Latest / Identity at the Center / #291 - Identity Bubbles with Justin Richer

Transcript

#291 - Identity Bubbles with Justin Richer · Identity at the Center

0:00
One other thing I thought of is that we're probably going to be
0:02
podcasting there, so whenever you and I get to a conference
0:05
together, we bring all verb recording equipment and try to
0:09
get a few episodes in. What happened?
0:18
Nothing happened as far as I know.
0:22
My monitor just turned off. Sorry guys I don't.
0:29
I didn't even move down the inch.
0:33
Hashtag just gym things. Oh.
0:36
My God. Alright, just Jim's poor
0:39
technology. Jim gave up, he walked away.
0:45
He's like I'm done, mark this down.
0:48
We we made it 5 minutes before we had a gym technical issue.
0:54
Well, I am back, so where was I? I'll start.
0:58
Over. I don't remember where I about
1:02
where I was I guess. It was too close to the mic.
1:05
You keep bouncing around. Yeah, my my screen is kind of
1:09
flickering, so hopefully I got everything set up here.
1:18
This is identity at the center. If it has anything to do with
1:23
IAM, this is the go to podcast now your hosts Jim McDonald and
1:30
Jeff Steadman. Welcome to the Identity the
1:39
Center Podcast. I'm Jeff, and that's Jim.
1:41
Hey, Jim. Hey, Jeff, how are you?
1:44
Oh, not so bad yourself. Doing great man.
1:47
It's definitely summer here in Georgia.
1:50
It was about 100°F the other day or yesterday and man, I'm
1:56
feeling it. But fortunately I work in an air
2:00
conditioned building and you know, I, I'm feeling it when I'm
2:03
outside and that's for 10 minutes.
2:06
First as I run to my truck that is also air conditioned and then
2:10
I go to drive through windows and I can feel the air
2:12
conditioning emanating from those buildings.
2:15
So I I can't complain too much. That's kind of how I feel about
2:19
like winter is I work. When I lived in a wintry area
2:23
like Chicago, it was, well, I'm inside where the heat is and
2:25
then I'm in my car where the heat is, and then I'm walking
2:27
outside to somewhere and then I'm somewhere where the heat is.
2:30
So same thing. But yes, definitely hot.
2:33
I'm in Minnesota today, so another week on the road for me.
2:37
But we'll see how hotel Wi-Fi holds up for this episode.
2:41
But so far so good. Not quite as hot here.
2:44
My watch says it's 69° here in Minnesota.
2:47
So nice. Yeah, that's definitely not too
2:50
bad. And by the way, Father's Day
2:53
just passed here in the US and I've received a pretty awesome
2:56
award, Greatest Dad of all time. It it's great because I also got
3:03
a commemorative notebook which has all of my past awards #1
3:08
Dad, Best dad ever. That's pretty much it.
3:14
I mean #1 dad and best dad ever, and now the greatest dad of all
3:17
time. I think that's the trifecta.
3:19
What do you think? Well, I'm not a dad, so I'm, I'm
3:23
feel bad for all the other dads who thought that they were
3:25
number one. I guess.
3:26
What are they? Are those like, you know, fake
3:28
news, false, false prizes? Their kids are lying to them.
3:32
I mean, which one of those poisons do you want to pick?
3:36
I think so. I think they've, they've been
3:38
buying the coffee mugs as a number one dad and giving it to
3:42
their dad. And really, they should have
3:44
been giving it to me. Apparently I am the greatest dad
3:47
of all time. Oh well, congratulations on your
3:50
major. Award.
3:53
Thank you, Sir. All right, what else do we have
3:56
going on? We, we forgot to mention last
3:57
week, but we're definitely gonna beat Identity Week coming up
4:00
later this year. Identity Week.
4:01
Europe has already passed by the time people listen to this.
4:03
But we do have discount code for both America, which is in
4:07
Washington, DC, September 11th and 12th.
4:10
IDAC 30 gets you 30% off of your registration.
4:14
And that code is also good for Singapore, which is October 22nd
4:17
and 23rd. Jim, you and I are going to be
4:19
in DC September 11th and 12th. We're going to start to work on
4:23
plans in that probably the next, you know, few weeks here, but
4:25
hoping to see some, some friendly faces there.
4:28
What do you think about DC and Identity Week?
4:31
Well, I think it's going to be hot as heck in DC at that time.
4:35
Oh wait, you're going to be inside.
4:37
Probably be. It'll be perfect weather.
4:40
I love DC. There's a few things I really
4:42
love about it. One is a sandwich shop called
4:44
Potbelly's, which I think is in a lot of places, but it's not in
4:48
the Southeast. It's a.
4:49
Chain a small little place like McDonald's.
4:53
Well no no like McDonald's is everywhere and Potbelly's is not
4:58
here and I love it. I I would eat there at least
5:02
every week if I lived there. Also the museums are pretty
5:06
awesome. Last time I was there, I went to
5:09
the Holocaust Museum, which is free.
5:11
And man, it's like, it's pretty somber.
5:14
But I think it's an experience everybody should go through.
5:19
And then I just feel like, you know, when you're in DC, like
5:22
there, you know, there's so much going on.
5:24
So, yeah, I'm really looking forward to it.
5:27
Plus, I think the conference is going to be awesome.
5:29
I mean, you know, you've been there before you told me about
5:33
it. It sounds like it's becoming one
5:35
of the conferences people have got to get to and and give it a
5:39
shot. Yeah, definitely.
5:42
I think it comes at a good time of the year too.
5:43
It's kind of a lull in between like Adeniverse, which just took
5:47
place a couple weeks ago and then like Gardner, which is
5:49
later in the year. So I think it's really good kind
5:52
of opportune timing. So yeah, hopefully see lots of
5:54
people there that we know. I know last year there was quite
5:57
a few people there was like, wow, OK, there's some, there's
5:58
some names at this conference. So I'm expecting, you know,
6:02
similar and or better turn out for this year as well.
6:05
So that's kind of exciting, but hopefully people take advantage
6:08
of that. That code's a good way to show
6:09
support for us. We'll have link in our show
6:11
notes so people can can use that as well.
6:13
I'm looking forward to the conference in terms of, you
6:15
know, hopefully we can record a few episodes.
6:19
And while we're there, I mean, whenever we go to conferences,
6:22
bring all of our recording equipment, try to record a few
6:25
episodes, put out some more additional content for the
6:29
listeners. And I think people appreciate it
6:31
because one of the things I noticed is that most of the
6:33
episodes get a lot of views, get a lot of downloads.
6:37
So we'll keep doing it unless, you know, we hear from people
6:40
that it's too much, it's too much, dial it back.
6:43
It's never too much. You can never have enough
6:45
identity center in your life. So we're just going to keep
6:48
doing it. We don't do it for you.
6:50
We do it 'cause we like to do it.
6:51
No, I'm just kidding. We do it for you too.
6:53
That's why we started, though. We started out just doing it
6:56
because we like doing it because.
6:58
I mean, we're going to keep doing it as long as we keep like
7:00
keep liking to do it and we do. So that's good.
7:02
All right, let's get going with the show.
7:05
Let's talk about Bubbles vaguely cryptic topic.
7:09
We've got Justin Richer. He's security and standards
7:11
architect and founder of Bespoke Engineering.
7:13
Joining us again. Welcome back to the show,
7:16
Justin. Hi, Jeff.
7:17
Hi, Jim. Thank you guys for having me
7:19
back on. Yeah, thanks for taking the
7:21
time. It's been about a year since you
7:23
were with us. You've already given us your
7:26
origin story. That was back in episode 222.
7:29
We're on episode 291 now, so we'll point people back if
7:33
people want to learn more about your background.
7:34
But let's talk about the past year.
7:38
How's your year been, what you've been up to?
7:40
Anything new and exciting? Oh man, it's, it's been a busy
7:43
year. So we had the GANAP protocol is
7:46
now with the with the RFC editor.
7:48
So that'll be becoming a, a final RFC soon.
7:53
It still takes a while even when it's at that stage, but
7:56
hopefully soon. We had HTTP message signatures,
7:59
which is another draft that I've been working on for a few years
8:01
that is now an RFCR FC9421. And so that's exciting to go to
8:08
see go through. And then also in the ITF, we
8:12
have spun up the workload identity in Multi System
8:15
environments or Whimsy working group and that is new work and
8:20
I'm helping Co chair that at the ITF.
8:23
And that we've just gotten that started really within the last
8:28
year, which is absolutely breakneck speed by ITF standards
8:31
to get a new working group up and running in that time.
8:35
That is pretty quick and and you've got a great acronym,
8:40
Whimsy, which is awesome. It's right up there with Cheeto
8:43
for Chief Identity Officer. I I can't I can't take credit
8:47
for whimsy. We, we originally tried to do
8:51
workload identity in distributed environments or wide.
8:54
And it turns out that there is a, there's already a, a project
8:58
named that. So they wouldn't let us have
9:01
that. But the security AD came up with
9:04
whimsy when brainstorming with, with a few of the folks that
9:08
were proposing it. So and I, I absolutely love it.
9:11
It's give nerds enough rope and we will like we will come up
9:15
with the most ridiculous set of acronyms that you can possibly
9:19
possibly use. Yeah, but you know what?
9:22
It's all about marketing, right? If you, you have to have a good
9:24
name for your thing, otherwise they'll never get traction.
9:28
And Whimsy's a great name. I, I, we're gonna, I wanna dig
9:31
into that more 'cause there's another one that you were
9:33
mentioning before we hit record called Spiffy, which is even
9:35
awesomer. So it's like between Spiffy and
9:38
Whimsy and Cheeto. And I'm sure there's other ones
9:41
out there. Oh yeah, Spice is just starting
9:44
up too. So, you know, that's a lot, lot
9:46
of lot of good stuff. And yeah, naming things is
9:50
worth. We're gonna get to that in a
9:52
second. I wanna ask you about
9:53
Identiverse 'cause I saw you in the hallway.
9:55
We kind of chatted for a couple minutes there while I think, I
9:57
think I was coming from a recording and walking somewhere
10:00
and you were sitting in a chair holding court as as you do.
10:03
What did you think of the conference this year?
10:06
Any thoughts? Overall it was good.
10:09
Honestly most of my time I got pulled into hallway
10:11
conversations this year it was it was a hallway con for me.
10:15
Just a lot of good conversations with people that are working on
10:20
lots of interesting stuff. The the big topics this year
10:23
really seem to be like authorization.
10:25
Absolutely a big topic this year that's really kind of coming out
10:29
into its own. All the workload stuff like for
10:32
example, like we're doing with whimsy that showed up in a bunch
10:35
of different spaces. And so that was that was really
10:37
good to see. And it's interesting seeing all
10:40
of this stuff happen in, in a world where like O auth and open
10:45
ID connect stuff that I helped like define and and build.
10:49
It's not the new stuff anymore, right?
10:51
That's that's the old guard that's been around for over a
10:54
decade. Like let's what's, what's next?
10:56
What are we? What are we building on now?
10:58
And to me, that's really exciting to see what the new
11:01
takes are on solving not only the same problems, but also like
11:06
problems that that stuff just doesn't solve well.
11:08
It never, it was never meant to solve well.
11:11
And so, yeah, seeing a lot of people working in just, I, I
11:16
think we're really seeing a lot of new flourishing ideas in a
11:20
lot of different spaces in the identity community right now.
11:23
And most of them are probably going to end up being bad ideas.
11:27
We don't know which ones those are yet.
11:29
And I, I think we'll see some really, really cool stuff
11:33
landing over the next couple of years.
11:36
That's a good perspective. And I think a lot of the things
11:38
that you talked about with, you know, the whimsy, the swiffy, it
11:42
all is going to tie into this concept of federation bubbles.
11:47
You're going to kind of educate us on today.
11:49
But you start at the most simple level.
11:51
What is the use case that the federation bubbles concept is
11:56
meant to solve and kind of how how did you stumble into this
12:01
And you know, tell us the give us the background.
12:05
Yeah, of course. So the whole concept I'll, I'll
12:08
start with like what an idea of a bubble is and then it'll make
12:12
sense of a little bit more of where it fits.
12:15
The idea of a bubble is that you have a network of systems
12:18
wherein everything is just kind of self-contained.
12:22
So you have accounts that work, applications that work,
12:25
authorizations, all of that. And then you have controls about
12:28
how stuff gets into that system and how stuff gets out of that
12:33
system. So how I provision accounts in
12:34
and how I can use that as a launching point to provision
12:37
stuff outbound. Now where this really ends up
12:42
being pretty useful is places where you have disadvantaged
12:46
environments. So you have systems where you
12:50
might lose network connectivity. One of the places that.
12:53
So I've been working with Uber Ether on this project for about
12:56
the last year or so and they do a lot of Department of Defense
13:00
and sort of forward deployed type of stuff.
13:02
This is cases where you literally have a bunch of people
13:04
on a boat and then that's going to go sail off and you're going
13:08
to be outside of satellite coverage, outside of
13:10
connectivity range. Or even when you do have
13:13
coverage, the latency is so high that traditional federation
13:17
concepts and protocols just don't really don't really work
13:20
anymore. Like bouncing somebody back to
13:22
their home IDP back on their, you know, their base or back at,
13:27
you know, DoD somewhere is not not really going to work because
13:31
it's going to time out before it ever it ever returns.
13:34
And so you need to have a system that works within this sort of
13:39
sometimes disconnected environment.
13:42
The other thing that got me really interested in this is
13:45
that years and years ago, you know, several, several jobs ago,
13:49
I was working at a company called Mitre and we were doing a
13:53
lot of rural search and rescue work at the time.
13:56
I was doing interface design for unmanned aerial vehicles,
14:01
drones, we would call them today.
14:03
And one of the things that we found in that environments is
14:09
that we would go work with these groups that you got a whole
14:13
bunch of people that just kind of show up to help with a rescue
14:17
operation or help with disaster recovery.
14:19
And you might not be able to identity proof these people.
14:23
You might not be able to tie them back to anything in
14:26
particular. But you know what, you're here,
14:29
you can hold a shovel, that's good enough.
14:31
Here you go. And we really felt that in going
14:36
into this bubbles project, we really need felt that we need to
14:40
be able to extend that into the digital space.
14:43
Like you're showing up in the fact that we are together in
14:46
this same space means that like I trust you enough for right now
14:51
to do something. And that trust didn't come
14:56
provisioned from some central system that said, Oh yeah, you
15:00
know, you're, you're down here in this in the same area that
15:04
this other person is going to be.
15:05
And so you can work together and here's all of your policies and
15:08
here's all of your accounts and all of that.
15:09
It's like, no, we just showed up and we might not have even known
15:13
that each other was going to be there and we're going to figure
15:16
out how to connect. The thing is we do this type of
15:20
dynamic connection all the time today.
15:22
But the way that we do it is that people show up and we just
15:25
hand them a username and password on a sticky note and
15:28
say, Hey, this is your account. And and we're going to burn that
15:31
account when when you leave or when we remember at some point,
15:35
hopefully in the future. And The thing is like, we're
15:40
doing that same type of thing for people that we've that just
15:43
rolled up off the street and people that we have a long
15:45
standing relationship with. And occasionally people that are
15:49
actually are provisioned in our sort of larger environment.
15:53
We just don't have the latest updates yet.
15:55
So we're treating all of these accounts exactly the same and
15:58
they end up all basically in this muddy mess that occurs out
16:04
in these sort of edge environments.
16:06
And So what we wanted to do with this concept of a bubble is like
16:10
embrace that mess and figure out like, what is it actually mean
16:15
to work within that type of system?
16:17
What are the constraints here that we need to to work with?
16:20
But also on a very practical level, what does it mean to
16:25
onboard somebody into that from a trusted domain, from an
16:28
untrusted domain, from no domain at all?
16:30
And what does that look like within these systems once we
16:35
actually get all of those tied together?
16:37
So it's the idea here to have like this, I don't know,
16:40
serendipitous. I am force field that sort of
16:43
gets erected for a short time. Is it something that's a little
16:48
more permanent maybe based on location or use case?
16:53
Like help me understand, like how these little bubbles, is it
16:56
one bubble or are these bubbles connected in some way?
16:59
Oh, there's many, many, many bubbles.
17:01
So the idea is that we want to really draw the perimeter down
17:07
as far as we can, and so that when we have one of these groups
17:12
that's going out into the field, we create a bubble for that.
17:17
And we provision into that bubble all the stuff that we
17:20
know ahead of time. It's like we might have 20
17:22
accounts that we know are supposed to be in there.
17:25
So we can drop those in there, We can drop default policies, we
17:28
can drop all sorts of stuff into that, create this entity and
17:32
then send it off. Now, what's important here is
17:34
that this creates its own separate entity and managed
17:39
space, because a lot of people that are listening right now are
17:42
probably thinking, oh, OK, what we're talking about is I have an
17:46
IDPI, have a user data store. I'm going to create a Shard.
17:49
I'm going to just Shard my ID system.
17:53
And you get a copy and you get a copy and you get a copy.
17:55
And then eventually we just need to reach some sort of consensus
17:59
mechanism about any updates and then it'll all be fine.
18:02
It's a, it's a synchronization problem.
18:05
But what we found is that that doesn't take into account the
18:07
type of dynamism that you actually see out in the field
18:11
where you've got people coming and going.
18:14
You've got people making these real runtime decisions.
18:17
That it's not that I don't have the latest policy to address
18:21
this, it's that the policies never thought of this.
18:25
They couldn't predict this. But I am in a position out on
18:29
the edge where I need to make a decision.
18:33
And So what happens historically is that This is why people
18:36
create admin accounts with the password admin because they just
18:40
need to be able to override a couple of things locally just to
18:42
get something done because they're out there in the edge
18:45
and they need to do something. So, you know, let's go back to
18:48
the to the disaster recovery scenario.
18:51
You're out there and you've got a bunch of people that show up
18:54
out of nowhere and just want to help.
18:56
You got a, a group of people that roll up in a pickup truck
18:59
and say, Hey, we're electricians and you can say maybe you are,
19:05
maybe you aren't. I like nothing is on right now,
19:08
so I can't actually check that. But you look like you have
19:11
electricians tools and you know what I'm going to assign you to
19:14
go, you know, to, to clear out to go clear the wiring on that
19:18
block and hand me whatever credentials you have.
19:21
And we will clean up the mess later of authorization and
19:25
everything else. We will figure this out later
19:27
when we actually have the time, because right now it's more
19:29
important that we get people who can hopefully go do things out
19:35
there and working to try and help us out.
19:37
And, and it's the same type of thing that happens in all of
19:42
these types of environments that we're looking at.
19:44
Like we have some type of local information that wasn't
19:48
accounted for that you know what, I'm going to make a
19:51
decision right now and I need, I should be able to write down why
19:57
I made that decision. What was the provenance of that?
20:00
What was the input to that decision making?
20:03
And then push that out into some type of auditable log so that
20:08
when I do reconnect, it's not just, oh, just give me the new
20:12
copy of everything. And that wipes out all of the
20:14
local changes that I made. No, it's like, hey, here's the
20:17
set of changes that I made, right.
20:19
Here's the set of decisions that I made locally.
20:22
And maybe some of those are going to be like, oh, wait,
20:25
those three guys showed up. Yeah, they don't actually have
20:28
journeyman's licenses. So go send a licensed
20:31
electrician to check that entire block that we assigned them to,
20:35
to make sure that that is actually correct.
20:37
Because that is a realistic way to deal with that type of, you
20:42
know, breach effectively that we've given somebody access to
20:46
somebody to something that they didn't necessarily have the
20:49
right to. But given the context, it seemed
20:52
like it might have actually been a good idea for us to do that.
20:57
So Justin, is Federation bubbles a concept?
21:01
Are you working toward it being a standard or is a product or is
21:06
it all those things at once? That's a great question, Jim.
21:12
So I will say it's not a, it's not a product or a single
21:15
standard. I don't think that there is a,
21:17
that the solution to this is going to be a single protocol
21:21
stack. And I can talk about that more
21:23
in a little bit. It's a, it's a proof of concept
21:28
that we've been building out in, in different layers and pieces.
21:31
So for example, we've got an identity provider just to make
21:35
things very concrete, we, we built out an identity provider
21:39
that the first time you log in, you give it your identifier.
21:44
If it doesn't know you, it goes and figures out where your home
21:47
IDP is, does a dynamic connection to that.
21:50
You log in from your IDP and then you immediately,
21:54
immediately get prompted for a web authent credential.
21:57
And then the next time you show up at that same IDP with that
22:00
same identifier, you're only prompted for the web authent
22:04
credential because we've already gotten all of your attributes
22:07
from the IDP. We have already, like we took
22:09
that step of validating your account.
22:12
All we need to do now is log you in and we have the machinery to
22:15
do that locally without having to reach back out across the
22:18
network every time. So we do that heavyweight
22:20
federation operation as an onboarding exercise and then
22:23
from there we are just doing an authentication operation and
22:28
there's some fantastic technology that lets us do that
22:31
in a way that's secure and you know, user friendly and all of
22:34
those good things today. On top of that, we've also built
22:39
out with these prototypes at Uber Ether, these trust bundle
22:44
domains to allow you to, to address these different systems.
22:50
So one of the things I mentioned is that, you know, we think that
22:53
there's going to be a lot of different bubbles out there and
22:56
they're all going to be sort of coming from different trust
22:59
routes and they're not all tied to the same route.
23:02
So you've got folks coming in, you know, going back to the, to
23:07
the military side, folks coming in from the US, from the UK,
23:11
from, from France, some other, some other partners coming in.
23:16
They're all going to be having their own trust roots, their own
23:20
policy roots, their own account roots.
23:22
It's ridiculous for us to assume that they're just going to want
23:26
to synchronize everything into our system so that so that ours
23:29
work, especially when we are not willing to synchronize our stuff
23:33
back out into their systems. And, and it's funny, as soon as
23:37
you bring that up as an option with a lot of people in the
23:40
space, you get like the looks of shock and horror are like, like,
23:44
why would we ever do that? That's a security risk.
23:47
That's a privacy risk. We would never do that.
23:48
It's like, OK, but you're asking everybody else to do exactly
23:51
that in order for these things to work.
23:54
And so sorry, go ahead. I, I, I want to ask about that
23:59
item, about people not trusting the sink backwards.
24:03
I mean, it seems like if you're establishing some sort of IM
24:07
bubble, why wouldn't you want to sync back some of that data or
24:10
some of those attributes for future use?
24:14
Maybe it's, hey, wait, this guy is a license, we've verified it
24:17
here. Would you want to carry some of
24:19
that information forward? I mean, I'm trying to think of
24:22
like obviously the security aspect of it, but I would think
24:25
enriching data is generally a good thing though.
24:28
Well, yeah. And in the bubbles construct, it
24:30
absolutely is. We would expect these bubbles
24:32
not to just be, you know, input only views of the world 'cause
24:38
they're out there collecting all sorts of information that is
24:41
going to be useful to other parties in the network.
24:44
And so we would want that to not only propagate back up any type
24:48
of tree, but we would also want to be able to share that out to
24:52
other peers. So let's say, for example, you
24:56
know, we're, we're AUS thing and we, we show up, we've got our
25:00
bubble and one person comes over from the UK and we onboard them
25:05
into our system. And then then we go and we
25:09
connect our system out to the French system and we can say
25:13
like, oh, hey, we have this, we have this Brit with us and we
25:18
validated it. Here's our record of the
25:20
validation that we did and we can assert that out to you.
25:25
So in other words, we're kind of doing an identity proxy at this
25:29
point, but it's not, it's not the traditional real time online
25:33
proxying where you're sending them out to the IDP and then to
25:38
our IDP and then to the other system all at runtime.
25:40
It's we did that once we wrote it down, here's the record.
25:44
If this is good enough for you, then great, trust it.
25:48
If not, there's a record in here that says, hey, that's where
25:51
this person's IDP is. So they might connect out to the
25:56
French system, which then says, you know what, OK, fine, for
25:59
today, we'll let you in. But if you want to come back
26:01
tomorrow, we need to talk to your IDP.
26:04
Once we're back online, we're going to talk to your IDP to
26:06
make sure, really make sure that that is the right type of
26:10
connection. And this is that type of data
26:12
augmentation that is really, really rich that ends up getting
26:16
just completely sort of chopped and lost in systems today.
26:20
Because right now, like I said, what happens is somebody like
26:23
that shows up, It's like, oh, fine, we'll just make him a
26:26
local account so that they can log in.
26:28
And then, and then you lose that entire chain of information,
26:31
right? You lose all of that rich
26:33
information. So now when it goes to, for
26:36
example, audit things six months later after all of this is, is
26:41
done, you, you can say, well, I there was somebody that made a
26:46
local account named Jay McDonald.
26:48
We don't, that's all that we have.
26:51
You know, he did a bunch of things.
26:53
We don't know what that means where as opposed to like, no,
26:57
this is Jim, he came from here. We onboarded him On this date.
27:00
We checked the provenance on these, on these dates and these
27:04
are the things that he did within the system.
27:06
And it's like, oh, by the way, when I'm back online and I'm
27:09
doing this sort of, it's not, it's not really a reconciliation
27:13
in a classical data sense, but it's kind of a this, this
27:16
reconnection exercise. I can go back and say, oh, like,
27:20
hey, Jay McDonald came from you guys.
27:25
He did some shady stuff. And this is the nature of the
27:28
shady stuff that happened. You might wanna, you might wanna
27:32
look into that account a little bit, 'cause we had to like, we
27:35
had to like shut them down and cordon them off over here for a
27:38
little while. And that might be news to to
27:42
Jim's organization or that might have been why they sent Jim, you
27:46
know. That's just Jim.
27:47
That's just Jim doing Jim things.
27:50
Exactly. It started.
27:51
Sorry to pick on you, Jim, but you know, just to make it, just
27:55
to make it really concrete, these are the types of like
27:59
really local, really individual types of decisions that we,
28:03
we've got to make. And this notion of, oh, we can
28:07
just centralized all of our identities that really starts to
28:12
fall apart. So to to the synchronization
28:14
thing, that is absolutely key to the whole Bubbles concept and
28:19
prototypes. It is antithetical though to an
28:24
identity Shard because if I am only supposed to have my subset
28:29
copy my subservient copy of some portion of the IDP, well then
28:35
what are all of these other accounts doing there?
28:37
That's, that's aberance. That is, you know, I'm going off
28:41
of what I was told was OK, and now synchronizing with all of
28:46
that. Does that mean that I'm supposed
28:49
to just throw that out? I'm supposed to eject all of
28:51
these people that I've onboarded?
28:54
Because if you tell me to do that, what am I probably going
28:56
to do? Just go make new accounts as
28:59
soon as the synchronization is over, right?
29:01
Because people need to get things done at the end of the
29:03
day. This, and this goes back to
29:06
something I, I know I mentioned in the last show, I very, very
29:10
deeply feel that security needs to serve functionality.
29:15
You know, it needs to be there to protect systems, absolutely.
29:18
But it's only as good as the functionality that it enables
29:24
and not the functionality that it prevents.
29:27
Not the attacks that it prevents, not the, you know,
29:30
the, the off label stuff that it prevents.
29:32
It's only as good as the positive functionality that it
29:36
enables. Well, you're talking about the
29:39
the usability of security, which I think is, is hugely important,
29:42
right? It doesn't matter how many rules
29:44
you have, if they're not designed around humans, I think
29:47
it makes it just that much more difficult to comply with.
29:50
I want to ask you one more question about the bubbles
29:53
because now I got my head thinking here about these
29:54
different kind of use cases. Can two bubbles merge to form a
30:00
bigger bubble? So in that example that you used
30:03
of like, OK, well, here is, you know, the US and England and
30:06
then France. And what if the US and England
30:10
are working on one thing and then they kind of are working on
30:13
the same thing? Would it become one big bubble?
30:16
Would it be two little bubbles that are kind of Federated to
30:19
each other immediately? Like how do you see that kind of
30:21
use case taking place? So I, I, I see it happening in
30:27
two potential ways, although I think we'll see what it really
30:30
looks like once once this type of thing is deployed and people
30:34
start throwing it up against the wall to see what breaks.
30:37
But where I see it happening is in that type of scenario.
30:41
I think that if you have an environment where you have two
30:44
existing groups that need to come together to work on
30:47
something together, you create a new bubble for that working
30:52
together portion. So either one side or the other
30:56
is going to host it, or you're going to create a new
30:58
environment where all of this actually happens.
31:01
And we see that pattern in the research and academia world with
31:06
virtual organizations and like, people will go stand up a lab
31:10
that is, yeah, you know, a partnership of seven different
31:13
universities and a bunch of commercial firms and some
31:15
government funding, right. Like that's that's exactly the
31:19
type of like weird collaboration that we should be taking
31:23
inspiration from. Now, in the academic world, the
31:26
assumption is that you're online so that you can check ID PS, you
31:29
can check account records, you can do all of that type of
31:32
stuff. But if we take that type of
31:34
dynamic environment and move it into this space where it's a lot
31:38
more dynamic and it's not like we can't really sit down and
31:43
plan this over a, a bunch of grant writing sessions.
31:47
We just kind of have to make it happen.
31:50
Like that's the type of space that I'm talking about.
31:53
So to me, I think the most sensible thing would be for a
31:58
these organizations to create sort of a new bubble that
32:05
running somewhere it almost doesn't matter where at this
32:07
point, but it gets on boarded by members of both of those bubbles
32:13
into that space. So now you have this separate
32:15
independent environment that is then sort of parented to two
32:20
other places and it knows how to talk back to both of those, both
32:25
of those other domains. And immediately you can start to
32:29
see where the Shard thing doesn't work anymore because
32:32
like this is not a subset of either of those.
32:35
It is a subset and union. And this is the type of math
32:41
that doesn't work with trees, right?
32:44
They they get too, too tangled with each other like this.
32:46
We are very deeply into graph territory now.
32:50
Justin, you mentioned a company that you're working with on this
32:54
federation Bubbles concept, Uber Ether.
32:57
I've never heard of them. What did they do?
33:00
So Uber Ether is a technology integrator in the US They do a
33:04
lot of work on the federal government side, a lot of
33:07
identity platform type of stuff. So a lot of government agencies,
33:13
you know, don't have the don't have the IT depth to go and
33:18
stand up a secure identity system.
33:21
Uber Ether will run that. They don't actually, they don't
33:26
have an identity sort of a core identity product like a Ping or
33:30
Ford Rock, although I guess that's the same thing now or, or
33:34
anything like that. But but they will give you a
33:39
platform that runs that and sets that up with all of like the
33:43
provisioning and all of the bits and pieces that make the most
33:46
sense for that given agency and organization.
33:50
And a big part of this, a big part of what they've been
33:54
working on is stuff with the Department of Defense, which as
33:57
you can imagine, both needs pretty advanced functionality
34:01
and is also, quite frankly, 20 to 30 years behind the times in
34:05
terms of this notion of what what technology we actually feel
34:12
like running. Like I mentioned, I used to work
34:16
for a company called Miter. We did tons of work with the US
34:19
federal government. I was on the research side, but
34:22
I still touched a lot of the customer side stuff while I was
34:25
there. And I remember back, I want to
34:30
say this was like, this is about 10 years ago now, but talking
34:35
with a government group even then.
34:38
And they were like, well, we just heard of this new thing
34:40
called SAML and we're thinking about using it, but we're not
34:45
sure yet. And the reason for this is that
34:49
these systems move very slowly. And some of that's a good thing
34:54
'cause it's a little bit more predictable, but it also you,
34:59
you lose out on a lot of the like, well, we need to go solve
35:01
all of these problems. And we're trying to do it with,
35:05
with this technology that has been around for 30 years.
35:10
It's it's a really difficult mismatch.
35:13
So anyway, Uber Ether will basically build and run modern
35:21
identity platforms for all of these different groups they
35:25
specialize with, with the federal stuff.
35:27
But it's not just necessarily that space.
35:32
Cool. So you had mentioned a couple of
35:34
standards. I wanted to talk about those.
35:37
The first one was whimsy, the second one was spiffy.
35:40
Can you kind of give us the overview of what they do and
35:44
maybe an add on of what the tie in back to Federation bubbles
35:49
was? So starting with whimsy.
35:52
Yeah, of course. So they're actually, they're
35:55
actually related. So Whimsy is the workload
35:58
identity and Multi systems environments working group in
36:02
the IETF, the ITF being the standards body that gave us
36:06
things like HTTP and Oauth and TCP and TLS and all of these
36:10
other great acronyms. And what we're doing with with
36:15
Whimsy, which has to be one of my favorite acronyms to date, is
36:22
we're trying to look at the space of workload identity.
36:25
So let's say you're out and you you need to spin up one of
36:29
these, one of these bubbles. Well, that's a stack of software
36:34
and all that software is just going to be kind of like waking
36:37
up. And just like in its
36:39
environment, you need to know that your database is connecting
36:44
to the right things. That your your API processing is
36:48
going through all of the right channels, that your filters are
36:50
all lined up in the OR in are lined up in the in the right
36:53
ways. That everything is running
36:55
software that actually has a good software bill of materials
36:59
to it that all of that's BeenVerified and validated and
37:02
you need to be able to secure and reason about all of the
37:06
connections between all of these pieces.
37:09
Well, solving that is actually where solving parts of that is
37:13
actually where Spiffy comes in. And I always forget what spiffy
37:17
stands for. It's secure something identity
37:22
for everybody. It's SPIFFE will have a, a link
37:26
in the, in the show notes, I'm sure.
37:28
And, and what Spiffy does is that when a piece of software
37:33
wakes up, sort of the environment around the software
37:36
says, oh, here's your identity, here's your, your credentials
37:42
for calling other people. And importantly, here's the set
37:46
of things that you trust. So it's this bootstrapping of
37:50
trust at a very, very fundamental software level at
37:53
runtime that Spiffy solves. What we're doing with Whimsy is
37:57
saying like, OK, so we can get that part and we know how to
38:00
talk to different things in terms of like O auth
38:03
authorization or, you know, user identities coming in or
38:08
credentials coming in. How do we start to reason about
38:11
systems as we connect them all together and especially as we
38:14
cross security boundaries? You know, it might not be enough
38:19
that it's just, oh, this one workload is connecting to this
38:22
other workload and they're allowed to do whatever they're
38:24
allowed to do. I might actually want to know
38:26
that in order for this one to call the second one, well,
38:30
something else has to have been called first.
38:32
Maybe that's an auditing system or maybe that's a a very
38:36
specific gateway that that request has to come through
38:39
before this is even allowed to talk to me.
38:42
Now in today's systems, a lot of a lot of stuff is like you're
38:45
down here on the leaf node and you're like, Oh, well, if
38:48
somebody's calling me, everything must have gone right.
38:51
And so I can just trust that everything else happened just
38:55
fine. And then I'm just going to do my
38:59
little job and then that's it. Obviously that's very fragile.
39:03
That's a very sort of, you know, harden the exterior and keep the
39:07
inside soft and squishy type of type of thinking.
39:11
As we move towards smaller and smaller boundaries around zero
39:15
trust thinking, we need to be able to say like, OK, not only
39:19
is the correct party calling me, they're calling me in the right
39:22
context. It came through the right call
39:24
chain, which may actually not even be a single linear chain.
39:28
You know, it may have graphed off into a whole bunch of
39:30
different systems before it ever got to me.
39:33
If I can quickly check that against something that said,
39:36
here's the list of things that you trust.
39:38
Here's the policies that you're supposed to check it against.
39:41
Well, then I can actually make some real determinations about
39:45
what I'm supposed to be doing here in this system.
39:48
And that's the type of stuff we're doing in Whimsy.
39:52
So how this relates to bubbles is we spin up this bubble and
39:55
yeah, we need to be able to identify all of the pieces that
39:58
are running inside of it. But also, I think that there's a
40:01
lot of applicability at a more macro level because once I spin
40:05
up one of these bubbles, well, I'm going to want to be able to
40:09
talk to other bubbles. That means I need to be able to
40:13
address another bubble. When I send a user, so I've got
40:18
this Jay McDonald guy that I'm sending over to you and I
40:22
actually got his account from somewhere else.
40:24
Well, I need to be able to say somewhere else in a way that
40:27
makes sense to you. I need to be able to say through
40:30
me in a way that makes sense to you.
40:33
And we can't just assume that everything is on a publicly
40:37
available web-based URL like a lot of the a lot of the
40:43
federation systems that we we have today actually do.
40:48
One of the things that Spiffy gives us is a way to build out
40:51
URLs within their trust bundles that that actually makes sense
40:56
contextually. And this actually brings up a a
40:59
really, really interesting tie in from the very beginning of
41:04
the show is the award of the greatest dad ever.
41:08
I believe it was. And here's the thing, it's
41:12
absolutely reasonable. I think we all know that is
41:16
absolutely reasonable for every kid to give their dad the
41:20
greatest dad mug because that is a contextual assertion, right?
41:28
Greatest dad of all time is a contextual exactly.
41:33
And so that is the bit that makes that truly meaningful.
41:38
It's not actually a global declaration.
41:41
As much as we love, we love to joke about that.
41:43
Like I, I, I love that joke. It's a great, it's a great
41:46
standby. It's really wonderful.
41:49
But the truth of it is that just like in all of these security
41:52
systems, it's contextual. Like I might be needing to make
41:58
a decision about what to do next based entirely on only the
42:03
things that I know in my environment.
42:05
And I might have some policy that says only the greatest dad
42:08
of all time can call this API and and when he does then then
42:15
he gets the data. Everybody else I just give him a
42:18
403 and say Nope, not going to happen.
42:22
Thing is, how do I determine that?
42:24
How do I determine the validity of that assertion?
42:28
It's probably going to be it's only asserted by people that I
42:31
trust to make that particular assertion within a context that
42:35
I am comfortable with validating it in.
42:40
And that's the reality of all of these security systems that are
42:44
out there today, whether we like to think about it that way or
42:46
not. I think we're too quick to say
42:49
like, Oh yeah, we're going to solve things on a global scale
42:53
of like we'll have an authorization policy for every
42:57
system that we deploy and it's all going to be the same.
42:59
We're going to manage it centrally.
43:01
We're going to have like a cedar file that we just send out to
43:04
everybody and it's just going to work.
43:06
It's like, OK, that's that's going to get you some distance
43:09
of the way. But eventually down there at the
43:12
nodes, I'm going to need to be able to decide.
43:16
Well, you claim to be the greatest ad.
43:18
Do I believe that? Like who said it?
43:21
Where does that come from? And yeah, if your kids tells you
43:25
that, that's great. If a random stranger on the
43:28
street handed you that, I think it would be a much stranger type
43:33
of conversation than. What I do in my own time is my
43:37
own business just. You know, no judgement here, no
43:39
judgement but but really that's really one of the core things
43:45
here is that we're embracing that contextuality.
43:49
We're embracing that messiness at the edge and just admitting
43:53
that it's there and admitting that it's not part of a problem,
43:56
but it's just it's part of the world.
43:58
That's just how this works. And so by no longer pretending
44:04
that that's not part of this overall conversation, now we can
44:07
really start to make some smart decisions about it.
44:10
You know, we can really start to think about how we process these
44:15
things, how we talk about these things 'cause I can now actually
44:19
say like Jim's kids called him the greatest dad.
44:23
That is a, that is an assertion that I can make and you can do
44:28
with that whatever you like. You know, I can, I can check the
44:32
Providence that might be good enough for me.
44:33
That might not be good enough for you because we're operating
44:36
in different contexts and I need to be able to make those
44:40
statements and reason about those statements in a way that
44:42
crosses boundaries in a way that actually makes sense.
44:46
So Spiffy solves the identity piece just for that running bit
44:50
of software. Whimsy's looking at how do we
44:53
reason about this across multiple systems, especially
44:57
across security domains. And the bubbles concept is
45:00
really looking at that at a, that same style of thing, but at
45:05
a macro level. You know, how can I have an
45:09
identity system that I know is independent and that I that I
45:13
treat as independent and that is not always connected but is not
45:18
always disconnected 'cause like when I come back online, like
45:22
you were saying, Jeff, I want to be able to say like, hey, these
45:25
three electricians came on. Can I double check all of their
45:28
credentials right now? OK, great, thank you.
45:30
Right. I want to be able to do that
45:31
kind of thing and not just sweep all of that under the rug.
45:38
Yeah, it's a real interesting concept.
45:40
I'd be curious to see how it continues to evolve and more
45:44
importantly, how does this actually make it into the real
45:46
world? Right.
45:47
From a thought experiment and and I will assume there's
45:49
probably stuff that's happening, but it seems like it's very much
45:52
still on the upward trajectory of figuring things out, right?
45:56
Absolutely. We're building into bits and
45:58
pieces, figuring out where the technology gaps are, deploying
46:03
it where it makes most sense. And one of the things I've said
46:06
from the very beginning of this is that it's, it's not a
46:08
product, it's not a technology stack, it's not even a standard,
46:13
because there have been attempts to have like a global vision of
46:17
distributed identity systems. And it's like, well, if
46:20
everybody would just use this agent, then all the problems
46:24
would go away. And that's just that is never
46:27
going to happen because as soon as you want to connect to
46:29
somebody else, they're going to be using a different agent,
46:31
right? They're going to be using a
46:32
different schema, They're going to be using something that's not
46:35
the same. And so the interoperability
46:38
here, I think needs to be about as messy as as it it, it can be
46:42
and still connect because that's that's how human systems work.
46:47
So I'm looking forward to the next RSA where we start to see
46:51
products with, you know, 100% more bubbles or something like
46:55
that, just like we saw with the AI and Zero trust and all that
47:00
other stuff. I want to wrap up our
47:02
conversation on a lighter note and I'm happy to say that I am a
47:08
sponsor or contributor or funder.
47:10
I'm not sure what the right word is.
47:12
Backer, I guess probably the right word of a new board game
47:15
that you had been working on called Natural Ball.
47:19
Talk about that cause got a link in our show notes.
47:20
It sounds really cool. And I also want to get into
47:22
Cards Against Identity for for a couple minutes.
47:24
But tell us about Natural Ball. What is it?
47:26
Yeah. Well, so one of the things we
47:28
talked about last time is that one of the other things I do
47:32
beyond all of this identity stuff is I really enjoy board
47:35
games and I've, and you know, I like designing them.
47:39
Cards Against Identity is something that I've, I've
47:42
published a new version every single year over the last five
47:46
years or so. And that's been a very small
47:50
sort of niche thing that that shows up at the identity
47:53
conference circuit. But with Natural Vol, this is a
47:59
game that actually came to me through a friend of mine who I
48:02
met in, she's based in Iceland. And she came up with the
48:07
original idea of this game when just talking with her kid who
48:12
was I think 9 or 10 at the time. And he just wanted more facts
48:16
about animals. So like, hey, mom, can you just
48:19
make a bunch of the animal flash cards and let's make an animal
48:21
game. Let's do something.
48:23
And so she came up with this idea of basically having animal
48:26
flash cards with a bunch of statistics about the animals on
48:30
the cards and then rolling dice to compare the statistics.
48:34
Very simple rules, very simple mechanics, really easy for kids
48:38
to pick up and learn and play. She showed me this game a couple
48:42
of years ago and it had been sitting around in the back of my
48:45
mind like, like, there's this there, this is a neat idea.
48:49
Like this is, this is pretty, pretty neat.
48:51
Now, she had been just printing things out on her home printer
48:56
and, you know, putting contact paper over them because I had
49:00
been doing game design and prototyping for a couple of
49:03
years. I actually printed up, I went
49:06
and designed and printed up an actual prototype, sent one copy
49:10
to her in in Icelandic with the condition that she translated
49:14
into English so that I could also have a copy.
49:17
And then we had those for a little while and we're playing
49:22
with, with our kids and with friends and stuff.
49:24
And both of us were like, this is this is a fun game.
49:27
Like this isn't just like a, a neat little hobby.
49:30
So we want to make this into like a real commercially
49:33
available board game. So what we're doing right now is
49:36
we're trying to raise enough money through it's basically
49:40
pre-orders with a bunch of extras through game found.
49:45
And like Jeff said, you can find the link in the show notes.
49:50
And the way that it works is if if we reach our goal by the end
49:54
of it, then we are going to get a full set of these games
49:58
printed from an actual game manufacturer.
50:01
It's actually the same printer that does Wingspan and Pandemic
50:06
Legacy and Gloomhaven and a bunch of other like really big
50:10
games. They're they were.
50:11
Legit. Yeah, they were really excited
50:13
to work with us little indie developers.
50:16
It's a it's a team of three people total, and that's that's
50:20
been working on this. Four, if you count my friend's
50:23
son, who's arguably the original designer for this whole project.
50:30
And, and yeah, we're trying to, we're trying to kick this off.
50:34
And so yeah, please check out the game.
50:38
I spent way too much time putting together the the little
50:42
pitch video that's on that website.
50:46
So and that runs until I think mid-july.
50:51
So if you if that sounds interesting to you or if you
50:54
know somebody it sounds interesting too, please check it
50:57
out and send it along. Yeah, we'll have a link in our
51:00
show notes. I'm a backer.
51:01
I bought one for myself and 1:00 to give to my local community
51:07
thing. I think that's still to
51:08
determine right how you like determine where, where the extra
51:11
copies will go, but. Yeah.
51:13
So that is that is something that we're doing with this
51:15
because it's an educational game.
51:18
We're giving people the option to basically pay for extra
51:22
copies that then get donated and shipped out to to schools, to
51:28
libraries, to community centers, to all sorts of things like
51:31
that. So so yeah, you can get you can
51:34
get a copy for yourself and there's a bunch of extras that
51:38
you can do to like our artist is is gonna be like sketching
51:43
animals for people. Or you could actually design a
51:46
card to go in this. So we've got friends who like
51:50
people have already contacted us that they're getting like their
51:52
friends, pet cats on a card in this with whatever stats you
51:58
want. We don't care if they're
51:59
accurate at that point. And so like my kids hamster is
52:04
probably gonna be gonna be one of one of the cards.
52:08
But yeah, in addition to all of those extras, we're we're
52:13
letting people sort of donate this to spaces that wouldn't
52:17
have the opportunity to just go out and buy a $20 board game.
52:22
And and that's something that we really, we, we felt really
52:25
strongly about going into this. Yeah, it's a very cool idea.
52:29
I love the art style of the direction of it.
52:31
Like I said, I've I've I bought 2, so I'm looking forward to
52:34
getting that one out. Cards can card scan's identity
52:38
real quickly. What's the latest on that?
52:41
Was there a new pack for this year?
52:42
I I don't, I forgot to ask you identiverse about it, but.
52:45
Yeah, so there was a new pack this year.
52:48
I so it's one of those things that if you catch me on on the
52:53
spring identity conference circuit, then I usually have a
52:58
backpack full of them with me. Those sold out through the
53:03
absolute gauntlet that was Identiversed immediately
53:06
followed by EIC, plus a bunch of other stuff around that time.
53:11
But you can go to cardsagainstidentity.com and
53:15
that will actually you can, you can buy it online since that's a
53:21
small run. It's a it's basically goes
53:23
through a print on demand service, but you can get
53:26
everything all going all the way back to the original 20/19/2019
53:31
deck. What's your favorite white card
53:36
and black card for this year? For this year, Oh my gosh.
53:42
So I think my favorite black card is that's it.
53:47
I'm creating my own standards organization with blank and
53:50
blank and white card. Oh my gosh, there's so many
53:57
different, there's so many cards now across all the years that I
54:02
have to remember. I, I will say my, you know,
54:04
instead I'll give you my favorite white card of all time
54:08
was from a couple of years ago was the Super Vittorio card.
54:12
As, as you know, there, there was somebody in our community,
54:16
an absolute giant Vittorio Betochi.
54:20
And there was, there's this video that's still on YouTube of
54:25
him as a superhero anime character.
54:28
And I was able to actually clip that from the video and get that
54:32
onto onto a card And that that I don't think that one's gonna get
54:36
replaced as my favorite card for a very long time.
54:40
That's a tough one to top for sure, and well earned too, by
54:42
the way. OK, why don't you go ahead and
54:45
wrap it up, I think for this week, Justin, thank you so much
54:47
for spending time with us. I'm really interested to see how
54:50
this bubble, how these bubble things take off.
54:52
I guess terrible pun, error rising.
54:55
I don't know. So, you know, keep us posted on
54:58
how that's goes on, how that goes.
54:59
I'm sure there's other topics we want to talk about with you in
55:01
the future. So we'll have you back if you
55:03
are so inclined. Absolutely, thank you for having
55:06
me on again. I would love to come back.
55:08
Yeah, and I appreciate it. I, I, I mentioned before you
55:10
before we started your real Pros pro from a microphone and a
55:13
recording and all that good stuff.
55:15
So two thumbs up makes my job easier.
55:17
And this isn't even the good Let's see what the computer
55:19
that's back there. You got so many that you're
55:23
choosing from. Meanwhile, I'm here in a
55:24
Springfield Suites in Minnesota. Oh, it's.
55:26
It's with a lovely mini Can you call us a kitchen?
55:30
I mean, it's got a mic, it's got a microwave and a fridge and I
55:34
don't. Know drink the top water.
55:36
Yeah, it's pretty bare. All right, let's leave it there.
55:40
idacpodcast.com, Twitter at IDAC podcasts, the YouTube channel
55:45
youtube.com slash at IDAC podcasts, Mastodon, IDC podcast
55:52
at info psych dot exchange. Do all those cool things like
55:55
like subscribe, share with your friends, share with your
55:57
enemies, doesn't matter long people hit that button.
55:59
I don't care who does it and we'll leave it there for this
56:01
week. So thanks everyone for listening
56:04
and or watching and talk with you all in the next one.
56:10
You've been listening to Identity at the Center.
56:13
We hope you've enjoyed the show. Make sure to like, rate and
56:17
review, and we'll be back soon. But in the meantime, hit the
56:21
website at identity@thecenter.com.
56:25
See you next time on Identity at the Center.