Latest / Identity at the Center / #242 - Authenticate 2023: Passkeys with Pedro Martinez of Thales Group

Transcript

#242 - Authenticate 2023: Passkeys with Pedro Martinez of Thales Group · Identity at the Center

• 0:05
  This is identity at the center. If it has anything to do with
• 0:10
  IAM, this is the go to podcast now your hosts Jim McDonald and
• 0:17
  Jeff Stedman. Welcome to the Identity at the
• 0:23
  Center podcast. I'm Jeff and that's Jim.
• 0:24
  Hey, Jim. Hey, Jeff.
• 0:25
  How are you? Not so bad yourself.
• 0:27
  I'm doing great. You know, it's good.
• 0:29
  Again, we're at the Authenticate conference and it's a really
• 0:32
  cool conference. I mean you know it's not one of
• 0:35
  the really big conferences we go to like Gardner Eidner Verse or
• 0:39
  some of the vendor specific conferences.
• 0:42
  However, like you'll see signage that say MFA is so 80s.
• 0:48
  And I'm like, I feel like I'm still going around to my clients
• 0:51
  saying make sure you have MFAI mean, I know it's old, but it's
• 0:59
  kind of like I'm in between, right?
• 1:01
  Because you better have MFA. But at the same time, it's this
• 1:06
  passerless phenomenon. It's kind of like making it
• 1:10
  passe. Well, passkeys are having its
• 1:12
  moment in the sun right now, but at the end of the day you still
• 1:15
  need to have some factor additional to.
• 1:19
  Just a password, right? So MFAI think is still valid.
• 1:23
  Lots of companies out there have spent the last couple years
• 1:25
  investing in even just getting MFA off the ground, especially
• 1:28
  with, you know, the pandemic and people working from home and
• 1:31
  needing to do better authentication on that, which is
• 1:33
  great. MFA still has a place in the
• 1:35
  world. It's better than not having MFA.
• 1:38
  But clearly the future is shifting towards passkeys and
• 1:42
  Fido authentication. We've seen Google, Microsoft,
• 1:45
  Apple. Yeah, so I don't want to poo poo
• 1:52
  all over the MFA thing. It definitely feels like it's, I
• 1:56
  don't want to say legacy, but we're approaching that.
• 1:58
  It's kind of like, OK, SMS, right?
• 2:00
  That was top of the line 10 years ago.
• 2:02
  SMS is the best thing you can do now.
• 2:04
  It's not even recommended. Is it better than nothing?
• 2:06
  Yes, of course. But people aren't recommending
• 2:10
  that you start with SMS now, They're starting with, hey, you
• 2:13
  should be looking at pass keys for your.
• 2:17
  I also think there's a difference between enterprise I
• 2:19
  am and customer I am. I think that's probably the
• 2:24
  biggest dividing line because usually customer I am is focused
• 2:28
  on apps and and the web, whereas employee workforces.
• 2:36
  I mean it can be anything from legacy green screens to VPNs and
• 2:41
  and as well as you know apps that are either desktop apps or
• 2:46
  web enabled apps of all generations so.
• 2:49
  Those are different. They're captive audiences,
• 2:51
  right. I mean your employee, your your
• 2:54
  employer can say this is the way you're going to do that, right?
• 2:58
  And you don't have generally speaking much of A choice within
• 3:01
  those rails consumer side of things.
• 3:04
  It's. How easily can I get you to
• 3:06
  spend money with me, right, or give me data or whatever The
• 3:10
  thing is right? So of course you need to have a
• 3:13
  minimum threshold of security, but it is much more open to,
• 3:19
  hey, let's look at it easier ways.
• 3:21
  You know, the user experience is much more predominant now.
• 3:24
  I think that's changing, thankfully, but I think that's
• 3:27
  still sort of a general thrust between the two.
• 3:29
  Yeah, absolutely. So I think the pesky's are a big
• 3:32
  topic. You know how they fit into
• 3:34
  authentication, especially customer I am is something that
• 3:40
  we ought to explore And to that to that end we have a great
• 3:45
  guest today. Yeah.
• 3:46
  When you say explore, I think of the cowbell.
• 3:48
  Let's explore the space. Let's explore the space of task
• 3:51
  keys. Want to welcome to the show
• 3:53
  Pedro Martinez. He's a business owner for
• 3:55
  Digital Banking Authentication at Tallis Group.
• 3:57
  Welcome to the show, Pedro. Thank you very much.
• 4:00
  It's a pleasure. Yeah, Thanks for taking the time
• 4:01
  with us. One of the things that we like
• 4:03
  to do when we have someone on for the first time is to really
• 4:06
  kind of learn their identity origin story.
• 4:08
  How did you get into the world of identity access management?
• 4:12
  Is it something that you chose or did it choose you?
• 4:18
  No, basically 25 years ago I went to a job interview knowing
• 4:22
  very exactly where I was going and I found myself working into.
• 4:27
  And Identity and access company which at the time was called the
• 4:34
  Schlumberger and and has been evolving name over time to the
• 4:42
  point that today without having changed companies it's talents.
• 4:47
  So I didn't know at the at the end but it happened to be a.
• 4:51
  Very. A very lucky, I would say a very
• 4:55
  lucky situation because it put me in the right place at the
• 4:57
  right time because we are talking about this was 1998 when
• 5:02
  I joined. And all the sudden it turns out
• 5:06
  that this company that I interviewed for and they finally
• 5:08
  hired me, their main business was to manufacture smart cards,
• 5:13
  smart cards for either banking, so for payment cards at the time
• 5:18
  that we were starting with the transition from.
• 5:21
  Max drive towards cars with a chip and at the same time we
• 5:26
  were having the the big roll out worldwide of GSM technology with
• 5:32
  SIM cards and so you there was a point in the where where you
• 5:39
  essentially would be walking down the street and you will
• 5:41
  heat a stone and you would have a.
• 5:45
  A licence for a for a mobile operator popping out, popping
• 5:48
  out the floor. It was there were licences
• 5:50
  coming out all the time in each country around Europe and later
• 5:54
  on it was around here. So it was, it was a boom of
• 5:57
  telecom and and it was, it was a happy moment to get into that
• 6:01
  kind of market that all the way until now changing a lot over
• 6:05
  the years because that was very hardware centric at the time.
• 6:09
  Around cars, the manufacturing, the personalization it was, it
• 6:12
  was not just manufacturing cars. The the main, the main value
• 6:16
  that we were bringing was the fact that every single SIM card
• 6:20
  or banking card that was leaving our factory was personalized.
• 6:25
  It was charged with a specific unique credentials to be
• 6:29
  associated. So that was what was making.
• 6:31
  We were making millions, but each of one was coming out as a
• 6:35
  different product, already personalized from the factory at
• 6:38
  the time. So that evolved a lot and over
• 6:40
  time it, it turned more towards software and and back end
• 6:48
  services than the actual development.
• 6:51
  So today it's a mix. We still do SIM cards, we do
• 6:54
  banking cards, but we do a lot of back end solution, server
• 6:58
  solution, solutions for securing digital banking, digital
• 7:02
  payment, tokenisation. Etcetera, etcetera.
• 7:05
  So that that was it was purely by chance.
• 7:07
  I didn't know what I was getting into and am I 25 years late?
• 7:11
  That's how I feel like a lot of people in the space sort of just
• 7:14
  ended up in it. You have a title of business
• 7:18
  owner, at least I introduced you as business owner for digital
• 7:20
  banking authentication at Tallis Group.
• 7:23
  I got two questions. First question is what does
• 7:26
  business owner for digital banking authentication mean?
• 7:29
  You know, what do you do? And then tell us a little bit
• 7:31
  about Telus Group because I think it's it's a large company
• 7:34
  that people who prefer maybe people aren't familiar with
• 7:38
  bring us up to speed on that. So well, first of all business
• 7:43
  owner means that my role today is not technical.
• 7:46
  I have a responsibility which is worldwide.
• 7:50
  It's not a specific to a region and I I I basically I'm
• 7:55
  following all the. Opportunities that we have for
• 7:59
  business related to these type of solutions of authentication
• 8:03
  for digital banking with customers and with our sales
• 8:07
  teams around the world. I am not frontline, not normally
• 8:13
  with customers. I am.
• 8:16
  I am obviously our sales teams. Our sales teams are.
• 8:20
  I am called on occasion to to help, to assist, to have
• 8:23
  conversations and particularly with the topic of passkey that
• 8:26
  I've been exposed a lot over the last 1618 months.
• 8:31
  We have been very proactive in going and talking with customers
• 8:34
  and I have been and we wanted to gather as well a lot of feedback
• 8:37
  we were sharing with them what we knew and they were they were
• 8:41
  coming back. So business owner means that I
• 8:43
  follow the business not not at a deep technical, just following
• 8:48
  the opportunities and helping our.
• 8:50
  Our regional teams to to sell, to sell our stuff, yeah.
• 8:55
  And Telus Group is a French company.
• 8:56
  I didn't know much about Schlumberger, but I just
• 9:00
  pronunciation leads me to believe that was a French
• 9:03
  company. Well, nothing to do because they
• 9:07
  were completely different companies.
• 9:09
  I'll I'll just to as you as you mentioned Schlumberger,
• 9:12
  Schlumberger, I don't know if I'm pronouncing it well, I don't
• 9:15
  know if I but. The origin of that company is
• 9:18
  American, it was a couple of and the name of Lamborghinis
• 9:22
  probably is probably I think that it was to German or German
• 9:28
  origin brothers that the family name and it's a it's an American
• 9:33
  company Oilfield services as the main business.
• 9:36
  But they had a division that was working on something completely
• 9:40
  different and it was the business that I was talking
• 9:42
  about. Smart cars, smart cars,
• 9:45
  technology now. And that's what that's what I
• 9:47
  joined over time. There was a point where we, we
• 9:53
  went through an IPO and we became an independent company.
• 9:56
  Just this division, there's so, so much it continues to to work
• 10:01
  and do a lot of great business around all field services,
• 10:04
  engineering, services, very, very impressive.
• 10:07
  And we became an independent company under the name of
• 10:09
  Axalto. Then we merged with our first
• 10:12
  competitor which was, I'm talking about my my Origin that
• 10:17
  we merged with our main competitor.
• 10:19
  We became Gemalto at the time as a result of that and and we were
• 10:24
  the number one provider for, for all these kind of of products.
• 10:28
  So now Talas. And now Talas acquired us about
• 10:32
  five years ago. And Talius is a big is a big big
• 10:36
  company French multinational with working with divisions
• 10:41
  around aerospace, around defence and also around civil services.
• 10:48
  And we have joined as a as a as a division within Talius around
• 10:53
  cybersecurity. Our the name of our division is
• 10:59
  is is DIS Digital Identity and Security.
• 11:04
  And yeah, we we we bring that that aspect of for for security
• 11:10
  always with the aspect of security but very centre on on
• 11:13
  the digital life And so for those who are not very familiar
• 11:16
  are is supposed to be the work that you do in Europe.
• 11:21
  I'm sorry, are most of your customers in Europe?
• 11:24
  No, no, no, no. We we are.
• 11:27
  I mean, I if I talk, I. I'm going to talk about the DIS,
• 11:32
  the digital identity and security.
• 11:34
  We are a very multinational, very multinational company.
• 11:37
  Even the part that related to Gemalto, remember that we were,
• 11:42
  we were, we were working with banks and with telcos and with
• 11:45
  governments, because I talk about banking cards and SIM
• 11:48
  cards, but we also were were providing electronic passports
• 11:53
  and electronic IDs, for example, as well as equipment for reading
• 11:57
  them. To to governments, to telcos, to
• 12:02
  banks. All around the world, All around
• 12:04
  the world. We are.
• 12:05
  So you're working with like some really large clients and this
• 12:11
  idea of passwordless. I mean we've relied on the
• 12:15
  password for so long and I've heard you make the statement
• 12:18
  passkeys will replace the password.
• 12:21
  I'm wondering why you say that and what kind of reaction you
• 12:25
  get when you say that to these big organisations that you work
• 12:29
  with. So that's that's that's actually
• 12:33
  it. It it all started well, it all
• 12:35
  started last year. We have been working, we have
• 12:38
  been members of the Fido alliance since very early on.
• 12:43
  We are board members and we have been participating actively
• 12:47
  leading leading WAR groups. We have contributing to it and
• 12:51
  we have been building products and certifying our own products
• 12:54
  as as Fido products. But it is a technology that we.
• 12:57
  Always consider that he had promise and we were following
• 13:00
  and we were coming with products.
• 13:01
  But it was last year in May when Apple, Google and Microsoft did
• 13:09
  something that to my knowledge, because I haven't been able to
• 13:12
  find any president of that, did something unique, which was to
• 13:17
  issue a joint PR. The three of them.
• 13:21
  That was the moment where we said, OK, this is even bigger
• 13:25
  than. We thought it would be, it was
• 13:29
  we, we we really saw that this was going.
• 13:32
  We knew that everybody had been working and had been doing all
• 13:35
  the plumbing that would be necessary for this technology to
• 13:38
  succeed. But sometimes that's not enough.
• 13:41
  No. But when we saw that level of
• 13:43
  commitment and that level of commitment from the three of
• 13:46
  them, we said OK, well, so here there is something big that is
• 13:49
  going is, is, is really going to happen and we decided that we
• 13:52
  needed to. Start to evangelise a little bit
• 13:56
  to take the opportunity. It was, it was, it was not the
• 14:00
  time yet to take an action from from customers last year.
• 14:05
  But it was an opportunity for us to go see our own customers and
• 14:11
  and share information with them that we believe they would find
• 14:15
  valuable because what we were convinced is that they weren't,
• 14:18
  they didn't know what was coming.
• 14:20
  So even if there was this announcement.
• 14:25
  People was not processing visa. What is irrational at the time
• 14:29
  you read? Sorry, it sounded irrational
• 14:31
  because you if you haven't had time to observe the idea.
• 14:35
  Yeah, or or or you just don't, you know, I mean, we have been
• 14:38
  depending on passwords for as long as there is Internet.
• 14:43
  It has come to a point and nobody likes them.
• 14:46
  Nobody, Neither the service providers nor the end users.
• 14:50
  Nobody likes to use passwords. And yet we have come to accept
• 14:55
  that it is what it is. It's always been like this.
• 14:58
  It gets to a point, except everybody that is working here
• 15:01
  on a solution. Everybody that is out of this
• 15:03
  bubble. It has come to a point that they
• 15:06
  just accept that they have to manage 50 or 60 or 7 different
• 15:09
  passwords, that every time that they are going to a login that
• 15:12
  they have not visited in three or four months there a standard
• 15:15
  login user experience is going to be going through the password
• 15:18
  recovery mechanism. We have come to accept all that
• 15:21
  as as just the way things are, no and and even even our
• 15:26
  interfaces in companies. Anyway, we we thought that we
• 15:29
  needed to go on, we needed to to share information and to see the
• 15:32
  reaction as well. And and we started to go out and
• 15:37
  we started to plan our most beloved customers and and and to
• 15:41
  see them. And when we started to do these
• 15:43
  meetings indeed we we said we want to grab their attention and
• 15:48
  we are going to start by by by by poking a little bit and and I
• 15:55
  will start with a slide that was saying flat out and this is
• 15:59
  going at customers that I don't normally see.
• 16:00
  It's not like they know me. I mean, they they just see.
• 16:03
  A weird guy that is coming with her with her with her the the
• 16:07
  typical contact which is the salesperson for that account or
• 16:10
  or anyway and and and and along comes these these weird guy you
• 16:15
  know and and he sits in the room and and he comes out and comes
• 16:18
  out with a slide and start by saying passkeys are going to
• 16:23
  kill password. It is inevitable, and it's going
• 16:26
  to happen fast. And the reaction was as
• 16:30
  expected. You could, you could see it.
• 16:32
  I mean you would be in the room and maybe there were 5-6 people
• 16:35
  depending on on the gathering and the customer and all the
• 16:38
  sudden you would see a one guy typically security architect or
• 16:42
  so that would lean back on the chair and cross there and cross
• 16:45
  there. They didn't have to.
• 16:48
  Say anything. It was the body language.
• 16:49
  Yeah, yeah. They didn't say anything.
• 16:51
  No, but. But that was somehow intended.
• 16:54
  It's a way to be you. It was creating a little bit of
• 16:57
  attention and then and then from there you you want.
• 17:01
  I wanted them no to to challenge that that statement.
• 17:05
  But when you go through it, the question was, OK, I understand
• 17:09
  you who you don't believe. Why would you believe it?
• 17:11
  I mean you have always seen these and it has never, it has
• 17:13
  never happened. When you go through that and you
• 17:16
  start to explain them that, well then I was explaining why are
• 17:20
  they why it is inevitable that this is going to happen.
• 17:23
  And then I was starting with the lamest argument possible.
• 17:26
  Which was to tell them because they are great and they were
• 17:30
  kind of kind of laughing well, but they are great.
• 17:33
  Let's see. They are really great because
• 17:34
  they are clearly providing, compared to passwords, they are
• 17:38
  clearly providing a much better user experience.
• 17:42
  And you could expect rolling their eyes, yeah, the better
• 17:45
  user experience, OK. They provide a much better
• 17:49
  security and you can get into actions and you can start to
• 17:52
  talk there about they cannot be fished.
• 17:55
  They cannot be subject to a massive data leaks that begins
• 17:59
  to touch ground because they have seen them.
• 18:03
  Either they have suffered them themselves or they have seen
• 18:06
  nearby bombs dropping to them. And then you can tell them I
• 18:10
  need and and as a third argument of why they are great because
• 18:13
  they can reduce your cost very significantly.
• 18:17
  The cost of the password research represent one of the
• 18:21
  biggest 'cause that you have related to customer care, so
• 18:24
  that is quantifiable. OK, they are great, but that is
• 18:27
  not enough. What is the second big reason
• 18:30
  why it's inevitable is because and that's where where you you
• 18:35
  come out with APR and you say look at the level of
• 18:38
  commitments. This is something unprecedented,
• 18:41
  these guys, Microsoft, Google, Apple and the industry behind
• 18:47
  them, because the Fido alliance with everything that comes
• 18:50
  behind these guys have declared publicly.
• 18:54
  That they are committed to end with passwords.
• 18:57
  This begins to be this begins to be something you've got to think
• 19:02
  if all of your Apple, Microsoft, Google, Amazon services start
• 19:08
  using passkeys. It becomes ubiquitous.
• 19:10
  Everybody gets used to doing it. Who's listening to this podcast?
• 19:14
  Who isn't used to doing MFA? Because at one point in time,
• 19:18
  that was almost unheard of. They're going to send me a
• 19:22
  message to my phone and I've got to enter that.
• 19:25
  You know, it was, it was new. Well, now everybody gets it.
• 19:29
  You see that pop up? Check your phone for message or
• 19:33
  for a one time password, etcetera.
• 19:35
  The same thing's going to happen with passkeys, right?
• 19:39
  Yeah we are going to get used because we are going to see it.
• 19:42
  But but there are two two aspects and this sometimes is it
• 19:45
  it gets especially talking and that's what a different you you
• 19:48
  said Microsoft, Google, Apple and Amazon.
• 19:53
  Obviously they are big must as as service providers but we have
• 19:57
  to make the difference with Microsoft, Google and Apple
• 19:59
  because the other reason that brings to say that this is
• 20:02
  inevitable is that day three they hold the platforms for all
• 20:08
  the. End user communication devices,
• 20:11
  whether they are computers, tablets or or or phones that we
• 20:17
  all use, you have there practically 100% of the market.
• 20:21
  And if they three are telling we are going to make this happen we
• 20:25
  are going to do everything that is necessary at the level of our
• 20:28
  devices and at the level of the operating systems for this to be
• 20:32
  enabled. That is a big thing and indeed
• 20:34
  they did the announcement that announcement that told us wait
• 20:37
  this is going to happen and over the next that was the 5th of May
• 20:40
  actually that's password they of 2022 and over the 5-6 months
• 20:47
  that followed they they they were true to their to their
• 20:51
  commitment because by the end of 2022 you had you had you had
• 20:58
  Windows, you had you had Android, you had iOS you had Mac
• 21:04
  OS equipped for passkeys natively.
• 21:09
  Yeah, all along. So you're drawing the
• 21:12
  distinction on Google, Microsoft, because they have the
• 21:15
  devices. Next level down might be Amazon,
• 21:19
  eBay, TikTok, you know, does anybody not think this is going
• 21:25
  to happen? Is anybody thinking this is not
• 21:29
  going to happen? Well, it depends.
• 21:32
  I mean if you, if you think well, OK, so so there is, there
• 21:37
  is, there is, there is banks, there is certain industries and
• 21:42
  in particular the banking industry that because that was
• 21:46
  the second part of the conversation that we were having
• 21:48
  at that table with those with those customers, no, even with,
• 21:52
  with with the person that was leaning back on the table.
• 21:56
  The first part of the conversation was to tell them
• 21:58
  this is going to happen, this technology is going to thrive.
• 22:01
  The second part of the conversation was, well, is this
• 22:06
  fitting well for financial institutions?
• 22:08
  And there things were getting complicated.
• 22:11
  And in part, besides sharing information with them, we also
• 22:15
  wanted to get their feedback to see how they see it, because at
• 22:17
  the beginning there was quite some, quite some, quite some
• 22:20
  doubts. Why is that?
• 22:22
  At the same time that Google, Apple and Microsoft said we are
• 22:25
  going to we are going to enable this technology and make it
• 22:29
  natively, they also came out with a notion of synchronisation
• 22:34
  of of pass keys. All the work that had been done
• 22:37
  at the Fido Alliance to build the pass keys was always under
• 22:42
  the consideration that a passkey was bound to a device.
• 22:48
  Passkey is created on one device, you create that
• 22:51
  credential and that credential. Once it is created it it creates
• 22:55
  a unique link between a service provider, a user and and then a
• 23:00
  specific device and so it becomes a possession factor, a
• 23:06
  possession factor for a multi factor authentication.
• 23:12
  However, the moment that you enable synchronisation, which is
• 23:15
  great from for for more than one reason for one side because it
• 23:20
  simplifies the user experience, you don't need to create a
• 23:23
  passkey for every single device that you have.
• 23:26
  You can just create one passkey on one device.
• 23:30
  And if you have multiple devices on the same my myself, I I use
• 23:35
  Apple devices. I've got to say, I have a Mac, I
• 23:37
  have a tablet, I have a. Fanboy.
• 23:41
  You're a fanboy. Well done.
• 23:42
  Hey, it. Works and they're good.
• 23:43
  Device I like we all, we all, we all have our.
• 23:46
  He said he stares at his back book.
• 23:49
  Anyway, The the The thing is that it's great.
• 23:52
  I mean that's synchronisation, it simplifies life and it also
• 23:55
  solves an an everlasting issue related to a strong
• 23:58
  authentication which is the which is account recovery.
• 24:01
  You know if you lose your device then you need to again verify
• 24:05
  your identity in order to create on a new device etcetera
• 24:09
  etcetera. Having this backup, this is
• 24:10
  fantastic, but you have lost the notion of device binding that
• 24:18
  when you create a passkey. I create it on one device on my
• 24:22
  iPhone, but all the sudden that I that passkey is going to flow
• 24:27
  through iCloud and end up available on my iPad and on my
• 24:32
  MacBook. Well, it's difficult to claim
• 24:36
  that that that is a a possession of it's proving it's it's it the
• 24:40
  possession factor. It's proving possession of what?
• 24:43
  At most, it's proving possession or control.
• 24:46
  It's really that I have control of my iCloud account, but not of
• 24:50
  which. Goes back to password which goes
• 24:53
  back to password. So, so in in that was something
• 24:56
  and as we started discussing with with our banks we're
• 24:59
  telling this is going to come, this is something that is
• 25:01
  arriving but but what is, what is going to be your position of
• 25:05
  that? We're talking about the
• 25:05
  second-half of 2022. We're having these conversations
• 25:08
  and some were surprised and were saying no, no, this doesn't
• 25:11
  happen some and we were trying to form our own opinion and
• 25:15
  there were discussings into the Fido alliance as well.
• 25:18
  No, in the end, in the end we scratched our head a little bit
• 25:26
  for a while. But over time as we had more and
• 25:29
  more interviews and we mature our own position it it is not
• 25:32
  that that complicated as that at least in our in our view.
• 25:38
  We think because there is there is any bank that today is using
• 25:48
  passwords even if it's partially because they require something
• 25:52
  more than passwords to meet regulation.
• 25:56
  But if they are using passwords as part of their authentication
• 26:01
  policy, there is in our view, there is absolutely no doubt
• 26:08
  that they should jump at the possibility of replacing those
• 26:12
  passwords for sync passkies, for the passkies, even if they are
• 26:18
  synced. Sometimes when we were having
• 26:20
  this conversation, a customer would say no, no, but but no.
• 26:26
  I mean this is how, how are we going to accept that the
• 26:30
  credential, because the credential is ours, is between
• 26:32
  me, the bank and my customer. How am I going to accept that
• 26:37
  this credential that is mine now it's going to go on flow to an
• 26:41
  iCloud or to a Google password manager and they would have to
• 26:44
  tell them And how is this different to what happens today
• 26:47
  already with passwords you have no control and that is already
• 26:50
  happening because because today when a user is going to a
• 26:54
  website on any of these if I go to my iPhone and I'm trying to
• 26:58
  log in into into a certain account, I can I can choose to
• 27:04
  to to save it into my kitchen. So that is already happening
• 27:08
  with your credentials today. So you cannot consider that
• 27:10
  there is a loss because that's already happening to you.
• 27:14
  So don't don't look at it, don't compare pass keys with your
• 27:19
  strong authentication solution. But are you using passwords as
• 27:23
  part of your of your authentication policy at all?
• 27:27
  If so, it's a no brainer. Replace as fast as you can those
• 27:33
  passwords for pass keys and if you have a solution for a strong
• 27:38
  authenticating OTP or whatever, whatever the solution it is that
• 27:42
  you to meet compliance combined with those passkeys.
• 27:46
  OK, it continues to work. You don't need to make any any
• 27:49
  effort with that. You can do low assurance
• 27:52
  authentication if you want through passkeys instead of
• 27:55
  passwords. And then when you need to step
• 27:57
  up because you want to sign a transaction, you want to make a
• 28:01
  payment and and you need to do a higher authentication, apply
• 28:07
  whatever you have as as as already as a stronger think
• 28:11
  litigation mechanism and that works.
• 28:13
  And over time what can happen that's going to be very easy to
• 28:16
  implement because you just need to connect a back end and to do
• 28:22
  a very minor standard modification into your web
• 28:25
  services. No, just implement web often so
• 28:30
  that you can be calling on passkis.
• 28:31
  You don't need to do anything on the client side because the the
• 28:36
  OS of the devices of the end users are already are are
• 28:38
  already taking their. So it's super easy to add
• 28:42
  passkey support to your web services and all the sudden you
• 28:45
  will see how customers start doing less passwords and more
• 28:49
  passkis and the more passkis they do and less passwords
• 28:52
  that's risk that you are removing, risk of phishing that
• 28:55
  you are removing. It's it's it's only benefits
• 28:58
  that you have from the on that side.
• 29:00
  And if you do just that you are doing yourself a favour later on
• 29:05
  you can consider, well, I mean right now I'm having an
• 29:09
  infrastructure for authentication of passkis based
• 29:11
  on Fido and then I have another infrastructure in place for
• 29:16
  legacy. Legacy for a strong
• 29:18
  authentication. You can say, well actually I
• 29:21
  don't need 2 infrastructures because I can use the fighter
• 29:25
  infrastructure as well to do to do authentication.
• 29:32
  That is 2 factor and that is acceptable from a compliance to
• 29:37
  regulation standpoint. How can you do that using the
• 29:40
  same back end, the same fighter back end that you have for basic
• 29:43
  passkeys? Now you can reuse it if you
• 29:45
  want. If you want to to remove the
• 29:47
  old, the old infrastructure that you have for OTP, how well
• 29:53
  ensuring that pass keys don't don't synchronise.
• 29:57
  Now you were saying before that end users you you can't control
• 30:04
  them in a in AB to C environment, you cannot control
• 30:06
  them, you don't know which platforms they are using.
• 30:08
  So as far as there is one platform that is applying
• 30:12
  systematically synchronisation, well, those those you cannot.
• 30:17
  Consider that you have a solution that fulfils all your
• 30:20
  users like that. So you cannot count on the pass
• 30:24
  keys that are managed by the platforms as your solution for
• 30:27
  authentication. But you can implement Fido, you
• 30:31
  can implement Fido and you can manage pass keys through other
• 30:35
  means, for example through an SDK.
• 30:38
  You can integrate A Fider functionality on your mobile app
• 30:42
  as they do today in in many cases.
• 30:44
  So the bank can use their own mobile app to they can add the
• 30:50
  fider functionality into the mobile apps.
• 30:54
  How important is that control for an organization to own that
• 30:59
  portion of the authentication? So we talked about the platforms
• 31:03
  owning quite a bit of it right now, Google, Microsoft, Apple,
• 31:06
  but you just mentioned. A financial institution for
• 31:09
  example wanting to incorporate the authentication into their
• 31:13
  app in your in your dealings with that industry.
• 31:17
  How important is that control where they want to have that it
• 31:20
  is, it is. It is very important, I think
• 31:23
  that they don't. They suddenly they don't want to
• 31:25
  relinquish financial institutions in general of at
• 31:30
  least of a of a medium sized to large size.
• 31:33
  They they say these are my customers when it comes to their
• 31:38
  to their service. These are my customers.
• 31:40
  These are my credentials. This is a direct relationship
• 31:42
  between between us. I have to be the master of of
• 31:46
  that relationship and they. Want to only in full
• 31:48
  authentication experience as much as they can anyway.
• 31:52
  Yes, there are, I mean there are, there are in in most cases
• 31:55
  that's the case. There are some regional cases,
• 31:58
  there are some initiatives and we have some some very
• 32:00
  interesting presentations that are there are some, some small
• 32:03
  polls. For example in the Nordics, in
• 32:05
  Northern Europe, there has been an initiative actually where
• 32:08
  banks came together. There is a consortium of
• 32:12
  entities that came together and created an entity to manage
• 32:15
  identities which is which is called Bank ID.
• 32:17
  The same concern that banks had with identity of the service,
• 32:23
  you know, 10-15 years ago was like, oh, I can't put my
• 32:27
  credentials up in the cloud. I need to have them on Prem and
• 32:32
  control them. You know, the thing that I think
• 32:35
  where you're getting with the argument of passkeys versus
• 32:39
  passwords is people can use their iCloud to sync their
• 32:46
  keychain, which is basically just the password.
• 32:49
  But your password could also end up in some kind of password file
• 32:54
  out on the the dark web, and it can be used by anybody but the.
• 33:00
  The passkey can't because it's cryptographically signed and
• 33:06
  it's not something that could end up in some kind of dark web
• 33:09
  dump pass keys. So that is a risk that you
• 33:12
  completely remove from the table.
• 33:14
  Because pass keys are based on a symmetric cryptography, the fact
• 33:20
  that they are based on a asymmetric cryptography.
• 33:23
  What it means is that what you are going to be storing on the
• 33:26
  server side, you need to have something on the server side.
• 33:29
  But it's not the entire key, it's just half of the key.
• 33:34
  So even if that would be if that server would be compromised and
• 33:38
  those keys would be stolen, that on itself doesn't allow to
• 33:41
  recover to recover all the. It doesn't break the security of
• 33:47
  of that of that credential. So that is one of the massive
• 33:51
  arguments why a a a bank or any service provider for that matter
• 33:57
  that today is using passwords for authentication.
• 34:00
  They may want to they may want to move away from them as soon
• 34:04
  as possible into this because the the the question about the
• 34:07
  data leaks it's I mean there is the finance the direct financial
• 34:11
  loss but there is the the branding the branding laws is is
• 34:16
  it's and it's a nightmare so so that on that on itself is is
• 34:20
  quite a motivation. So folks, for folks who are
• 34:23
  listening, it's 25 after three on Tuesday, you're going to be
• 34:28
  presenting in like 25 minutes. So, one hour, yeah.
• 34:32
  And one hour. OK.
• 34:33
  We really appreciate you talking through this with us, but we
• 34:37
  don't want to hold you back from that.
• 34:39
  You need a little bit of time to catch your breath, maybe have
• 34:42
  coffee or something. But thank you, Pedro.
• 34:45
  I mean, this is really educational.
• 34:48
  My pleasure anytime. Yeah, so let's end on a lighter
• 34:51
  note here so you can get off and go and prepare and and psych
• 34:54
  yourself up. We were talking before we hit
• 34:58
  the record button that you're a soccer dad, you've got a couple
• 35:02
  of sons. I think you said that are
• 35:04
  playing soccer. Then the then the conversation
• 35:06
  turned a little bit towards Messi, who has become a
• 35:09
  phenomenon. He's already been a phenomenon
• 35:10
  around the world, but. Unless you've been a die hard
• 35:14
  soccer player, you probably just kind of were maybe passing
• 35:17
  familiar. Now he's playing for Miami and
• 35:20
  Florida of your soccer dad duties.
• 35:26
  How do you see your sons and their journeys through the
• 35:31
  sport? Are we are we looking at maybe
• 35:34
  the next Messi somewhere in there or a different position?
• 35:36
  No, no, no. We're we're, I mean still too
• 35:39
  soon they will, they will do. They will do whatever they they
• 35:42
  want. But for us it's just a matter of
• 35:44
  keeping them healthy and and doing a team sport and and
• 35:48
  getting into that. But to me what it it the only
• 35:52
  thing is that now they playing soccer and then watching soccer
• 35:55
  and then playing soccer because you have the the equivalent of
• 35:58
  the NFL games. It's all soccer all the time.
• 36:02
  All it's intensive but it's true that we were by tradition in the
• 36:07
  family fans of Barcelona and now to and we had Messi.
• 36:13
  We had the lack of have this guy in in in our team.
• 36:16
  And to see the impact that now he's having in a country that
• 36:19
  doesn't have the tradition of it's.
• 36:22
  It's funny to see the the kind of craze that he's generating in
• 36:24
  a country, in a country that that traditionally didn't pay as
• 36:28
  much attention to to soccer and as as it was before.
• 36:32
  So does that give a sense of? Pride when you see that
• 36:35
  happening. Or is it a sense of loss because
• 36:38
  he used to play? No, no, I'm.
• 36:40
  I'm really happy for the guy because it's, you know, there
• 36:43
  are great sports guys that are that are just great at at what
• 36:49
  they do, but as a person, you don't.
• 36:51
  You don't. I mean, he doesn't, he doesn't.
• 36:54
  I mean they are too fond of themselves or they they don't
• 36:58
  and you don't You don't see them as a role, as a role model for
• 37:00
  example for your kids and this is a guy that has been it's he's
• 37:04
  great in what he does. He's exceptional about any kind
• 37:07
  of measure and he's a very humble very reasonable very
• 37:10
  nice. He doesn't has outbursts or
• 37:12
  anything like that and he he won the World Cup after have been
• 37:16
  chasing it for many years in the late stages of his career.
• 37:19
  And now to see him the kind of things he's doing, every time
• 37:22
  that he does something that is remarkable, we we just get a
• 37:25
  smile. No it's it's it's it's it's
• 37:29
  happy to see him to see to see him thrive and to see the kids
• 37:33
  obsessed with him as well. So the Barcelona?
• 37:35
  Fans, Are they Florida MLS fans at this point?
• 37:39
  Or Miami, I should say. Or you follow a player versus
• 37:43
  A-Team? No, no, I would say that people
• 37:46
  have sympathy for the for people from Barcelona have sympathy for
• 37:49
  Miami now because Messi is in there.
• 37:52
  And not only Messi mean, there were a couple of players, X bars
• 37:55
  of players that went along as well.
• 37:57
  So now now I it's a very rare thing to see because there was
• 38:01
  no interest whatsoever in Spain about MLS here.
• 38:05
  And then now you can have a conversation of what did Miami
• 38:09
  last week which was unheard of before.
• 38:12
  So it's amazing when a transcendent.
• 38:13
  Player can do that or anything. Can see that occasionally with
• 38:16
  maybe basketball player coming from some area of the world
• 38:19
  right into. One league or another or
• 38:22
  baseball was another one, which I know, Jim, you were just
• 38:24
  chomping at the bit to to get into that one.
• 38:26
  So I. Was in a conversation with
• 38:29
  Denise and one of her friends and she sent a picture of a guy
• 38:33
  that she's dating her her friend.
• 38:36
  And she said I was like, he looks like somebody famous.
• 38:39
  She's like, yeah, he looks like Victoria Beckham's husband.
• 38:46
  David Beckham? No, she.
• 38:48
  Said it right the the spice. Spice Girl, Right.
• 38:52
  She was a Spice Girl, yeah. Anyway, but he.
• 38:54
  Came over and played in the MLS for a while, but I think it was
• 38:59
  more of like, you know, it got some attention.
• 39:02
  But from what I understand now, Messi's over here.
• 39:05
  Just like dominating, right? Which that's kind of cool.
• 39:09
  I mean my Uber driver from the airport to the resort here.
• 39:15
  He's like, do you want to listen to something or watch something?
• 39:17
  I'm like, I don't care. And So what do you, what does he
• 39:21
  put on? He puts on like this highlight
• 39:23
  reel of messy, just scoring goals and winning championships
• 39:27
  and stuff. And it was probably still
• 39:28
  playing. After the 40, Yeah, he was.
• 39:31
  Still going he's. Probably watched it hundreds.
• 39:34
  Of times I guess. But yeah, I it's I used.
• 39:37
  To play soccer when I was a kid and it's interesting see how MLS
• 39:40
  has gotten. Progressively more popular over
• 39:44
  the years. I mean it's still very much not
• 39:47
  anywhere near you know NFLNBA, you know at hockey, baseball and
• 39:53
  then you've got sort of MLSI think it's kind of after that.
• 39:56
  But there was a just a genuine excitement when you, you know, a
• 40:00
  player of that caliber comes over.
• 40:03
  I was, I was concerned and he's OK.
• 40:06
  He's going to come over. He's towards the end of his
• 40:08
  career. What does that mean?
• 40:10
  He's not going to be able to produce whatever guy comes out,
• 40:13
  scores, goals left. I mean, he delivered right away
• 40:17
  and it was like this shot of adrenaline that went through
• 40:21
  MLS. It was the worst.
• 40:23
  Team in the MLS this season the guy arrived and he played six,
• 40:27
  seven matches and he won a title for them just to straight up it
• 40:31
  was. I mean, they were expecting him
• 40:33
  to make an impact, but they no one was expecting that he would
• 40:36
  do that. Right off the bat, as he arrived
• 40:38
  to them, it was, it was funny to.
• 40:40
  It was funny to watch. It was funny to watch.
• 40:42
  A real Cinderella, a Cinderella story.
• 40:44
  We're going to go ahead and wrap it up for this conversation.
• 40:47
  Thank you so much for taking the time.
• 40:48
  My pleasure. I think we'll be recording
• 40:51
  another episode when you're on stage, so we'll be simpatico
• 40:53
  with you thinking about that. But it was great to meet you,
• 40:57
  Great to have this conversation. I'll have some links in our show
• 41:01
  notes so that people connect with you on LinkedIn if they
• 41:03
  have any questions. So I have a link to the Telus
• 41:05
  group as well so people can find out more about what goes on over
• 41:09
  there. We'll have links to myself and
• 41:11
  Jim on LinkedIn as well. We're on the web.
• 41:13
  idacpodcast.com we're on Twitter slash X slash whatever it's
• 41:19
  called. By the time you listen to this
• 41:20
  at IDAC Podcast Mastodon at IDAC podcast at infosec dot exchange
• 41:26
  Like, subscribe, share with a friend, share with an enemy, I
• 41:30
  don't care. As long as people are listening,
• 41:31
  we'll keep doing this. Thanks to everyone for listening
• 41:34
  and we'll talk with everyone in the next one.