
going to talk about those here today, but that was the
4:59
principal. The company is, let's figure out
5:01
one way to prove who you are and use that everywhere you have to
5:05
engage online. Does a great analogy, Mike this
5:10
week we're focusing on the future of identity and we came
5:13
up with this term goes to Adamas week, right?
5:16
We want to talk about how things are going to be in the future
5:19
and one of the topics that you're hearing a lot about it.
5:22
I Denver's this week, Andre brought it up in his keynote
5:26
yesterday. Was this idea of like
5:29
user-centric user managed identity is going to replace the
5:35
corporate ID P managed identity in the future, right?
5:39
So people are going to have control over their identity,
5:43
that's going to change the game. So mix that in with kind of the
5:47
buzz terms of the industry self Sovereign identity and
5:51
decentralized. Identity from the tip of
5:52
everyone's tongue and kind of want to get your ideas.
5:56
Diaz and your thoughts on, you know, how reality how real is
6:01
that? What's it going to be like, in
6:02
the future? Where we at today to start us
6:06
off, but where do you see it for five years down the road?
6:10
Well, I'll answer your question with a question when you get
6:14
pulled over by a State Trooper, not that you ever have but
6:16
hypothetically or you go up to the TSA checkpoint.
6:19
How do you prove who you are today?
6:21
TSA checkpoint. Yeah it's both of the plastic
6:25
card as guards a credential And they look at your face and look
6:28
at the credential and say they match and we know that we can do
6:32
that online. And I'd like to spend some time
6:35
diving into the mechanics of that and the privacy of that.
6:39
As we as we have this discussion today but the future of identity
6:44
must involve Biometrics and I'm not just talking about Touch ID
6:47
and face ID, right? I could have five fingerprints
6:50
on my iPhone 8 that could be long to anybody but real
6:53
Biometrics so that state trooper.
6:55
Looks you in the face. You need to do that digitally as
6:58
well and there's ways to do it that are safe.
7:00
But of course, we have had a number of setbacks from a PR
7:04
perspective with State legislation like Peppa if you're
7:08
familiar with the Illinois law suits that are going on, that
7:11
are setting us back things that happen with the IRS etcetera.
7:15
So the future is a combination of privacy Biometrics and you
7:19
mentioned self, Sovereign the terms getting a little old
7:23
these, you know, it's like nobody knew really knew what it
7:25
meant when it came out at you, Really, creating your own
7:28
identity. Well, it's user managed does the
7:31
term that I like to really use. If you're in control of it,
7:34
nobody else can use it. So, that brings up wallets and
7:38
the ability to put a credential somewhere.
7:39
Safe that we'll talk about here today as well.
7:42
Do you think three, four, five, maybe ten years down the road.
7:47
We don't carry physical will. You know, wallets are pocket
7:51
anymore and I meant have, you know, plastic, driver's licenses
7:55
that Everything is smart enabled and put on phones, is that only
8:01
for people who are, you know, modern and use smartphones?
8:05
Where do you see us? Where is it?
8:07
What's the evolution look like? Yeah, as the older generation is
8:13
not the primary user of Technology anymore.
8:15
I'll try to say it nicely, right, you'll see.
8:19
Now everybody will have a device or be comfortable with using
8:23
Biometrics, right? If I tried getting my dad, you
8:26
know, he's a 80 years old to use his phone to do something.
8:30
It's really hard for him. So that generation will be less
8:34
and less of the of the majority online.
8:37
And I think it must go to a digital form.
8:40
We can't then plastic is copyable, Right.
8:43
Forge documents are really hard to detect.
8:45
You have a, i that can now spoof all kinds of things.
8:47
So we have a lot of challenges we have to work with but it has
8:50
to go digital because of the bad guys know how to digitally
8:53
manipulate everything as well. So who's the father this
8:56
questions for you? What's it going to take to make
9:01
this happen? You know what is it is just time
9:04
that it has to kind of percolate.
9:07
And then what are the big challenges order?
9:09
The big enemies to this happening.
9:11
Maybe it's what Mike brought up there with, you know, just
9:15
generational not ready. I mean, my father doesn't have a
9:18
smartphone, you know, he's still using his flip phone.
9:22
So what's it going to take to make this happen?
9:24
Happen. You know, that Vision that Mike
9:26
just painted and what are the roadblocks or stumbles?
9:30
So in some areas in some geographies, it's already
9:34
happening. Maybe not to the entire extent
9:38
of the population. But for example, you mentioned,
9:43
you need to carry a wallet and in a lot of other geographies,
9:48
everything is on your smartphone now, including a driver's
9:51
license. So one, big proponent of that
9:54
has I mean the government's so I know that there are certain
9:59
European countries India where you get a driver's license and a
10:03
copy of that onto your phone, you have your payments on to
10:07
your wallet as well. So one big proponent of that is
10:13
even your government issuing your credentials that is
10:17
consumable into your smart device and then over a period of
10:21
time that's going to be more encompassing.
10:24
Now. And then, if you look at it, you
10:28
have to look at it with the, with the, with keeping your
10:32
customer identity, use cases. And then your Enterprise, I
10:35
think, Enterprise will be a little bit slower to it out,
10:38
just because there's more control that I need.
10:40
I need, you know, to have energy or credential, or a nadie
10:44
credential that I want to use to provision and account.
10:48
But if I'm shopping online, if I am, you know, signing up for any
10:54
kind of a government service, I want the ease of, you know,
10:59
signing to go through the identity verification once,
11:03
right? And then use my wallet to sign
11:04
up for multiple different services and then as a service
11:08
provider on the consumer side, I also don't want to take on the
11:11
liability of managing millions of different, you know,
11:15
identities or counts. So if there is More of a common
11:19
framework that is available. May be ready to essentially use
11:22
that help. You understand the walls a
11:26
little bit. So on my iPhone I've got a
11:29
wallet is part of the IOS operating system organizes, you
11:34
know, that you have got credit cards in it, so I can do Apple
11:36
pay. I've also got all kinds of like
11:40
boarding passes and other stuff that ends up in the wall.
11:43
I've got Starbucks card in there.
11:45
Is that the same wallet that we're talking about?
11:47
Or is it going to be some proprietary software that I run,
11:51
you know, download from the App Store and that's where I put my
11:55
digital credentials. Yeah, so today it is mode of
11:59
proprietary software but the industry is going towards, you
12:02
know, much more of an open wallet that you can use, which
12:05
is your wallet app into your iPhone.
12:09
And the idea is that every credential that you have, which
12:13
has been verified and the whole concept of a verifiable
12:15
credential that gets captured, Into your iPhone wallet, you can
12:21
then essentially use. So for an end user, the whole
12:26
notion needs to be that there is a in a credential that's been
12:28
assigned to me that goes into my wallet.
12:31
Let's say that's the driver's license or my certificate from a
12:35
university, my employee record. And then I can use that I want
12:39
to touch on this wallet subject, because I don't know if it is
12:42
the same wallet because we have vendor lock-in now.
12:45
So if I want to change my identity, if I'm stuck, On iOS.
12:49
How do I move to Android? If my wallet is a Apple wallet,
12:54
for example, and the same thing for vice versa, right?
12:56
With and Andrea whether it's Google pay or something similar
12:59
to that or Samsung pay is, this may be a role where some of the
13:03
password manager type Solutions, might be out there where they're
13:05
creating their own wallets is it a separate Financial backed
13:10
wallet, for example, how do you see this wallet thing?
13:15
Kind of playing out? Because I think it gets
13:16
confusing, it's okay. Well, We're talking about
13:19
getting rid of our physical wallet, but how many virtual or
13:23
digital wallets in my gonna start carrying around?
13:25
Is that an app for each one? I guess.
13:27
And maybe we grow into something or maybe we grow out of
13:29
something. I'm not sure, but I'm curious.
13:31
Michael start with. Uh, where do you see wallets?
13:34
Just, as a general going from a digital perspective.
13:36
Is it am, I am I going crazy here?
13:38
Thinking like, oh my gosh, I'm going to have like, eight
13:40
different wallets for eight different things.
13:42
No, it is messy from a standards perspective.
13:45
So Apple has Created a way to digitize mobile, driver's
13:50
license in a couple States. But the only place you can use
13:53
it is I think at the TSA and then you have Banks starting to
14:01
create their own digital identity like you mentioned.
14:04
So the viable players today that I see creating wallets globally.
14:07
We have sing paths and some government-sponsored ones that
14:10
are just amazing. When you see how well the apps
14:12
are done and how extensible they are here in the US.
14:16
It's we're 20 years, we're going to be Is behind just like we
14:18
were for the adoption of chip-and-pin.
14:20
How long did it take us to use a trusted credit card for
14:24
in-person transactions that took Target getting hacked and they
14:27
were doing it everywhere else around the world for ten years
14:30
and they're looking at us around the world.
14:31
Be like, you guys are still using magstripe.
14:34
I can program that with a five dollar piece of equipment.
14:37
So in my my opinion, the only entity that can issue a
14:41
credential reliably about who you are in.
14:44
The physical world, is the government.
14:46
That's why we have driver's licenses and passports.
14:48
And until they figure out what they want to do, you're going to
14:50
have all these tactical Solutions if Apple could
14:53
digitize my driver's license and let it be used to open a new
14:57
Saks Fifth Avenue shopping account.
14:59
I'd do it in a heartbeat. So what everybody else?
15:03
I don't know if they're not ready to tap into the states to
15:06
verify that and they don't want to take on the liability.
15:08
I would think and how that's pretty slippery slope.
15:12
So it's very messy right now. You have the mdl standard and in
15:16
a verifiable credentials which are two.
15:18
Credential standards that are out there and it's just going to
15:23
take time and market adoption timing is everything as they
15:27
say. So let's get into a little bit
15:29
about. I think the most important part
15:32
behind the wallet is, how do you actually get the credential
15:35
there and identity proofing in the first place?
15:37
So, if I'm going to have a digital identity, some
15:40
organization needs to say, okay, we are giving you, this is a
15:45
credential and is a few mentioned in India, for example,
15:47
right there. There is a couple versions
15:49
sounds like there's a physical document and a digital document
15:51
goes along with that. So let's talk about identity
15:54
proofing. Where do you see this going in?
15:57
The future is it multiple credential providers doing this?
16:03
Do you see something like Bank of America?
16:06
Does one thing Capital One does another US Bank doesn't other,
16:10
do you see maybe Consortium of financial services has like
16:15
their provider versus government has other Education or medical
16:19
and things like that. I'd like to get into that a
16:21
little bit and just kind of understand like where do you see
16:23
that? That identity proofing concept
16:26
going and maybe if we if you want to have anything else, you
16:29
want to add to that feel free. So I'll tell you today.
16:32
The identity proofing is, is primarily meant to check the
16:36
authenticity of the user as well as your physical, the car, the
16:40
plastic card, this will evolve more.
16:43
We're in this lot of friction. The user has to stand in front
16:47
of a Camera your disk and whose documents the more this becomes
16:52
digitized. Let's say there's an mdl in
16:54
place. All I need to do is to verify
16:57
with the state in u.s. that this particular mdl has been issued
17:01
by them, right? And there's a lot of
17:03
cryptographic ways to essentially do that.
17:06
So identity proofing is the means to create your credential
17:11
in the wallet. I know that's a mouthful, right?
17:13
And multiple bunch of different terms but the the what is, Is
17:18
what is required today is to essentially go through the
17:21
proofing Journey so that now I can trust the credential that is
17:25
coming in and and and the path in the future would be that I
17:29
may have to still do proofing, but I just need to prove you
17:32
know, if it's actually Jeff who is using this particular wallet
17:36
and and the credentials are coming from multiple different
17:39
sources. They coming from government
17:40
agencies and I'm just verifying with them.
17:43
What do you think is going to be the accelerator where it's like
17:46
you hit that point and it's like oh yeah this is the killer app
17:49
or can't really use case or whatever maybe that really
17:52
drives adoption because I think Mike pointed to you know
17:55
unfortunately we tend to be rather slow on some of the
17:58
stuff, right. We're behind in some areas at
18:01
least in the US but other than time budgets I feel like we have
18:07
the technology everyone for the most part has a smartphone.
18:11
Lots of services have been digitized.
18:13
And what is the thing that is going to?
18:16
Or maybe a couple things that really say, oh okay, we've hit
18:19
this inflection point and, you know, it starts to see
18:22
exponential growth versus kind of a slower path.
18:25
So saving dollars fraud reduction in fraud as the common
18:31
tribal bit, which every Industries are adopting it.
18:34
Some of the leading Industries are on the financial side
18:37
because repeated cost and Cave. I see Canada has a good model in
18:41
place. There are other Was a TI see
18:45
those two weeks back I guess and they're the discussions of
18:49
proofing is about five years ahead of what we're talking
18:52
about now they're talking about verifiable credentials how they
18:55
can essentially use it as well but yeah to answer your
18:58
questions industry wise. There are multiple different use
19:01
cases and examples kyc here in US.
19:06
Healthcare is come to an inflection point.
19:08
There is deaf cow. There are in other standards in
19:12
place. Which essentially say, I need to
19:14
be interoperable with my different networks with my
19:17
different providers and for that, I need to have an identity
19:20
wallet with a proof of identity in place as well, and then maybe
19:25
they're a couple more Industries.
19:27
Yeah, the healthcare use case is probably the most advanced that
19:30
I've seen in the United States. So there's an organization
19:34
called the Karen Alliance. Then I'm sure you've seen it to
19:36
some of the shows that we all travel together and Karen is
19:39
spelled c-- a Rin. It's not some lady's name.
19:43
It stands for creating access to real-time information.
19:45
Now and what it means is you are obligated as certain types of
19:51
providers of platforms, for example, Epic Systems must allow
19:55
you to download and access your own Healthcare records.
19:58
That's great. So, you whip out your Apple or
20:00
Google Wallet today. Right now today and go to health
20:04
and say, get my data. If the hospital you're going to
20:07
is an epic, and there's a couple other providers epic required by
20:11
law. Now, to give you access to your
20:13
Our own data, the next stage of that is to, then, to let that
20:16
data flow from one doctor to another or one provider to
20:19
another. You now, painful that is now
20:21
when you go to a new hospital in Timbuktu and they're faxing
20:24
papers or just you know they can't find you whatever.
20:27
So this Alliance Karen has brought together about 40
20:31
different, payers providers, and Technology providers, like us to
20:36
improve a Concepts and put out a big white paper about this.
20:39
It's real, it's actually happening today, so that's
20:42
exciting. The you Case was there protect
20:45
my data HIPAA that those types of principles digitized and
20:48
allow me to access it and then share it in a privacy-preserving
20:52
way. So that's exciting.
20:54
And when we see, maybe they'll be a mandate that requires this
20:57
in the banking industry. Well, now you're going to have
20:59
some things starting to happen that's one way that the path
21:02
could be accelerated. Money usually drives stuff.
21:06
That wouldn't surprise me at all because for every regulation.
21:08
Yeah. Regulations which you could
21:10
argue, could be driven by money. Let's talk a little about
21:14
pastoralist because I think this is something that I've been
21:16
bullish it on for a few years. Now, this is a space.
21:20
You guys definitely playing as well.
21:22
If we go by Bill, Gates is calendar.
21:25
The password died in 2006. I know about you but I've
21:30
already typed in three passwords today, alone to get in different
21:33
things. So, we're behind there as well.
21:36
Perhaps, where do we see password list going in the next
21:40
three to five years, is it did. You know, obviously the Fido
21:44
Alliance and getting Apple Google Microsoft kind of all on
21:48
the same page from a browser. And a mobile perspective was a
21:51
big win, we're starting to see, passkey support roll out.
21:54
I just set up passkey, I my Google account the other day and
21:57
it's great. Fantastic.
21:59
When are we going to see more of that out there and really get
22:02
into this pastor Lewis base? Michael start with you.
22:04
And then I want to hear who say, for your thoughts, from, from
22:06
your perspective, how you see it going?
22:09
Yeah, spaz wordless is here and there's a quote by Reid,
22:14
Hoffman, who founded LinkedIn. And, you know, I think he's part
22:17
of the PayPal Mafia. But he says, if you're not
22:20
embarrassed by your first release, you waited too long.
22:23
Well, that did not happen with passkeys, it's out.
22:25
There it works. Sometimes it works.
22:28
A lot of the times depending who you are your environment this or
22:30
that. So I see it breaking and lots of
22:32
places but it's here and to your point when it works works.
22:35
Well, it is the future. The Fido Alliance has really
22:39
Made this this a reality. And now the reason it's possible
22:43
it was not possible eight years ago because we didn't have a
22:46
place to keep it private key. All right, the phone's didn't
22:48
have TPMS and and the standards weren't in browsers to interface
22:52
it. So that's all here.
22:53
Now now it's a matter of working out the edge cases to make it
22:58
really a part of our day-to-day. But password list is a tool.
23:03
It is a way for you, to present a secure credential that secure
23:06
credential needs to be linked back to a real-world identity to
23:09
really prevent fraud. So what if you have a passkey
23:13
but you don't know who's presenting it.
23:16
Alright, so a lot of times the fallback comes username password
23:19
and I when you have to set up, or re buying or go back to your
23:22
cloud provider to go fetch the passkey, so I'm going to will
23:25
see a linking of the identity proofing, which we spend a few
23:29
minutes on here. With the issuance of password
23:33
list, Fido, passkeys that together something we refer to
23:36
as identity. Based authentication without
23:39
those two together, you have H ba instead of IBA HP, a stands
23:43
for Hope based authentication and we don't we don't like that.
23:46
So I had to get that one in there so I'll yeah it's here and
23:52
every organization is talking about it.
23:54
Now the path to get there, the adoption is where we see
23:57
companies differentiating in their A Journeys and on the
24:03
Enterprise side that is a much stronger adoption for password
24:07
list. Number one, they controlling the
24:10
users they control the systems and the need is just reducing
24:14
costs to. I have 100 applications on a
24:17
thousand applications. Right?
24:18
How many password reset cost that I can eliminate.
24:21
So definitely from that perspective.
24:23
On the Enterprise side, we have seen in the last two years that
24:27
every organization has some effort of password list.
24:31
When it comes to on, on your customer site, that's where
24:36
there has to be a little bit more adoption and place some
24:38
more edge cases. I don't have a SmartPhone.
24:41
I have a flip phone. Right?
24:42
How do I get those users into the mix as well?
24:46
So we can provide much more of a standardized experience, is
24:50
there a point where we say, You must be this tall to ride.
24:54
You must have a smartphone of this level of capability, TPM,
24:58
chip, or some other secure, Enclave, whatever it may be.
25:01
And you know, if we keep designing for things that can't
25:05
support it, I feel like this is where I right now is we're not
25:08
moving because we're still kind of holding on to the past so
25:11
Jeff I have the mindset that it's not black or white you have
25:16
to give the option to the user and that's what we preach to
25:21
organization that we talked to that.
25:23
Don't approach any password less initiative as I was with
25:27
passwords yesterday and I'm password list tomorrow.
25:30
I would rather have it as you introduce it and then you have
25:34
your adoption curve towards it. You incentivize them, you tell
25:38
them that you sign up for my for my password less, right?
25:42
You don't have to do XYZ, right? So I believe that's the approach
25:46
that organization especially on the consumer, the customer
25:50
facing sides. Have to adopt, give both the
25:52
options to the users, right? I think it's a really important
25:55
thing is, I think that sometimes gets lost in the messaging.
25:58
It's this binary thing, either your past.
26:00
So so you're not only the Sith deals in absolutes.
26:04
I think it's just another arrow in the quiver of an identity
26:07
professional to say. Hey this is a good use case
26:10
rapacity. Let's give that option to
26:11
people. Some people take a management,
26:13
some people won't especially think right now.
26:15
I think we're in this adoption cycle, right?
26:18
The Technology's there, the things are there but people may
26:22
not be comfortable, whatever reason, or maybe there are
26:24
different methods for delivery of that information, but if we
26:28
start providing at least as an option, great To your point,
26:32
should not be the only option. Maybe maybe it is, maybe it's
26:35
not a good option. Maybe I'll put you guys in a
26:37
spot. Is there a spot today that you
26:39
guys can think of where Pastor Willis?
26:41
Just doesn't make sense. Take every other factor out of
26:45
this cost technology political ramifications within the
26:50
organization where that looks like.
26:52
But can you think of any scenario where password list
26:55
just is not a good solution today?
26:58
Well, the definition of pastoralists is One Challenge,
27:01
as I'm doing a talk in about two hours and it's the five either
27:05
things to consider as you go password list or the five
27:08
pitfalls to avoid. And one of them is defining,
27:12
what your password is calls are, right?
27:14
Is it, if you Google? I did a little slider.
27:17
It says, here's G Petey's definition of password.
27:19
Listen, here's claude's right there.
27:20
That one of the competitors they're completely different and
27:23
Merriam Webster says to be without passwords, right?
27:25
So, so it's so vague. I mean, there's no.
27:30
Cuse that in any industry. Where you couldn't as an example
27:34
if you do it right have a webcam and just walk in front of it,
27:37
Minority Report style and boom. You're either through a choke
27:40
point or logged into a terminal and you're good to go.
27:42
Like on a manufacturing floor, wearing gloves I got a helmet on
27:45
like there's all these edge cases that you do need to handle
27:49
and I think we can get there 80-85 percent.
27:53
Pretty quickly. That 15% will be you'll need
27:56
like four or five different options to be able to handle
27:58
them. I don't know specifically of a
28:01
Example, but like the manufacturing floor if you're
28:04
full get up and you got to do stuff is not a good way to
28:07
interface with any technology. It took a while for the iPhone
28:11
to catch up with wearing masks. Yeah.
28:13
You know who couldn't do the face idea unless you brought the
28:15
mass down depending on your setting that was acceptable or
28:19
not acceptable. So what I wanted to bring up was
28:22
the user experience because it you know, I'm I'm pretty hot to
28:26
trot on the passkey. I think it's a major step
28:28
forward. I think that The user experience
28:32
committee over at Fido alliances doing yeoman's work to get
28:37
commonality in terms of how registration for passkeys goes
28:42
and things like that. But also if you sit through a
28:45
demo the four of us are all like wow that's really not that hard.
28:51
But then you know, my lens which is I think could my dad do this.
28:56
Yeah. He he would say forget this, I'm
28:59
not once he hit A wall he be done.
29:02
And so, I think that it's the Catch-22, which is it got kind
29:08
as to get to ubiquity the Catch-22.
29:11
Part being you can't get ubiquity until it's like
29:14
everywhere. But it's hard for it to become
29:18
commonplace in easy for people until it gets to that point.
29:22
So you have that that uncomfortable transition, which
29:26
I think we're just in the beginning of now to get to the
29:30
Point where her people are comfortable using the past keys,
29:35
and registering for it, and understand what's going on or
29:38
not having to understand what's going on.
29:41
But if you are going in as like, okay, use your Microsoft
29:44
authenticator and do this and do that.
29:46
And it only works within this realm, I mean that's going to be
29:49
confusing and I use my dad as an example, but even for other
29:54
people in my life, my life who are not technology people.
29:59
It's they don't want to understand and all what's going
30:01
on, they just want to get into their service.
30:04
Of course, they don't want to have their information
30:07
compromised, nobody wants that, but they don't have to jump
30:10
through hurdles. So that's where we have to get.
30:13
And I sort this transitions all about one important thing an
30:18
analyst told me and he said that we always look at the problems,
30:26
you know, from a first-world perspective.
30:28
And if you look at Latin America, if you look at Asia,
30:32
there's a large volume of users. You cannot expect them to have a
30:38
password less experienced similar to what we have.
30:42
So, it's important to understand, you know what, their
30:45
challenges are phones, Etc, and they have MFA requirements.
30:49
They just introducing the government's introducing that,
30:52
so they may still go with the Legacy.
30:54
Third of a username password and an OTP, you introduce more
30:58
friction for them. And then in those geography, is
31:01
if, you know, for this more users, would more tech savvy.
31:05
You lessen, the friction you don't have to do it three times
31:09
just to send hundred dollars from one user to the other.
31:13
But you have to understand the audience, all right?
31:17
And introduce it. And they will get to the
31:19
adoption curve just based on more technology, adoption Etc.
31:23
But Knowing knowing the user knowing the geography that you
31:28
play in as important as well. Yeah, I think, you know, in
31:31
terms of the transition, hopefully, it doesn't take as
31:33
long as this. But, you know, think about how
31:36
people did banking when we were kids, you know, a long long time
31:40
ago, they went to the bank, they stood in line, they went to the
31:43
teller and now banks have discouraged that so much.
31:48
Right. You might even have to pay a fee
31:50
to go see her tell her, right? They want you to use the ATM or
31:54
bank. Online.
31:56
The people that are parents, you know many of them are still
31:59
around and they just had to adopt adapt but their parents
32:03
are no longer around but you know so I think it hopefully
32:07
doesn't take as long to transition for password says it
32:11
has from physical Bank visits but I kind of see the analogy
32:17
has to be indistinct indistinguishable from Magic.
32:19
Really for them to be able to do it like you walk up and you do
32:22
that first time of Apple pay your a little leery.
32:24
Oh yeah. And then all the sudden you're
32:25
like holy crap, this is I'm doing this.
32:28
Every time I think that'll happen with every generation
32:31
eventually, I might be able to leave my wallet at home and that
32:33
would be a great thing just carry my phone.
32:35
I have to pay for everything and I get pulled over all my
32:39
documents are on my, my wallet on my phone.
32:43
Yeah, that'd be fantastic. Who wouldn't want that?
32:46
Well, where am I going to keep my Mary's Mountain?
32:48
Cookie punch card. So I get my six punch card.
32:51
Tell them to go verifiable credentials for crying out loud.
32:54
You exactly, right. For probably one more app on
32:56
your phone. Yeah.
32:57
There you go. Mike, even John about a bunch of
32:59
notes. Do we hit everything that you
33:00
wanted to cover today? Well, there's I mentioned
33:04
Biometrics, right? It really is an enabler when
33:08
done, right? And I want to point out
33:10
something that not too many people know about yet.
33:12
In March of this year, the White House put out a paper, it's
33:16
called the national strategy, to advance privacy-preserving data
33:21
and sharing analytics be pdsa, another acronym.
33:24
That we need and in this 45-page report they talk about what it's
33:28
going to take for the government to use Biometrics in a safe way,
33:33
and they mentioned two concepts privacy enhancing techniques are
33:37
pets and privacy, preserving data, sharing and analytics.
33:40
So how do you collect Biometrics or use Biometrics in a way that
33:43
lets you prove who somebody is without storing a bunch of
33:46
photos in a database right where bad things could happen because
33:50
when you go to the IRS to pay our taxes, do you trust that?
33:53
That face isn't going to be used against you in?
33:54
Court of law because you I don't know, look like somebody else
33:57
who got, you know, committed a crime in New York City.
34:00
Nobody is this good looking? That's right, that's right, and
34:02
indistinguishable from from the real Jeff.
34:04
So these are there's a couple Technologies now.
34:09
Like there's concept of something called homomorphic
34:11
encryption. Neural networks in these types
34:13
of things, the word homomorphic encryption is mentioned as paper
34:16
over 20 times. We are rolling out a technology
34:20
that lets you look into a camera and within one second.
34:25
At the edge can tell you if it's Jeff yes or no and send back,
34:29
basically the equivalent of a public key to a server and I
34:32
could do all this cryptographic stuff without any server-side
34:35
image is being captured. So imagine, you know, it's kind
34:38
of Minority Report. But if you knew the bit that the
34:40
good guys couldn't use your face.
34:41
All there was was a bunch of jumbled numbers in a that they
34:44
couldn't do anything with. That would be a game-changing.
34:47
I'm way to think about it and the reason that's important
34:50
we're talking about wallets and we're talking about past keys
34:53
and private keys. Coveri we didn't talk about
34:56
account recovery. What happens when you lose your
34:58
wallet, my house burned down my Android, my USB you because all
35:02
these things are gone. How do you start from scratch?
35:05
If your private keys are gone. Well, there's, there's
35:08
technologies that will allow us to potentially recover that
35:11
using multi-party Computing and using your Biometrics to be able
35:16
to recover your identity. And it's going to be a cat and
35:18
mouse game with things like defects and AI.
35:20
We didn't talk about AI either. There's a place for that and in
35:23
the in the world. Maybe that's a whole separate
35:25
episode, right? So I'm really bullish on
35:27
Biometrics and age. Verification to is really hard
35:31
and dealing with minors identity.
35:33
We didn't talk about that. How do you prove that somebody's
35:36
15 and not 13 to get in online and use Facebook?
35:39
There's new legislation that came out there.
35:41
Trying to pass a law that says you can't use Facebook if you're
35:43
under 18. All right.
35:45
Yeah. Like, that's pretty, it's pretty
35:47
serious. It's another 18 actually using
35:50
Facebook, though. Yeah, right.
35:51
Exactly too late. Maybe for the old people now.
35:54
So, yeah. These things of the Privacy
35:55
preserving, the Biometrics age verification were, and also we
35:59
didn't talk about diversity equity and inclusion who's ever
36:02
touched on a bit with, like, you know, the ability for everybody
36:04
to be able to use these Technologies.
36:06
So these are things were working on that Cantera has has a whole
36:09
D EI working group. Like, how do we do nist, 160,
36:13
3-3 with somebody who has no records?
36:16
Well, that's hard. But we have to figure it out on
36:19
the internet. Everybody knows you're a dog.
36:20
That's right. I actually think just as you
36:23
were talking about those White House paper and talking about
36:26
these different privacy initiatives.
36:29
I think that could be one of the biggest stumbling blocks to, you
36:32
know, self Sovereign identity and a lot of these things
36:35
overall. What I don't look.
36:37
I'm not like a extreme privacy Hawk, but I also see what's
36:42
happened with like this cookie thing, right?
36:45
You had every website, throws up a bars.
36:47
Like do you want to block cookies or accept cookies?
36:50
You click block cookies, forget about it.
36:53
Nothing on that website is going to work.
36:55
So if it just becomes like, hey do you give us the right to take
36:59
all your data from your digital Identity or you want blocked and
37:05
you can't use our service, you can't pay for your utility bill
37:08
online or check your usage or whatever.
37:11
So to me, privacy has the greatest potential to become
37:16
stumbling block because what happens is when the needle goes
37:20
too far in terms of you know not Respecting privacy.
37:25
Then the regulations tried to come back and they end up
37:28
overcompensating. Sometimes they become
37:31
ineffective, like this thing with the with the cookies.
37:35
Yeah, whoo. It's receive that in the
37:37
Enterprise as well. You know, you have this amazing
37:39
password list tool, you got a phone, it's secure and you used
37:43
your MDM to deploy it. And then some employees are
37:46
allowed to say, I don't want to use my phone, make me have a
37:49
corporate phone or they don't you don't have to make them do
37:51
that. And I don't know, I'm kind of
37:54
old school. Like, the way you raise kids
37:56
today versus yesterday or whatever, but don't work here,
37:59
but you can't do that, right? It's not the culture you want to
38:01
create. So, yeah, there's, there's
38:02
people that won't turn Face. I'd be on their phone and then
38:04
Fido doesn't work. They'll face idea, I don't think
38:06
you can use phyto. Passkeys with a 6-digit pin.
38:09
Can you? I think that's one of the
38:11
devil's one details claimants. Yeah, so people won't why won't
38:14
people use face ID? Because they're afraid.
38:17
Cops going to pull them over or they go to the other country and
38:20
they're going to wave the phone in front of their face and
38:21
unlock their data. And I mean it's pretty tinfoil
38:24
hat, kind of stuff. If but to each their own.
38:26
So yeah. It's these Technologies.
38:30
People can say no to them and sometimes you have to let them
38:33
operate anyway. Wasn't that just progress
38:35
though? I mean people were against cars,
38:38
right? And the phone lights?
38:41
Yeah. I mean, everything.
38:41
Yeah. It's the great cycle.
38:43
I think of human and inventions. That's right.
38:46
There's always changes heart, right?
38:47
You're changing up something. We see it all the time.
38:52
That guy kind of deep. So why do we end on a while?
38:54
No, we're in Vegas we're at a diverse and I feel like if
39:01
you've been here maybe more than a handful of times a couple
39:04
times three times, maybe you have like a secret spot that you
39:08
just kind of like go to maybe not a lot of people know about
39:10
it or it's just, you know, a safe place that you can go to
39:15
and cry over your losses right? Or celebrate your winnings.
39:18
I'm curious. If you guys have any sort of
39:22
kind of secret Vegas pot knowing that it might not be a secret
39:25
for too much longer after it gets out, has a faux.
39:28
What do you when you come to Vegas?
39:30
Do you have like a spot that you like to go Chang out?
39:33
Chill food drink show comes from Vegas.
39:39
The the spot I really want to chill is in my hotel room
39:42
because there's underwriting but if you want to spot this is not
39:48
a secret but Heart Attack Grill just for the experience which
39:51
Grill Heart Attack Grill. I don't know that one.
39:54
Oh, Okay. All right.
39:55
Try the secret. Yeah, so tell me about it.
39:59
You can eat whatever you like the portion sizes are huge so
40:04
just from an experience standpoint, go there that and or
40:09
anything on the menu usually works, right?
40:11
If you had a few drinks as well, good.
40:14
Hopefully hangover putting the heart attack Into the Heart
40:17
Attack Grill. All right, I'll check that one
40:19
out. Mike you got a secret spot for
40:21
us. Well there's a there's one
40:23
that's been on my list for ever but But you go to these shows
40:25
and you're running 18 hours a day and don't get to go out.
40:28
So we end up going to the steakhouse in the lobby, right?
40:30
But and I love a good steak, but there's one that I hope to try
40:34
tonight or tomorrow night. It's called other Mama, Asian
40:37
fusion. And I was just looking this up
40:39
before the show, it's out on Sahara Avenue.
40:41
It's in a strip mall along with two other Chinese restaurants
40:45
and it's Asian fusion and it's so hard to find that they give a
40:49
description of look for a little set of chopsticks on a sign that
40:53
can across right. And that's how you find it at
40:55
you. You will try to find in, can't
40:57
find it and it supposedly has an amazing menu.
41:02
And something they said here that I'm curious about is
41:04
Mongolian beef cheek bow, right? So, just one of those things if
41:08
you're sorry, if you're vegetarian.
41:09
But bujji, yeah, exactly. So yeah, I'm hoping to get to
41:14
there. And I'll toot about it.
41:16
If I if I happen to get there it sounds like it's almost like a
41:20
speakeasy. I have to look for the symbol or
41:22
whatever. Exactly Jim.
41:24
What's your Secret spot. I've gotta go with one with
41:26
secret in the name. It's called secret Pizza.
41:29
A new, you're going to pick that one.
41:30
Yeah that's a pizza place over at the cosmo and even if you
41:34
know where it is where it's supposed to be, you have a hard
41:37
time finding it right? Because it's like, it's not
41:40
marked. There's a long hallway.
41:43
That is more like an Alleyway that you used to get back there.
41:46
Once you're inside, it feels like a real New York City
41:49
Pizzeria. And the pizza is exactly that
41:51
style. So as somebody who lived in the
41:54
New York Metro and got actually New Jersey and got great new
41:58
york-style pizza all the time. But move down south, and it's
42:02
really hard to come by. Now, that's one spot that I
42:06
always said, you can get the full 16-inch pizza.
42:10
Bring it back to your room. Get a two liter of, you know,
42:14
your favorite sugary soda and just feel like the good old
42:19
days. Feel like you're a teenager
42:21
wolfing down a pizza again. Nice And what's yours Jeff?
42:25
Yeah. What are you Jeff?
42:27
You know, I got a few. I think it's my new toy.
42:30
It's probably my new favorite spot and I talked about in our
42:32
last episode was that place in the a turn Hotel on the North
42:36
End of the strip, there's no Casino.
42:38
So it was totally dead inside when it was in there Monday
42:40
night. My brother introduced it, to me,
42:43
it's called atomo, Gourmet Kitchen, and Pizzeria.
42:46
I talked about the chicken, which was fantastic, best
42:48
chicken I've ever had, but porkchop was amazing.
42:53
There was a Rib eye. That was fantastic.
42:57
We had a month. Margherita pizza was fantastic.
43:01
And it's just, it's kind of a newish place, I guess.
43:04
But not many people know about it.
43:05
So so you've been there once and there once you've had a steak a
43:09
chicken, well we can piece right?
43:11
So I got chicken. My brother got a pork chop, we
43:16
had a rib eye and then as an appetizer we had a margarita
43:19
pizza, a small one because we kind of got there that weird
43:23
time where it's like in between I mean, lunch and dinner so they
43:26
have like an all-day menu and then they had a dinner menu, and
43:28
so we had half an hour to kill basically, before dinner starts.
43:31
I was just get a pizza and I had just flown in from Atlanta.
43:35
That was starting that point. So, but for me, I was already
43:37
three hours ahead into the future.
43:39
So, we sat there and connected, and having, you know, had a good
43:42
old time, but it's just a little place and because there's no
43:45
Casino, there's no foot traffic. You just kinda have to know
43:47
about it, and it was fantastic. Definitely recommend it.
43:51
Amazing. Yeah, that's good.
43:53
That's that's what That's what Vegas is good for using this
43:55
kind of little spots. All right, let's go ahead and
43:58
wrap it up for this one. Mike has a flow.
44:02
Thanks for joining us. I'll have links to your guys's
44:04
LinkedIn profile on our show notes, as well as one Cosmos,
44:08
one Cosmos.com. That's one k0 smos.com.
44:15
You can find us on the web as I get all choked up here.
44:17
Just talking about password list.
44:19
Idac podcast.com we're on Twitter at idea, see podcasts.
44:24
Run Mastodon at idac podcast at infosec dot exchange and of
44:30
course you can always connect with Jim.
44:31
And I here at LinkedIn, it's been great connect with a lot of
44:33
listeners, have kind of come up and said, hello, and so thank
44:38
you for bringing back the guitar.
44:39
Riff people like the guitar riff.
44:41
So we'll roll with it until the next one.
44:43
So yeah. So don't forget to like,
44:45
subscribe, do all that stuff to help us out, get the word out
44:47
that people can listen to the sultry dulcet, tones of I sweet
44:53
identity, talk here Iran, add any of the center.
44:55
So we're going to leave it there for this week.
44:57
Thanks everyone for listening and we'll talk to you in the
44:59
next one. You've been listening to
45:02
Identity at the center. We hope you've enjoyed the show,
45:07
make sure to like rate and review and we'll be back soon,
45:11
but in the meantime, hit the website at identity at the
45:14
center.com and find us on Twitter at ivac podcast.
45:21
See you next time on identity. At the center.