Latest / Identity at the Center / #260 - Passkeys with Daniel Grube of TikTok

Transcript

#260 - Passkeys with Daniel Grube of TikTok · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity at the
0:23
Center podcast. I'm Jeff and that's Jim.
0:25
Hey, Jim. Hey, Jeff, how are you?
0:27
Not so bad yourself. I'm doing great man, but I'm
0:30
wanting just like I'm sure the rest of the identity at the
0:34
center community is wondering, can we get an update on the
0:38
Apple Vision Pro? Because for the rest of us
0:41
regular folk we can't afford such things.
0:43
But you, my friend, have one. I do.
0:49
It arrived yesterday, so I've had it for roughly 24 hours, of
0:55
which most of it has been either working or sleeping.
0:58
But I have had a couple of hours now to play around with it and
1:00
my wife too, which is a very important part of this.
1:03
There is a lot to cover here. I don't know if we have time for
1:06
it, but I will say this, it is very expensive and it is very
1:10
impressive. The hard part about it is it's
1:13
very difficult to demo and share with someone else.
1:17
It is a very personal device, so anytime like my wife and I were
1:21
trading off last night, kind of showing different things and how
1:24
it worked, you have to do an eye calibration for the eye
1:27
tracking. You have to turn off pass
1:31
passwords and pins, right, and all that stuff so you can easily
1:33
swap heads right there in the mask.
1:37
So it is very difficult to share with other people.
1:40
But my gosh man, this thing is the best ARVVR experience I've
1:46
ever tried. And it's not even close to
1:48
anything else that I've seen. For me, the killer feature has
1:53
been actually the MacBook pairing and using it as like a a
1:57
larger screen. So I was actually playing around
2:01
with it and like trying to edit the podcast on the Apple Pro in
2:05
like a giant mirrored, not mirrored, but it's like
2:07
basically like a virtual display.
2:09
And it was, it's it's pretty useful, Definitely first Gen.
2:13
it's heavy, it's expensive. Do I recommend it?
2:16
For most people, no. But it is extremely cool and I
2:19
am really excited about where this is going.
2:22
And this is coming from a guy you've had several VR headsets.
2:25
So I mean, like you're not just like some newbie who's impressed
2:29
by whatever fell off the shelf. No.
2:33
And it actually came in earlier than I thought it would.
2:36
So, you know, a couple weeks earlier than I thought it would
2:39
be. And it's pretty cool.
2:40
I mean, there's some pretty neat features, some cool apps.
2:43
It's just kind of the very beginning of it.
2:46
It's crazy expensive. It's really hard to recommend,
2:48
but for most people. But if you get the chance, go to
2:52
a store, try it out. If you know someone, try it out.
2:55
I I I think you would be blown away with how good it already
3:00
is. And if this is the worst that
3:03
it's going to be, I can only imagine the future.
3:05
I mean, it's going to get so much better after, you know, 234
3:09
iterations. The phone was like this, the
3:10
iPad was like this, the watch was like that.
3:12
I mean, it's it's crazy good. I am still torn at this moment
3:16
whether or not I'm going to keep it.
3:17
I'm definitely going to take advantage of the 14 days for the
3:20
return. But it's it's pretty cool, man.
3:24
I'm digging it. So you're so happy and there's
3:28
only two days after you're crying in your your Coke 0,
3:33
right? I mean, you seem pretty
3:35
recovered over that. Not only did your team that
3:40
you've always loved lose the Super Bowl, but you went public
3:44
on the Identity Center podcast and predicted a win and told
3:50
Todd and me and Steve that we were all wrong thinking the
3:54
Chiefs would come back. And I did say the Chiefs would
3:57
come back because of Patrick Mahomes and yeah.
4:00
That's not going on a limb. It's always going to be Patrick
4:02
Mahomes. It wasn't really going on a
4:05
limb, that's true. Well, This is why you don't tune
4:09
into identity at the Center for football picks.
4:11
I am over 2 on the season. I picked the Bears opening,
4:14
opening week. I drank the Bears kool-aid.
4:16
I immediately threw up the Bears kool-aid after that first game,
4:19
he said. Nope, they still suck.
4:20
Forget it. The Niners I am disappointed in.
4:24
I feel like they had so many chances to win that game and
4:28
they literally fumble it away twice, three times.
4:32
You cannot give Patrick Mahomes and that offense that many
4:36
tries. You get it.
4:37
And they held them the four field goals which is crazy.
4:40
They've lost one of their best offenders by tearing his
4:42
Achilles, just jumping, getting ready to go on to the field, non
4:46
contact injury. It was just it was
4:49
disappointing. I had some questionable
4:52
coaching. I think a couple of overthrown
4:54
passes that could have been touchdowns.
4:57
It's just I feel like. I feel like the 49ers lost it.
5:01
Not to take away from the from the Chiefs because they
5:02
definitely, you know, deserve the win, but I feel like it was
5:06
not the greatest outing for the Niners.
5:09
Yeah, well, the my biggest take away was first, the hilarious
5:13
commercials. I'd love to know what your
5:15
favorite commercial was. Mine was.
5:18
I don't think a lot of people pick this one out, but it was
5:20
like Chris Pratt doing a Pringles can commercial, right.
5:24
And young girl who's working on the counters, like, you know,
5:28
you look like the guy on the Pringles can, right?
5:30
And then everybody starts saying it to him.
5:33
And what I thought was the most hilarious part of the commercial
5:35
was he does Face ID on his iPhone, but it's pointed at the
5:41
Pringles can that lets a man. So I don't know, I I for for me,
5:47
I was just cracking up over that.
5:49
But I also thought to myself, man, Las Vegas is a really cool
5:52
city. It keeps getting cooler every
5:54
year and now they've got that sphere with it looks like a
5:59
marble rolling around. I mean mind blowing stuff.
6:03
And you can see it from, you know, from the sky as you fly
6:06
in. So I was just there a couple
6:07
weeks ago and I'm flying in at night and there's this giant
6:11
yellow :) spinning as we're, you know, landing it at the airport
6:16
there. And it's, it's very cool.
6:18
I think what I'm most impressed by is how high quality the
6:23
images It's very high, you know, dynamic resolution, right?
6:28
Things like that. But also the frame rate is
6:30
crazy. It looks super smooth, super
6:32
fluid, not janky at all. It's it's really cool.
6:37
I'm looking forward to someday maybe getting closer to it and
6:40
maybe even getting inside to see a show and what that looks like.
6:45
Well, you know, I mean, we're going to be back there in Las
6:47
Vegas for Identiverse. We should have the discount code
6:52
on the next episode. I'm really going out on a limb
6:54
with that because I know we don't have it in hand in the.
6:58
Next few episodes. How about that?
7:01
There you go. We'll have the discount code.
7:03
So anybody who's planning on registering, come on back to
7:07
your favorite podcast. You should have.
7:11
We should have that code here very shortly.
7:13
Should be the best code available publicly.
7:16
So we got that conference coming up other other conferences on
7:23
the agenda. Identity week which is in
7:26
Europe, America and Asia. So we have a discount code for
7:30
that as well and it works for any of the locations.
7:33
So the Europe one Identity Week Europe is in Amsterdam, June
7:37
11th through 12th. Identity Week America, which you
7:40
and I will be at, is in Washington DC September 11th and
7:44
12th. And Identity Week Asia is in
7:47
Singapore, October 22nd and 23rd.
7:50
I think if anybody wants to pick up our airfare first class, of
7:53
course we'd be more than happy to be there as well.
7:57
Again, IDAC 30 gets you 30% off registration.
8:02
Yeah. And we'll have the link in our
8:03
show notes to make it easy for people to find.
8:04
But yeah, we'll be at the America One.
8:06
And yeah, if you want to fly us out to Amsterdam or Singapore,
8:09
I've never been to either. I have a bag and I will travel.
8:12
Maybe. Maybe we'll bring my Apple
8:13
Vision Pro if I still have it. At that point, who knows?
8:17
It would offer. It is.
8:20
I I don't know. I I can't wear it in public,
8:21
man. I just I'm not that guy yet.
8:24
When I see a a bunch of other people doing it maybe, but not
8:27
yet. Another cool thing was we saw a
8:30
recent Apple podcast review and they were commenting about the
8:34
episode that we did with Ryan Galuzzo from NIST and so I
8:38
thought that was very cool. So definitely appreciate the
8:42
folks who take the time to review us on the podcast
8:45
platforms. It definitely helps us and it
8:48
you know continues motive us. The other thing is they like the
8:50
the person like the hockey talk and totally agrees with me.
8:53
So I'm totally bringing up this review because they agree with
8:55
me on playoff hockey. So there you go, I'm.
8:58
Going to guess that it was Ken Myers from GSA who's been a a
9:02
friend of the show and been on the podcast a few times.
9:05
And the reason I'm going to guess that is that he put a post
9:08
on LinkedIn that read very similar to this.
9:12
So if I got that right, Ken send me a message.
9:15
If I get it wrong, send me a message too.
9:17
I'd be OK with that. There's lots of people who think
9:20
I'm right, so you never know. It could be any number of people
9:24
out there. So today's main topic, we're
9:27
going to talk about passkeys. We've got somebody from San
9:31
Francisco who may have also been crying in his beverage of choice
9:34
on Sunday. I'm not sure, but I'd like to
9:37
find out. Why don't you introduce our our?
9:41
Latest guest Yeah, so we've got Daniel Grube again, Product
9:45
manager at TikTok. He was with us on stage at
9:48
Authenticate last year as part of our kind of live keynotes
9:53
extravaganza, we'll call it. Welcome back to the show,
9:57
Daniel. Yeah.
9:58
Thanks for having me guys. So are you a Niners fan?
10:01
I have to ask. You know, I was born in San
10:05
Francisco, so I feel some sort of loyalty, but actually my
10:12
dad's from Detroit, so he grew up in a Lions household, so he
10:18
was not too happy with the 49ers knocking out his favorite team.
10:23
It was supposed to be somewhat of a Cinderella stories for him,
10:26
I think after many, many years of just disappointment.
10:30
So yeah, our our household was sadly watching the Super Bowl.
10:35
It has been a while, you know. I would not have been upset if
10:37
Detroit had beat the 49ers. I'm glad they didn't, don't get
10:40
me wrong. But I feel like it's time.
10:43
I think it's been like 40 some years and I feel like they're
10:46
also a little bit ahead of schedule, which is good because
10:48
I think the NFC North is up for grabs.
10:51
But now we're talking NFL. What we want to do is talk about
10:54
identity and access management. We didn't really get a chance to
10:58
really get into your background on stage, and we kind of had of
11:00
a shortened show just based on timing and things like that.
11:02
So why don't we start fresh in this episode?
11:05
So tell us a little bit about your background.
11:07
How did you get into the identity space?
11:10
Is it something that you chose or did it choose you?
11:13
Yeah, that's a an interesting question.
11:16
I think it kind of chose me to be honest.
11:21
So interestingly enough I I have a technical background but it
11:24
was mainly applied to social sciences, especially in grad
11:27
school. I analyzed social networks to
11:31
look at how they evolved over time and if we could predict the
11:35
evolution of social and economic networks to better understand
11:40
where we think those types of things are going to be going.
11:43
So a lot of that type of modeling that I did applied
11:48
really well to social networks and things like that, not only
11:53
in the real world but obviously online.
11:56
I actually also started my career as a private
12:00
investigator, which was pretty interesting.
12:03
I think that this set me up very well for understanding identity
12:08
in a way. I got that job just through a
12:10
few random languages that I speak.
12:12
That can be very useful in private investigations,
12:16
especially for the people who go into that field and the places
12:20
that they previously worked at. And so for me, I think it was
12:24
really interesting because a lot of that job was about taking a
12:27
ton, a ton of information given to you by clients and then
12:31
having to dissect it, pair it down and tell a story with it.
12:37
And for me, it was all about figuring out who are these
12:39
people, Who are these, you know, where are the, where are they,
12:42
What are they doing? Why did they do it?
12:44
Understanding identity and then motivation from that and telling
12:48
a story. And for me, I think that was
12:51
very, very interesting. And I did that, you know, in a
12:54
lot of languages, with a lot of people from a lot of countries.
12:57
It was super cool and really led me nicely into using kind of my
13:01
technical background, my investigations background into
13:06
employing this in a more product focused way where I can actually
13:10
build things that are, you know, using identity for security and
13:14
and understanding the intersection between the two.
13:18
And so you work on, I guess I interested you as a product
13:20
manager at TikTok, you got to help me understand what does
13:23
that even mean? Like what would you say you do
13:25
here? Yeah, of course.
13:27
I think being a product manager at TikTok is similar to being a
13:30
product manager at most tech companies, right.
13:34
What you're doing is identifying opportunities for the space that
13:37
you work in. I primarily work in security,
13:40
identity access management and so essentially figuring out
13:46
where are opportunities using, you know, certain data or user
13:50
research that you can get from interviews, things like that.
13:54
And then building features that will help users based on the
13:58
needs that you've identified. And you know, writing those
14:01
documents, working with engineers, designers, things
14:04
like that to build these things, testing them, understanding if
14:07
they work and then launching them on your app so they can be
14:10
used by people worldwide. So everything you see on your
14:14
TikTok app is built by some team.
14:18
You know who's trying to understand that this is
14:20
something our users would like to use the constant.
14:25
You know, March of progress, right, and how to improve
14:27
things. I think most people are probably
14:29
familiar with what TikTok is. If you, if you're not, I guess
14:33
just get out from under the rock right and go online.
14:36
What is a feature that you think is underutilized when it comes
14:40
to TikTok something maybe that you like to use and maybe not
14:43
like needs more commercial promotion, right?
14:46
Or something like that. So for me, one of my favorite
14:49
features at TikTok that I use a lot I would say is a collections
14:54
feature. So I I find myself, I love using
14:57
TikTok and the 4U page and stuff.
14:59
I feel like I always get entertaining content.
15:01
I especially love it for recipes, to be honest.
15:04
So for me, I I love cooking and I kind of, you know, use a lot
15:08
of the recipes I see in my 4U page and try to copy them at
15:11
home. But collections is something I
15:14
use to put them all together, essentially, and after I
15:17
bookmark them. So bookmarks can kind of get,
15:20
you know, there's a lot of them, things like that.
15:22
This just helps me to kind of organize them and then share
15:24
them with people as well, which is cool and I don't know how
15:27
many people are using it, but I find it very useful for me and
15:30
kind of how I use the app. Seems kind of like the the a new
15:34
spin on like the bookmark, right?
15:36
I think everybody's familiar with like, the bookmark in a
15:38
browser. It's like, hey, how do we pull
15:39
this collection? Clever name, by the way.
15:43
Building on the library theme, yeah.
15:47
I would imagine that your role has a lot, a lot of interaction
15:51
with sort of you know that growth and that user experience
15:54
that that happens. There are those things competing
15:57
interests, can they be complimentary like how do you
16:00
see your role sort of a driving and and affecting those areas?
16:03
Yeah, the team that I work on TikTok, from the product side,
16:08
we do not only experiences on the app like signing up, logging
16:13
in and security, but we we do all of them you know as a team.
16:17
And so for me Task Keys has been a great way of providing users
16:22
with more security but a frictionless experience as well,
16:27
meaning that it's just much easier to you know log in things
16:30
like that which can kind of show you how you can utilize good
16:35
user experiences that are also secure to make the process
16:39
faster for users and easier. So I I think that that's a great
16:44
answer in the sense that we have found ways especially with new
16:48
technology to make if these experiences, especially security
16:51
experiences much easier and much better for users.
16:57
Daniel, I'm wondering what was the hot topic in Identity at the
17:00
time that you joined Tiktok. Yeah, again like what was
17:06
interesting is when I when I joined it, I was approached by
17:11
one of the engineering teams to basically talk to me about
17:15
passkeys. It was especially discoverable
17:19
credential which we use at Tiktok with pass keys right
17:22
where you just show it up, show the pass keys automatically to
17:25
the user that are saved on their device.
17:28
It was all very new at the time when I joined and they had
17:32
already they, they were a team internally that had already
17:36
focused pretty heavily on Fido technology and how this can be
17:39
used especially for employees to secure their accounts, things
17:42
like that. And so they approached me saying
17:45
this is also something that could be used in a consumer
17:47
context. And so it was a very hot topic
17:50
from an identity perspective as something that we had already
17:53
invested in to increase security for employees and why not use
17:58
that technology to increase security for our users also.
18:01
So for me, that was kind of one of the first conversations I had
18:05
when I joined about a cool opportunity that we had in our
18:08
identity and security space. Yeah, I I feel like Pesky's is
18:14
kind of the best of the user experience and also, you know,
18:19
improving security and there's so few things you can do in the
18:22
identity space that do that. I, you know, so I think this is
18:28
kind of a story that anybody who's dealing with an external
18:31
user population can really take from it.
18:34
I mean, you guys have also experienced a lot of growth in
18:38
the past few years. That's a challenge as well as an
18:42
opportunity. What are some of the challenges
18:44
and opportunities that you've experienced?
18:48
Yeah, I think that having new users is definitely an
18:51
opportunity for security because it gives you the ability to help
18:55
users and guide them to the, you know, most secure option
18:58
possible for them to use, right? So for us, this is an
19:02
opportunity to, you know, allow users to create a pass key
19:05
earlier in the user experience when they're creating an
19:08
account. I know that for a lot of
19:11
companies or a lot of, you know people, adoption or creating a
19:16
passkey might be a bit of a tricky or user experience or a
19:20
challenge, right? Whenever you have new technology
19:23
or something you have to add to your account, it can be
19:26
difficult to figure out how to ask users to do it.
19:29
And so when you have more users who are joining or signing up,
19:34
you have an opportunity earlier in the user journey to give them
19:38
better security. So I view this as an opportunity
19:40
for us to help users secure their account at an earlier
19:43
stage in their journey on TikTok.
19:46
Yeah, I think that makes a lot of sense.
19:48
I mean when you're when you guys got on past, he's just really
19:52
new, right. And so there's kind of like you
19:55
almost had to kind of break the barrier of like people don't
19:59
even know what you're talking about.
20:01
Now it's becoming more at least within our within our industry
20:05
like kind of the common parlance but.
20:08
Let's say outside of our industry, people generally still
20:12
are just coming up that learning curve.
20:16
So, you know, I think being that early adopter kind of hints to
20:21
me this innovative culture, you know, and I think the
20:27
opportunity to improve the UX in the innovative culture probably
20:33
gives you the opportunity to take some, take some more
20:39
challenges or make make some more risks.
20:41
Does that make sense? Yeah, it does.
20:43
I think it has afforded us the opportunity to understand where
20:47
we can improve, right. We have embraced passkeys at
20:51
Tiktok. So we know that this is a cure
20:55
way and a frictionless way for users to log in.
20:57
And so we I also understand where there I think is
21:01
opportunity to grow or challenges that we noticed with
21:05
some of the technology initially as it's provided by Apple,
21:09
Google, Microsoft or you know people who are providing the
21:11
technology to relying parties. For us a lot of it is you know,
21:17
making it more flexible for user experience, right.
21:20
Not only is this a product that you can use to sign in, but also
21:24
to authenticate your identity in various scenarios across a
21:29
platform or across the user journey as well as signing up
21:32
for a new account. So we're looking at other ways
21:36
that we can, you know, utilize the technology that's provided
21:39
to us in different scenarios. And I think the biggest
21:42
opportunity there is a more flexible way of, you know,
21:46
messaging to users, the difference in the different
21:49
scenarios. Right now we have the sign in
21:52
with passkey prompt, but maybe in the future we'll have other
21:55
versions of that that will allow us to more easily communicate
21:59
with users without extra steps that they could also, you know,
22:02
authenticate with a passkey or they could sign up with a
22:05
passkey, things like that. So I think that for us noticing
22:09
that using, you know, the technology we're given helps
22:13
users to more quickly understand it, especially if it's from the
22:16
native OS that they have. But also we'd love you know to
22:21
see more flexibility of what users are seeing to address more
22:25
scenarios so. Here's a challenge for the Tik
22:28
tokers out there. How do you make passkeys go
22:31
viral in a way that it becomes trending of like, you know, sign
22:36
up with passkey, right? I mean, is that like, am I?
22:39
Am I too much of an I am nerd to think about in that perspective,
22:43
Like, you know, what's the communication marketing plan?
22:45
You know, what is? How do we roll this out from a
22:47
communication standpoint? TikTok video man.
22:49
Why not? I know.
22:51
Yeah. I I would love to do a TikTok
22:53
video about passkeys. That sounds awesome for me.
22:57
Yeah, I I wanted to go viral also on our platform.
23:01
That would be so cool. I have no idea how to get there.
23:05
That would be really fun. I feel like that's something
23:07
that we maybe you guys could make the video.
23:10
Oh, there we go. We can carve up part of this and
23:12
make, I don't know, funny faces, put weird filters on us and then
23:15
talk, you know, some sort of pass key prop type thing.
23:19
I don't know. Yeah, there's something there.
23:21
I feel it. I feel like this is something
23:24
that everybody wants and frankly probably should be using in the
23:30
age of sort of getting away from the password which we everyone
23:32
knows and hates. But is 100% adoption really the
23:37
goal? Is it?
23:39
Is that even realistic to think about from AI guess from like a
23:43
authentication standpoint? Yeah.
23:46
And I guess when we talk about this, it's probably just around
23:49
everyone, right? Like can all all people who are
23:52
using passkeys across all different platforms using the
23:55
technology that's provided to the relying parties, can relying
23:58
parties expect their apps to have all users with this?
24:04
I I'm not sure, I guess from a practical perspective, right.
24:09
There are requirements for a passkeys, so you have to have
24:12
screen lock enabled, you have to have Bluetooth turned on, you
24:15
know, you have to have your biometrics enabled or I guess
24:18
you can use like a passcode, things like that.
24:20
But not everyone has a passcode or a you know, a pattern or
24:24
something on their device depending on you like Android or
24:27
iOS. So I think that there are just
24:29
certain conditions that are required by Apple, Google,
24:32
Microsoft to create a passkey that will probably just
24:34
naturally you know make some users ineligible as well as like
24:39
the OS version, right? It's only available for iOS 16
24:42
plus Android 9 plus. So right now I I don't think so.
24:47
Simply based on the conditions that are given to relying
24:50
parties, you know that it's probably not realistic to have
24:54
100% based on that. But over time as more people
24:57
meet these conditions than than it is a possibility for sure.
25:01
But I think it's just a matter of time more so than anything
25:04
else. I feel the same way because I
25:06
think there's still, you know, accessibility concerns.
25:10
We want to make sure that it's available right for everybody
25:13
and you certainly bring up a lot of a lot of the things that I
25:15
think a lot of people think about is OK, sounds cool, that's
25:18
great. But there's you know, there are
25:20
certain use cases or scenarios where it's just it's just not
25:22
going to work. So what is the fall back
25:24
mechanism? So I'm with you on that one.
25:26
I I guess from a feedback perspective and maybe this is a
25:30
weird question to ask, but has anybody like have users
25:33
commented like hey this is great that you have it on here?
25:35
Is it just I dent to Roddy that are like hey you've got passkeys
25:39
right? Or are normal people in
25:41
quotation marks also getting feedback on it?
25:45
Yeah, I think this is interesting.
25:47
I definitely, I'm not going to lie, definitely Google like
25:49
Tiktok and Passkeys. I want to see what people are
25:52
saying, all kinds of stuff. Based on just what I've seen, it
25:56
seems like we've gotten positive reception, which is great.
26:00
I don't think I I've seen any specific feedback like you're
26:04
saying around that. But I think generally when we
26:06
looked at the response after announcing that we were going to
26:10
be doing passkeys in July of 2023, there was positive
26:14
response. I think people have seen us as
26:16
embracing the technology and have welcomed that.
26:19
And we've seen other relying parties adopt the technology
26:22
also after that and even before. Obviously, we weren't the only
26:26
ones at the time. So I think that generally, yeah,
26:29
we're seeing a positive response for this.
26:31
We know users are using it. So I think that that indicates
26:35
to us that people like it. Yeah.
26:38
One of the things we like to do on the podcast, Daniel, is make
26:41
sure that we don't lose people, right.
26:44
And we're talking about pass keys and we're halfway through
26:46
the episode. But I think it's important to
26:49
maybe level set on what pass keys are obviously.
26:53
I think well, may I ask a question?
26:55
Pass keys, replace passwords? Yeah I think that's the
27:00
intention right, to create a password less experience for
27:02
users. So it's to me this is my own you
27:07
know thought but that that was the naming convention right.
27:10
Instead of a password it's a passkey I think the the naming
27:13
even sounds like it's it was intended to replace a password.
27:18
So yeah, I I it feels it feels intentional from the way that
27:22
it's been branded as a product. What did the What does a normal
27:27
end user have to do to start using passkeys?
27:32
Is there any kind of like special signs that they have to
27:35
do? You mean just in general?
27:38
I mean, not really. I mean, we talked about like
27:39
their eligibility conditions, but for the most part you just
27:42
have to create it. Right now it looks like most
27:45
apps are using passkeys just to log in for users.
27:49
So you would just create the passkeys so that you can log
27:53
back into your account. I haven't seen anyone, you know,
27:56
removing passwords or anything like that.
27:58
So I guess if we're talking about creating a passwordless
28:01
experience, that's still something in the future for pass
28:05
keys and relying parties, especially as passwords seem to
28:09
be, you know, they've been around a long time.
28:11
You know, it's always hard to get rid of something that's like
28:14
hold reliable. So I think that, yeah, I think
28:19
that's probably what what I've seen is just the the login
28:22
scenario being tackled primarily by all the the lion parties
28:26
adopting passkeys right now. So it seems like that's kind of
28:30
where we are at this stage. Now, if I'm a practitioner, I'm
28:35
thinking, OK, maybe passkeys would be the right thing to
28:39
provide to my users, right? Maybe we're looking at multi
28:44
factor authentication, which seems like a baby step in the
28:47
right direction when pesky's are out there as an option, but I'm
28:52
not sure about how much money I'd need to spend.
28:56
You know, from your standpoint, did you need to invest money
28:59
into hardware or additional software in order to make this
29:02
work? Yeah.
29:04
That's a great question. So as we talked about before, I
29:07
think there was actually a A-Team that's dedicated to
29:11
exploring, developing, understanding phytotechnology
29:14
that we have at Tiktok. And so they had actually already
29:18
created an SDK to be used in the enterprise scenario, you know,
29:24
to create passkeys, things like that.
29:27
What was great for us is that we could use some of the technology
29:31
that we had already developed at Tiktok to be able to then make
29:36
it available for consumers also. So there's no new, no new
29:40
hardware, you know, obviously software.
29:45
But yeah, it it made it great, 'cause, you know, it's something
29:48
we as a company had already invested in to increase
29:51
security. And so we were able to use that
29:54
to also make our consumers more secure as well, the people that
29:57
use Tiktok who want to have more security on their account.
30:01
Yeah. If I'm thinking about rolling
30:02
this out, I mean is it do I have to do all Big Bang for all of my
30:07
users at once or can I pilot it? I've been trying to get an idea
30:12
of like how big is the roll out? Is the effort A lot of, you
30:18
know, mostly focus on just putting the technical pieces in
30:21
place or is there kind of a change management of like
30:24
letting people know it's coming, be here tomorrow, it's here,
30:29
here's what you need to do? Yeah, that that's a really good
30:33
question, right. I think with any new technology,
30:36
adoption is going to be a challenge, right?
30:38
Like we talked about, it's new. So education, right?
30:43
Do people know what a passkey is?
30:45
So if they see this, are they going to do it?
30:47
If they don't know what it is, they might be confused, which
30:51
can change your decision. If you want to invest a lot in
30:54
it or not a lot, it can also change your decision.
30:57
Do I need to educate users on what this technology is before
31:01
they create it so that they understand things like that?
31:04
There's there definitely enters a lot of these questions when
31:07
you're trying to roll out past keys on your platform,
31:10
especially because it is a new technology.
31:12
I think that what's great what we found especially working with
31:15
things like the Credential Manager API that Google
31:18
provides, it actually is it's a it's very efficient, you know,
31:25
as a platform to provide this technology to our users.
31:29
So I think if you're questioning about whether or not you want to
31:33
adopt it, I think recognizing that there are tools that you
31:37
can use provided by, you know, Apple, Google, things like that,
31:41
that make it an efficient technology to integrate onto
31:45
your platform that that's great maintenance is going to be you
31:48
know, easier potentially than other things.
31:51
And so I think that's one big benefit.
31:54
But yeah, again, I think adoption is probably the biggest
31:56
challenge with any new technology, especially with
31:58
something like passkeys. If people are on an app to, you
32:02
know, talk to their friends or watch content or something like
32:05
that, you know, are they really interested in interrupting that
32:09
experience to create a passkey? I don't know.
32:12
And I I hope they are, I I hope that they want to.
32:15
But of course, I think it is important to start small if you
32:19
can, and make it available to your users.
32:21
I think that we should always make security available when
32:23
it's when possible. So there's ways that you can
32:27
start out small, offer it in settings right to start with and
32:30
see if people naturally are going to try to go do it.
32:33
Try to ask them to do it in user experiences where it makes
32:36
sense, right? Like account recovery, logging
32:39
in, things like that so that next time they can use it,
32:42
things like that. So there's probably ways to do
32:44
it slowly and just test out where it works best for your
32:46
user base depending on the app that you have and and what the
32:50
app is meant to do. Yeah.
32:52
One of the things, so Jeff mentioned, we met at the
32:55
Authenticate conference and I was thinking one of the things
32:58
that I think has made this so possible and so successful is
33:04
what the Fido Alliance has done with passkeys overall.
33:08
And I'll tell you, we were at the universe and like the amount
33:11
of universal appreciation, acceptance for Fido 2 and
33:17
passkeys, it's like it's really like nothing I've ever seen.
33:21
There's always seems to be maybe not polarization, but there
33:24
seems to be, you know, some percentage of people who think,
33:28
OK, that's not good, but it it doesn't feel that way with 502.
33:34
I mean the investment that they're making to build a
33:37
community around the investment they're making to build
33:41
standards like user interface standard contributes a lot to
33:47
it's kind of become ubiquitous, right.
33:50
It's kind of like nobody has to explain to you how you do one
33:53
time passwords with an SMS text, right.
33:56
It's like we've gotten so many of them it's ubiquitous pesky's
34:01
has to get like that till to get to the kind of the adoption
34:05
level where it belongs. But maybe you could talk about
34:09
your interfacing with the Fido Alliance in terms of how they've
34:14
supported the community at large and you?
34:17
Yeah, the Fight Alliance has been, you know, one of the
34:21
biggest, biggest, I think supporters for us in getting
34:25
this out there and also connecting us with teams at
34:28
Google and Apple to ensure that our adoption and integration of
34:34
passkeys is the best experience possible for our users.
34:37
So we definitely owe a lot to them in the sense that they have
34:40
helped us to, you know, roll this out to our users as fast as
34:44
possible by, you know, connecting us to the right
34:46
teams, the right people where we can ask questions, solve
34:50
problems quickly, things like that.
34:52
So definitely has been huge for us in in making this happen at
34:56
TikTok. And also excitingly enough if
35:00
you look at the website, TikTok is now on the Board of Directors
35:02
for the Fido Alliance, which is awesome.
35:04
So we're we're getting to be a bigger part of the conversation
35:09
which is really exciting talking about you know the user
35:12
experience, things like that and just being you know a bigger
35:15
part of the alliance itself and contributing to the future of
35:20
502 in this technology. And they have great
35:23
documentation too on the website with the they do user guides and
35:26
sort of not deployment guides but you know implementation and
35:30
and kind of things like that. I know that our friend Andrew
35:33
Shikiar who's over there, you know spent a lot of time getting
35:36
it up and running and it I think it definitely shows.
35:38
I think it's, you know, top of class, 1st class, whatever you
35:41
want to call it, right. But from a documentation
35:43
standpoint that put it right up there with what I've seen from
35:46
other organizations. So definitely, I would imagine
35:49
probably pretty helpful to have something like that to fall back
35:51
on and say, OK, well, how does this work?
35:52
But then also like the big brains that you're also
35:56
interfacing with say, oh, you know, how do we challenge, you
35:58
know, how do we satisfy this use case or whatever this challenge
36:01
may be? Can I talk a little bit about
36:04
the security side of things? Because they feel like this is
36:07
an area that, you know, we want to make sure that people are
36:11
secure, they're using things. Passkey's a big step towards
36:13
that for sure. I'm totally on record as being a
36:16
big fan of AI. You know, I I'm a fan of it.
36:20
I am not afraid to admit that I subscribe to a couple of very
36:23
specific AI services. Right, Exploring and testing
36:27
with it. One of the things that I've kind
36:30
of tested with is this idea of impersonation.
36:33
And at some point I feel like I'm going to be at the stage
36:36
where I can actually do an entire Identity Center podcast
36:39
with all the voice samples that Jim and I have put together over
36:42
the years, and I wonder if anyone would notice.
36:45
I have to imagine, you know, there's lots of companies that
36:47
are, you know, encountering this.
36:50
There was one in the news, I think it was last week aboard.
36:53
You know, somebody got tricked for $25 million using deepfakes
36:56
and video on a team's call. I mean, it's crazy how easy it
37:01
has become and I think it will continue to get easy.
37:04
That seems like it's a pretty big threat.
37:05
I guess what are some of the challenges or concerns that you
37:09
see and how do you kind of stay ahead of that sort of thing?
37:11
Yeah, and and based on what you said in your example, it sounds
37:15
almost like people were impersonating other people to
37:20
fish the person. Essentially, yeah, it was I'll,
37:24
I'll, I'll butcher it. Someone will definitely correct
37:26
me I'm sure. But the the idea was people are
37:28
on a teams call and they were using deep fake video to pretend
37:34
to be different members of the board and having conversations
37:37
and essentially tricked this more junior member into wiring a
37:41
whole lot of money to an account.
37:44
And you know, next thing you know 20, some $1,000,000 I think
37:47
it was or I think it was 25,000,000 something like that
37:49
was gone. And it was predicated on this
37:52
idea of, I even know what we would call it, It's it's
37:55
fishing, but it was a very elaborate, you know, fishing
37:59
exercise to do it with deep fake video, deep fake audio, multiple
38:03
cameras and sessions running, right, to be all that.
38:07
I mean, it sounds pretty sophisticated to me, but it's
38:09
just going to get easier. And it it, it's something that
38:12
I've been thinking about for a long time is how do we protect
38:15
against that sort of thing? Do you have any ideas, thoughts?
38:18
Does it keep you up at night like it does for me?
38:22
Like what are your What are your feelings there?
38:23
Yeah, I mean, I think anyone is is probably afraid of the ways
38:29
that technology, especially new technology can be used for, you
38:33
know, malicious purposes like you said, using things like AI
38:37
to trick someone into doing something.
38:41
It sounds very scary, right for me.
38:45
I think when we talk about passkeys, and this is something
38:48
that you can see the vital lights talks about a lot, it's
38:51
just so you said you had someone from Nest as well on the
38:53
podcast. I think the reason why people
38:56
endorse passkeys so much is because it is phishing
38:58
resistant, right. It's been cited in, you know,
39:02
the White House memorandums. Nest, like a lot of
39:05
organizations at the governmental level have endorsed
39:07
it for this precise reason. And so I think that passkeys is
39:12
a great way to provide more security to users in these
39:16
scenarios where there might be some malicious use of new
39:20
technology to try to get people to do things that they probably
39:25
shouldn't do. And so I I think that there are
39:28
new, like you said, not only maybe are there new technologies
39:31
that can be used for bad purposes, but new technologies
39:34
that can be used for good purposes.
39:35
And so what's great is I think that we are focusing on giving
39:41
people the defenses that they need to protect against this.
39:45
Yeah, and I looked it up. It was 25,000,000 deep fake with
39:48
the Chief Financial Officer and I feel like if there was a
39:53
phishing resistant mechanism where I say that's fine right?
39:56
Let the person do the initiate the transaction.
39:58
But if the CFO had had to use a a phishing resistant mechanism
40:02
to have the transaction go forward, it would have gotten
40:06
stopped at that point. Or at least the chances of it
40:08
progressing would have been lower it seems like.
40:11
Yeah, it definitely seems like it would have been more
40:13
complicated. I I know that I'd authenticate.
40:15
There was a presentation that demonstrated this kind of
40:18
scenario, right? And I remember the woman who
40:22
presented it was showing how you could take someone's voice and,
40:26
you know, get the code from someone.
40:28
Things like that. Showing how even if we think
40:30
sending text messages or OTP codes to your e-mail, you know
40:35
is is a good way of, you know, authenticating identity, that
40:38
there are other things that someone might do if they have
40:41
enough motivation to get that information from someone.
40:44
And and she showed in her video how she did that, which was, I
40:48
thought really interesting and kind of what you're talking
40:52
about here, I think and and how Huskies or other fishing
40:54
resistance technology can help to prevent that.
40:57
I mean how it would have stopped her in that, you know,
40:59
fictitious scenario. So we've had a pretty exciting
41:02
conversation. I'm glad we're able to reconnect
41:05
after our Authenticate show and kind of bring you back and have
41:08
a little more, you know, deeper conversation into it.
41:12
I want to end the show on a lighter note as we normally do
41:14
and we're all travelers. So I came up with the ultimate
41:19
question that is going to cause controversy upon controversy
41:23
window seat or aisle seat, which do you take on a plane?
41:30
Yeah, definitely controversial for me because I have, I think
41:33
the minority opinion here. I'm an aisle seat person, which
41:36
I think people are really against, but this is only me.
41:40
OK, yeah, defend yourself here. OK, let me defend.
41:45
OK, so maybe on like a long haul flight I'll choose like a window
41:49
seat, right? Because I want to sleep, but I'm
41:51
so bad at sleeping on flights. Like, unimaginably bad.
41:54
I went to Tokyo in December, and I'm not going to lie to you, I
41:58
played my Switch the entire time on that flight.
42:01
Embarrassing. That's like 10 hours, Zelda.
42:04
Yeah, exactly. I blast like tears of the
42:05
Kingdom. Yeah, I love Zelda more than
42:08
anything. It's just so fun to just run
42:11
around like I'm just, I'm just looking at things.
42:14
I'm not even playing the game. I'm just, I'm on a safari.
42:17
So. But I I don't know.
42:20
I like the Isle because I like to have control of this
42:23
situation and I like to be able to choose when I get up and like
42:27
go to the bathroom, things like that, blah blah, blah.
42:29
I'm the gatekeeper of the bathroom for my row.
42:32
I'm I'm the leader of the row, you know, So I I want to.
42:35
Get past you. Yeah, exactly.
42:37
Yeah. You have to pay the toll to get
42:38
through, you know. Show me your TikTok account.
42:40
Do you have passkeys enabled? OK, you can pass.
42:43
This is our adoption strategy. No, I'm just kidding.
42:48
But yeah, I don't know. I I feel like that's a
42:51
controversial opinion, but that's.
42:53
Definitely, Jim, what's your controversial stance on this?
42:56
I think I know. What yours is, but I'm
42:59
unapologetically aisle seat and I kind of have wide shoulders.
43:04
I'm not saying that in a bragging way, but I kind of have
43:07
to lean out of the aisle. If I'm in a window seat, I'm
43:11
very cramped. What I think is controversial,
43:14
if you were to say middle seat and I've actually met someone
43:17
who said I like the middle seat, why?
43:20
Because if yours here is her mentality and she was a smaller
43:25
frame person, so that helps. But she said if she's got the
43:28
window seat, she gets too claustrophobic.
43:30
She feels like she's trapped because there's two people
43:35
keeping her penned in. But on the aisle seat, you know
43:40
I've run into this. I've been kind of a road warrior
43:42
for a long time is if you're hanging out into the aisle, it
43:47
it seems like the flight attendants like ramming the the
43:52
beverage cart into your shoulder and it's like I'm not hanging
43:56
out because I'm a bad person. I'm hanging out to give the
43:59
person next to me some extra room.
44:01
You're supposed. To say you're hanging out
44:02
because you're so swollen jacked you don't fit into your one
44:05
seat. Yeah, yeah, What was the the
44:10
Super Bowl commercial with Arnold Schwarzenegger, neighbor?
44:15
Neighbor. Hey neighbor, don't run that
44:17
luggage cart into me. Yeah, that wasn't funny.
44:21
Anyway, I'm. Going to isolate that and use
44:24
that for something. Yeah, go make it a song.
44:27
Make it a viral. There we go.
44:28
We just went viral. That's our pasty video.
44:32
We've just made it. My only exception I'm I'm taking
44:34
way too long to answer this question, but my only exception
44:36
would be that if I have like a super early morning flight, I do
44:40
like the window seat because then I'll put my head against
44:43
the side of the plane and kind of sleep.
44:45
What about you, Jeff? I used to be aisle and now I'm
44:49
window, but I don't care so much.
44:53
So what's the most important for me is to have under seat storage
44:58
because I always like to have my bag near me.
45:00
I generally do not check any baggage so I'm usually on carry
45:03
on only. Like everybody I've talked about
45:06
it, right? I like one bag travel as much as
45:07
I can, have stuff underneath me and have to worry about overhead
45:10
space and just kind of go. But I am a Danny.
45:13
I'm pretty similar to you. I am terrible sleeper on fly, on
45:15
fly Flyers can't talk today on planes and I'm getting better at
45:22
it but I still have challenge trying to like do a long haul
45:26
sleep flight even if it's like a lie flat sleeper.
45:29
It's just it's not happening for me.
45:30
So I'm the same way. I will either be playing a game,
45:32
watching movies, doing whatever it may be right to kill the
45:34
time, but I am window now, purely for the facts, for the
45:40
most part, is when you're boarding the plane, everyone is
45:44
banging it to you in the aisle, in the aisle, in the aisle,
45:47
there. Every time someone, someone
45:48
comes and goes, they're getting you.
45:50
I'm actually the opposite of you, Daniel, though.
45:52
So for most flights I'll be window.
45:54
But for a long haul, I actually prefer the aisle because I want
45:57
to have more direct access to getting up to go to the
46:00
bathroom, stretch legs, you know, whatever it might be.
46:02
I'm kind of a little flip flop there and I'm sure you know
46:05
there are strong opinions either way, but that's kind of my take
46:09
on it is what's most important for me is under seat storage.
46:12
Generally speaking, the aisles or the.
46:15
I'm sorry, the window seat has pretty consistent under seat
46:19
space. Sometimes you get those really
46:21
lame aisle seats that have like the power box or whatever like
46:25
sticking halfway in and you can't get your bag even under
46:27
there. I hate that.
46:29
So it's generally safer for me to pick a window seat.
46:31
That's a hill I'll die on and I'll fight anyone who who wants
46:34
to come at me at that. All right.
46:38
I think that's probably a good way where we can leave it for
46:40
this week. Daniel, thank you so much for
46:43
taking the time again to be with us.
46:44
Hopefully we'll see you at a conference in in the future.
46:47
Maybe identiverse, maybe authenticate, maybe Identity
46:50
week. America, we've got discount
46:52
codes galore, so hopefully you take advantage of that.
46:56
But yeah, appreciate you take your time.
46:58
Yeah. Thank you.
46:59
Yeah. We'll go ahead and wrap it
47:02
there. For this week.
47:03
We're on the web, idacpodcast.com.
47:05
We're on Twitter or X or whatever it's called.
47:08
By the time you listen to this at IDAC Podcast, we're on
47:11
Macedon at IDAC Podcast at infosec dot exchange.
47:15
Connect with us on LinkedIn. I'll have a link to Daniel's
47:19
LinkedIn profile if you want to ask him questions maybe about
47:21
his past key experience or you know, in a polite and nice way.
47:26
Disagree or agree on the aisle or window seat choice?
47:30
And I'll have links in our show notes as well for all the
47:33
discount stuff that we mentioned for the conferences and
47:35
obviously can connect with Jim and I.
47:37
We love it when you hear from folks.
47:38
It's great with people leave reviews.
47:39
So whoever left that review, you know, talk about how great the
47:43
show was and especially if you're agreeing with me on the
47:45
hockey talk, you know, 100% Gold Star for that person and keep
47:50
those reviews coming. So we'll leave it there.
47:52
Thanks everyone for listening and we'll talk with everyone in
47:55
the next one. You've been listening to
47:58
Identity at the Center. We hope you've enjoyed the show.
48:02
Make sure to like, rate and review and we'll be back soon.
48:07
But in the meantime, hit the website at
48:09
identity@thecenter.com and find us on Twitter at IDAC Podcast.
48:16
See you next time on Identity at the Center.