This is identity at the center. If it has anything to do with
IAM, this is the go to podcast now your hosts Jim McDonald and
Jeff Stedman. Welcome to the Identity at the
Center podcast. I'm Jeff and that's Jim.
Hey, Jim. Hey, Jeff, how are you?
Oh, not so bad yourself. Good.
I feel like my my voice is a little hoarse.
I just got done presenting a executive read out of IGA road
Map. And yeah, jump right over to do
the podcast because the show must go on.
You talked for almost an hour straight.
I think I clocked at 1.15 minutes without like a break at
all, so yeah. Yeah.
But there was, there were points where I was like, does anybody
have any questions? And of course nobody had any
questions. I was like, OK, I'll talk for
another 10 minutes straight. Yeah.
So when that happens, I just say, yeah, I'm picturing roaring
applause in my mind, and I just kind of go with that and just
assume that everybody's loving what I'm saying.
Yeah, I know. Like this podcast?
Yeah, exactly. Like you throw the podcast out
there and the only way you know if people are listening is if
they go and give you a five star rating or go and subscribe to
YouTube channel. Are these subliminal hints
working do you think? I hope so.
I mean, those are cool. Or come up to us in conferences
and things like that. That was Identiverse in New York
City last week. I think that was, I forget where
I am this week, but I had somebody come up and ask me
about that, which was kind of cool.
It seems like for whatever reason, you're like the
approachable one. Everyone comes up to you.
And I don't know, maybe I just have like, you know, resting B
face or something like that where nobody wants to come up.
Why is where my I was wearing my fancy suit jacket, So I think
people Los Angeles come up and say, whoa, that's a cool jacket.
Yeah, Hugh Hefner died and left you all his jackets, I feel
like. Yeah, exactly.
So we're starting some new things coming up here and before
we get to our episode, we're actually going to get into
blockchain identity and stuff like that.
But before that, something that's coming up later this week
that we're pretty excited to to share is we're starting a new
series of kind of podcast episodes calling them Sponsor
Spotlight for now. Basically they're fully
sponsored episodes that we've collaborated with different
folks on and the idea is to have a less vendor neutral
conversation. This podcast is generally we try
to be as better neutral as possible, right?
But sometimes we really want to get into like maybe a specific
product or service or something like that.
And this kind of I feel like gives us an opportunity.
So it's extra content doesn't replace our existing content.
Does that make sense, Jim? Yeah, yeah, it makes sense to
me. I mean, you know, honestly, I
was thinking during that entire episode, like this feels like a
normal episode. So I have a feeling the sponsor
spotlights aren't going to feel that much different.
I think our, you know, our listeners are the ones who
benefit because it's just extra content.
There was a little bit more of like you know, we we always
tried to stay very vendor neutral and we had, we had more
leeway on the sponsored episodes.
But actually I think that can be beneficial because if we're
talking to talking to somebody from a sponsoring company and
they can say like hey, this is how we solved that problem that
just, you know, I don't know, I don't get offended by that.
I think that's actually pretty interesting.
Yeah, I think it just, you know, like so we, we try to stay away
from questions that would be like too salesy or too like too
much of A commercial for folks. But these new episodes are not
that. So I feel like like I kind of
mentioned it in the one that we've already recorded like the
shackles are off. It's like, hey, let's ask
specific questions about this because that's the things that I
want to know. I think that's kind of the
intent is like, OK, how does this actually work, you know,
what does it take to do this sort of thing and get a little
more detail around that versus just trying to be maybe abstract
about it? I I kind of feel like the the
folks who want to do the The Spotlight series, they want to
be on the Identity at the Center podcast, right?
They like the formula of what we do, which is education and
entertaining. And so I think folks, you know,
our listeners, if you just go out there and listen to a
Spotlight episode and give us your feedback, like, do you like
it? What else would you like to see
that'll help us, right? We, I mean just like this
podcast in general. We started it and depended on
the feedback because that tells what we're doing right and what
was not so right. Yeah, we are constantly building
this car while we're driving down the street.
And yeah, I think it'd be cool to get some feedback.
So yeah, folks can check it out later this week.
Probably going to drop these on Wednesday, Wednesdays or
Thursdays, kind of kind of, you know, kind of off cycle from
things, but curious to see what people think, you know, get us
feedback, use LinkedIn. We've got the contact form on
our website. We've got a new voicemail button
that I've put on our website, idacpodcast.com.
So if you go to our contact page now, there's a little thing that
you can do to send us like a 92nd audio clip.
And then from that we'll use that on our show theoretically,
depending on how we get. But I'm curious if you know
people want to send something to us.
We can test it out and see how that works, but that'd be a good
way to maybe send some feedback. Now are you concerned at all?
Because I know we've always had to contact us link where
somebody could type something in.
And it feels like in the past month or two since we really
went crazy with getting all of our content up to YouTube, I'm
getting a bunch of contact information from people who want
to market our YouTube site and get us as many more subscribers.
And it's like it's not about the number, it's about getting the
information out there. So we have like 500 subscribers,
but it's people who really are loyal to the podcast wanting,
you know, there's the practitioners of the world as we
like to say, I don't care like, so there's marketing things are,
you know, 0 value to me, but I kind of look at them like spam.
Well, you're getting them because you didn't used to get
them before. They would all come to me and
I'd be like, Nope, Nope, Nope, Nope.
So I was acting as a filter, but no longer.
Now we both came at the same time.
Oh, thank you very much then, Yeah.
It's me. e-mail infrastructure changes behind the scenes so
that I wouldn't be a bottleneck so much.
But yeah, you're seeing a lot more of the the stuff that I
would normally just filter out and be like, yeah, I don't need
to help building our YouTube channel.
Like that's not what this is about.
You know what else has been cool?
I've seen a couple of posts where people are taking these
Spotify videos that have been put out.
So Ian Sing, you know, he's a, he's been a loyal listener to
the podcast for a long time. Apparently we're his number one
podcast. I mean, that's I I.
Love Ian. Thank you.
Thank you so much, Ian, But that is so sad.
Can anyone pick an identity podcast as their number one
podcast? Oh yeah.
Flattered. That's very cool.
I saw the same push you're talking about.
Is this the the Spotify unwrapped basically for like
podcasts? So that's.
Yeah, that's right. Yeah.
And I actually got a link sent to me from Spotify that, you
know, there are a lot of people where we're either their top
podcast or their top three podcast.
So I feel really good about that because again, we kind of
started this as like we were calling it pirate radio, where
it's like we get 25 downloads and know who those 25 were.
That was over four years ago, 4 1/2 years ago, something like
that. Now we're at episode. 200 and.
50X Is it 250 on the button? 250 on the dot.
Yep. We should have done something
special. Well, we did do something
special. We did do something special.
We're getting into a content that you and I, I think have had
interest in. I am a skeptic on this, so we're
going to get into it in a second.
The other thing that you mentioned about Spotify was I
started adding like polls and like questions to it.
So this is just something Spotify allows us to do.
Can't really do it on any other platforms.
So if you're not a Spotify user or listener of podcasts and it's
really kind of, you'll have to check it out there.
But people have started to answer questions, leave comments
and stuff like that. And Sean O posted a comment on
episode 245, which I think was, I think that was Dave Middleton,
where we're talking with him and he really loved to show you.
So it was awesome. Can't wait to check out more,
which is very cool, 'cause it's like, hey, we're, you know,
still reaching new people. Yeah, absolutely.
Yeah. And you know what I also think
is like, people who listen to podcasts or people who have been
our guests, like, wind up becoming our friends too.
Like, you see these folks in person, maybe for the first
time. You're just like, awesome.
You really can connect. You just mentioned Dave
Middleton. He was texting with me over the
weekend because all the College Football Playoff games are
happening and I'm a Georgia Bulldogs fan and it our weekend
didn't go so great, so. I I have no idea what happened
because I don't care. Oh, he sent his condolences to
me, so I thought that was cool. Well, he's a nice.
Guy, fortunately. Fortunately for him.
Singing voice too. And he does.
He does have a good singing voice.
Should we get into our main topic today?
I think it's time. He's been making Face at a Faces
at Us the whole time here on our recording studio.
We said we were going to do something.
Especially he's like, what I'm here.
Why don't we get into it? Because we really kind of.
I'm thinking about the title here.
It'll be kind of demystifying blockchain and identity.
Definitely not cryptocurrency. That's not where this is going
to go. But let me introduce you to the
show, Jay Shulman. He's a principal and lead for
the blockchain and digital assets practice at RSM US1 of
our colleagues. Welcome to the show, Jay.
I couldn't be more privileged of being Guest 250, so thank you
for for picking me for this for this occasion.
Yeah, high praise for sure. We appreciate you coming on
here. And I kind of let off the fact
that I feel like I'm a little bit of a skeptic.
Not a little bit. I am a skeptic of blockchain and
identity. We're going to talk about that.
But first time on the show we always like to find out about
background. We were kind of talking before
we hit the record button and say, OK, well, you know, how did
you get into the space of blockchain or identity or
security or what are you like, what?
What space are you like? How do you feel?
I'm old. I feel very, very old as I think
about that introduction. So 20 something years ago I
started focusing on information security.
I think like Dave Middleton said before it was even a thing my
parents asked me when I took my first infosec job is that that's
a full time job, which is amazing when you think about it.
Today, 10 years later, around 2010, I got into Identity and I,
before we hit the record button, you know what we were talking
about how that that happened. And I've always and the theme I
think you'll hear throughout this is I've always tried to go
where other people aren't. And it's really fascinating when
you think about where Identity was in 2010, 'cause you'd say,
well, Jay, that's that. It was a thing back then and it
was, it was amazing to hear about you.
You guys just presenting an IGAI, don't I don't we
definitely call it governance at that point, but I'm not sure IGA
had been a moniker yet. I think about sale point was was
just governance, Vexa was out there Tim and Tam you want to
think about what UCTA looked like in 2010 versus what it
looks like today. It is it's amazing to me while I
have have left the identity space momentarily probably it's
it's been amazing to watch what 10 years of innovation have done
in the space and and I'm certainly proud of what I did
back in 2010, 2011, 20/12/2013 but it it's it's just it's so
cool to look back on that and so so I went back.
I actually focused on another area of security application
security spent a ton of time there and I did a project back
in early 2017 at an incredibly old financial services company
that was implementing blockchain.
And I'll, I'll be honest, I was skeptical then too.
I was I I was not born and bred for this and we'll go into the
details of it. So I don't want to preface that
part. But I looked at the tech and
we'll talk about what the tech is and why I think it's
legitimate. But I I didn't think this was
going to become of anything. And doing that project at the
Super old financial services company really showed me that
there's value and that this was going to be a thing.
And you know, we all, we all work together.
Somebody at the company called me up and said, you know, is it,
is this really a thing? Is this what you want to do?
Think so. And they're like, all right,
you're in charge. And and here I am today and I,
I, I love it. But I also think that 10 years
from now will kind of laugh that there was a blockchain guy,
'cause I think you think back to 2000 and there's probably a
person in charge of the Internet, you know, oh, I run
our Internet practice. I just, you know, that doesn't
exist today. And I don't, I don't think
blockchain will be a thing in 10 years either.
But I'm super excited to kind of get into it because I bet you're
not the only skeptical person or people out there.
And so hopefully you can represent all the skeptics as we
go through it today. I'm.
Going to do my best and you say in charge of the Internet.
I immediately go to the IT crowd and Moss and Roy pulling out the
little black box for Jen like this.
Jen is the Internet and they're and she's carrying it around
with such reverence and things like that.
You know, I see, you know, maybe that's blockchain in the future.
I don't know, you know, for the, for the, for the real geeks.
So when I say I'm a skeptic, I feel like it's not because a
technology skeptic more of a, it seems like a really good
solution in search of a problem. And I've been hearing and seeing
about this for at least five years now.
I remember seeing you at a conference several years ago.
I was like, oh, that's interesting.
Yeah, OK. You know, five years later, one
of the questions that I had recently in our Spotify poll
was, have you set up a decentralized identity yet?
Nobody has. So I think it's maybe still in
that, you know, early adopter maybe stage of things, but maybe
we can get into that. But I don't want to lose people
right away. So let's talk a little bit about
blockchain itself. What is it?
Can you kind of help me understand the identity
components, especially of the blockchain?
Absolutely. And I'm for anybody who is
actually super deep in blockchain, listening to this,
this discussion is going to be hogwash to you.
I'm actually going to try to think about this from an
identity perspective. So somebody who is somewhere in
their identity career and how they might think about
blockchain and and it's kind of how I went and looked at it
maybe in 20/15/2016 and said I I thought this was some dude in
his basement who wrote all kinds of homegrown encryption code and
it was going to be, you know, a hot mess.
What I found was something really similar to way the
Internet works. It is really based on asymmetric
encryption, public and private key pairs.
And so when we think about the blockchain it really represents
well first it's immutable. I didn't in 2017 I I completely
asked. I'm not sure I knew what the
word immutable meant, so I looked it up.
ChatGPT didn't exist so I couldn't quickly ask that.
And it's a right ones technology and I think that is actually the
use case. How much time do we spend as
security professionals, as identity professionals, as
investigators, making sure that the data that we have hasn't
been changed? And so we have this technology
that you can only write once. How do you do that instead of
having a single repository? And I'll tell you, this is the
absolute worst database in the entire world, hands down.
It is slow. It is written to text files like
it's not even, it's not even a real database.
It is everything that you would hate about database technology
is how block chains work. But because it's slow is what
gives IT security and immutability and that's the way
it is built as a feature, not a bug.
And so we have this, this copy that's spread all around the
world. Bitcoin is the biggest block
chain. Again, we're not talking about
cryptocurrency here today, but just quick example is there's
11,000 nodes, 11,000 copies, full copies of the Bitcoin
blockchain spread all around the world.
So as we think about data and data integrity, we're not
talking about hot and cold backups and things like that.
We're talking about this idea that 10,000 people are keeping
copies of the same data that I have and we're comparing them to
each other and that is really valuable.
And so when we're talking about how the functions work, I, as
the user of the blockchain hold a private key.
There is a public key representation that sits on the
blockchain and kind of what's different and and we can go into
some analogies to other security things.
But I think what's different is it's not just recording that my
public key, it can actually record other other things about
me and certainly cryptocurrency that I hold.
Bitcoin as an example, could be one of those things.
But more importantly, any kind of metadata that you want, you
can go record to a blockchain, whether that's a log, whether
that's what my name is or that some event happened, I went and
climbed to Mount Everest and I reached the top and we're going
to, we're going to memorialize that on a blockchain.
There's a lot of really interesting use cases that I
think we'll dive into, but that's a pretty simple example
of it. It it is exactly if you've ever
worked in client side certificates.
I hold the client side certificate on my side of the
blockchain and the biggest difference here and I throughout
my career, public key infrastructure was always
something that clients inquired on is it doesn't it?
It's a pain to make PKI work at scale, and I think the user
interface in blockchain is horrible today, but there's so
many people developing really high quality user interfaces in
this perspective that I really think that will get to the point
where blockchain might be described as public key
infrastructure at scale. Does that make sense?
Yeah, that's pretty interesting. So you brought up this immutable
Ledger and to me that it's something I always hear about
the blockchain with the identity management conversation.
And you said there's a lot of good use cases and probably
there's some use cases that aren't so good.
But I I guess like I hear about this immutable Ledger as an I am
practitioner, like what does that mean to me?
Where where can I see that becoming A use case that
actually can wrap my arms around?
I think a lot of people, I mean some of the early examples I had
where they unplugged their database and plugged the
blockchain and then they're like Jay, it doesn't work.
I was like, no, that would be horrible to do.
And I've also heard the example of, well, gosh, I could take all
my log files and I could go write them to a blockchain.
Wouldn't that make sense? And I don't, I don't think so.
Again, let's think about it for a second.
This is incredibly slow. The sole purpose is immutability
when we think about all the data in the world.
I mean, I think the problem we have from a data perspective
today is so much of it is throwaway.
Where I think the use case is, let's narrow down to two things,
really important data. So I think about it from a
financial transaction perspective.
Do you care about all of the, you know, one and two dollar
transactions that you have in your bank account?
Not really. But do I care that I paid my
mortgage or that my pay my car payment or some of these really
important payments? Absolutely.
So take that to a corporate perspective and you can see
where they may have a million transactions, but they're only
writing like hundreds of the blockchain.
And I think that's my mindset. So we're thinking about
identity. We're not writing every login
and logout. We're not writing all these
things. Are we writing a password
change? Maybe.
Are we writing a privileged access, successful login?
That's that feels right to me. And there's some of these
markers that I think that do make sense in this space and and
that's that's how I think of it. I think one of the reasons that
we see a lot of failed projects and I I think we saw these in
identity too, is you're trying to do too much.
If we just got these things smaller and simpler, we find a
lot more success. Just wondering if, you know,
we've had folks on the show talk about decentralized identity and
self sovereign identity. And I think one of the biggest
actors in that where that use case makes sense is government
agencies where they can issue a credential.
And not just government agencies, but anywhere that
you're not kind of your typical corporate IDP environment where
you change passwords and things like that.
But let's take the digital driver's license for example.
Seems to me like the blockchain could play a valuable role in
that. What are your thoughts there?
I think there's a lot of interesting use cases like that,
but I also think that there's a role.
While governments is a great example, I think there's a role
for a corporation as well. So we we all, at least
personally, I I want to be done with Social Security numbers.
I actually want to be done with passwords too, if we're going to
go argue about that. But how do I, how do I actually
know who I am? Isn't a bank a great entity to
go validate who I am? They've already done a ton of
know Your customer elements. They know everything.
They would know far too much about me.
Can't they attest on the blockchain to who I am?
That allows, yes, governments to rely upon that too.
But wouldn't it be nice to have a whole suite of corporations to
rely on it? I think the different, yeah, you
could do this today. You know the question.
I'm sure the skeptics would say I could do that in a database.
Like, that's nothing new here. I think it's the transparency
that a blockchain gives that allows you to see a whole lot of
what's going on. That gives you the comfort that
when your bank goes and attest to these things that it's
something that I can rely upon and that that I think you have
trouble doing that with the database.
So when you say the blockchain, is that a lowercase the OR an
uppercase the? Because this is one of the areas
where I'm not sure how this is supposed to work, because you
mentioned that, you know, banks had it.
What about population of people who are unbanked?
You know, we say, well, the government blockchain, OK, well,
at least in the US, 50% of the population immediately is going
to not want to use that regardless of whoever's in
charge, right? That kind of thing.
So the blockchain means, who's blockchain?
Is it? Multiple blockchains?
Is it really one blockchain to kind of rule them all?
How do you see this working? I think there are multiple block
chains. I think there are going to be
multiple public block chains. So block chains that you don't
need permissions to access. You can everybody can just go in
and use them at will and they'll be multiple private block
chains. So a group of companies get
together to collaborate around some particular idea and the
only way that you can write to that block chain is with
specific access permissions. So it's definitely a lower case.
T and I you know it, I think I compare this to the Internet a
lot because I think we see the same type of disruptive
technology coming to fruition. And if we go back to when I
started my career way, way back, I didn't you, you can't see that
I don't have any hair, but if you look me up, I don't have any
hair. I didn't have any hair back then
either. A lot of of websites failed,
right, that they got billion dollar valuations and they
crashed and burned. So are there going to be block
chains that grow huge and crash and burn?
Absolutely. Are there going to be ideas that
start off looking really successful and fail?
Absolutely. But there's also going to be
ideas that kind of chug along for a while and then you realize
that they work really well and they will become the next, you
know, whatever brand name Internet company we want to
quote right now. So what happens when a block
chain fails? If I've been using that as my
decentralized identity source or my, you know, way to verify some
sort of credential or something like that, right?
If it fails, well, now what? The data's gone with it?
How do I can I save it? Do I have to start over on a
different blockchain? So you probably need to start
over on a different blockchain. That I mean and this is super
complicated technical question, but that is one of the big
considerations of building on top of these platforms is what
what's the long term probability.
And so you do see some centralization around a number
of very big platforms because of that exact purpose.
But I I think that's a short term, a short term thing that
over time we will see that becoming less of a concern
because we can just we know which ones are going to be
successful and which ones are not.
I'd argue it's the exact same thing when you go pick an
identity tool or a governance tool or or any of these tools is
well what happens if they go out of business.
I got to go rip it out and put something new in.
And so I I don't think that the issue is that much different.
It's probably a lot more impactful though to your end
user, whereas you have a a tough weekend of transitioning from
one platform to another is a little different than ripping
out, you know, your your decentralized identity.
I guess the closest thing that I can probably liken this to would
be like switching password managers, except without maybe
the benefit of being able to export and then import, right?
Trying to go to each website and then figure out whatever
credential I had, I don't know. I mean, I think I'm speculating
here what happens, I guess. Is this something where
organizations should be creating their own blockchain?
Like if I want to start one, how would I do that?
Or maybe this isn't something like a normal organization
should be. Maybe it's like you said,
something's either finance related or maybe civic or
government or maybe education. Like do you see, like any
company, just name one starting their own blockchain for their
own. Purposes.
A lot of companies have started their own blockchain for their
own purposes I think, and I can answer the question a little bit
differently, whether we're talking about companies or
whether we're talking about individuals, I think everybody
should be experimenting and understanding how this
technology works. I don't think you should run out
and go implement this and and be a decentralized identity guru
tomorrow. I think that would be a a
horrible mistake. But I do think that it's really
important to understand how a blockchain works, how it might
be applicable in the identity space and and play with it.
And you can play with it in a public way and I can give some
examples of how to do that. Or you can spin one up in a
private way too. And all the major cloud
providers have a pretty easy template to go spin up a
blockchain. Not to say that that's
inexpensive for a personal person to do it, but there's a
lot of ways to easily play with this stuff and I think that that
is the most important thing. That's what's going to prevent
you from making the big long term mistakes and you just
become educated on it and you'll start to see the use cases
yourself. I'm pretty confident in that.
So what? How do I get started with this?
I guess what are the building blocks here associated with if I
do want to experiment? You mentioned templates, but can
you talk a little bit about like what's what does it mean to set
up a blockchain? So I think the the 1st place I
would go to really quickly understand how this works,
Ethereum is what is the second largest blockchain to to Bitcoin
and Ethereum is much more like a decentralized cloud computing
platform than anything else. And so you can run little
programs on there and it's quite powerful.
They have something called login with Ethereum and that is the
answer to password less logins or decentralized identity.
There's probably a bunch of different ways that we could
describe it and none of them would do it justice.
The idea there is again, if we go back to that basic definition
I started off with, I hold the private key, the public key key
is on the blockchain. I can go log into a website,
present my private key and public key pair.
Obviously I'm not giving my private key away.
Just for those who think I misspoke and and go log into a
website, there is a full documentation suite.
It's obviously all open source code.
You can really look at not only how to do it yourself, but how a
bunch of companies are using that technology and then you're
off to the races. You can go implement that not,
you know, full production corporate world, but you can go
implement that in a dev environment pretty easily
yourself on a private blockchain.
You can go experiment with your own website and having people
log in that way on your own website.
There's a whole lot of different things and I think that's the
best place to get started and thinking about it and that I I
think that's it's really well documented and there's a great
community behind it if you have technical questions and things
like that, to go try to figure this stuff out.
All right, I've got a couple questions here.
The 1st is, I guess you mentioned Etherium is and then
you've got blockchain. And I know there's a whole bunch
of other things out there and I don't want to equivocate this
with like cryptocurrency, right? But there's like Dogecoin and a
whole bunch of other things. Is there a benefit or drawback
to some of these blockchain styles?
I guess I don't know if that's the right word or not for
identity, like is yeah, if you're going to do something
identity like a theory miss the one to use, or if you're going
to do identity, you know whatever other template or style
is the one that's probably the best fit.
Or are there different styles of blockchains that that maybe lend
itself better to different types of identity use cases?
I'm going to try not to get too complicated or technical here
with the answer, but Ethereum has been copied a ton of times.
And so that mini decentralized computer is actually called the
Ethereum Virtual Machine or it's abbreviated a lot EVM.
And so a lot of block chains are built on top of EVM Etherium
virtual machine, which means they're actually all completely
compatible with each other. So if you build login with
Etherium, you can actually reuse a lot of that technology to log
into or to use that to use a different blockchain because
they are EVM compatible. There's probably a lot I could
go into and get more detail there, but wait, let's let's
leave it at that. So by building on top of that
style blockchain, it really allows you to extend the
possibilities. Absolutely, each block chain is
going to be different. And I think over time, what
we're going to find is block chains will have maybe not a
singular purpose, but a really small number of purposes.
And so, do I think there's going to be an identity block chain in
the future? Absolutely.
Do I know which one it's going to be today?
So that you guys could all run out and figure that out.
They don't. And I anybody who says that they
do, I mean there's some theories on which one's going to be the
the media or video and music and things like that are stored.
I'm not sure which one is going to be for that either.
So it's it's again, I think you're yeah, you put it
correctly. We're still in the early adopter
phase and we have to kind of figure this stuff out.
Who benefits from controlling the blockchain?
So if I am setting up AI, don't know if I'm one of these
companies, maybe that specializes in blockchain and I
decide, hey I'm going to create this thing that does X, what
benefit is to me to own? I don't think you can really own
the blockchain, but maybe there is some component of it.
But who benefits from being the owner of a blockchain?
The end user, and I think that is the hard part for a lot of
different stakeholders to, to get their head around.
So today we have a lot of centralized data and we have a
lot of security breaches and we have, you know, a whole bunch of
issues all around that. And the whole idea of
implementing A blockchain is, is changing the paradigm away from
the centralized data store and pushing it out to where each
individual owner owns their data.
As I say this, for those of you who have spent time in PKI,
you're going to say that's great Jay, but but the end user is
going to go lose their private key and then all their data is
lost to. And I think that that is in fact
where we need to get to. That's the gap of where we sit
today. And what the feature looks like
is not only the user interface and the tooling to make it work,
but it's the IT. It's kind of understanding that
process and making sure that the user is bought into it.
I'm there's absolutely an argument that most users don't
want to own their own data. I think it.
I'm not sure that that I fully believe that.
I think given the choice, a lot of users would own that data if
they had the right tools to hold on to it.
And I, you know, I think about my less than technical mom.
No offense, Mom. If you're listening to the
podcast today, you know you have to you have to include them in
the the, the use case here. And I think that's that's where
it gets hard, right? Mom needs to be able to to own
their own data too. The end user's the benefit, I
get that part of it, But what's in it for me as a entrepreneur
in the space? How do I make money off this?
Running a blockchain? Or is this a loss leader of some
sort? Or is that really not a viable,
I guess, strategy to build a business of creating blockchains
and rely more on public funding or or something like that?
I don't want to get too deep there.
There's a whole lot of different theories on the economics of it.
I think most importantly, you need to have sound economics
behind it. But there's a lot.
You know that there's the old expression, If you're not paying
for the product, you are the product.
And that that's the paradigm that blockchain changes, which
means it also changes the monetization model.
And there's a lot of different companies trying a lot of
different monetization models here.
Again, early adoption phase, I don't know exactly how this is
going to work. The one that strikes me that's
really interesting from that identity and the identity
proofing model is if my bank is going to proof me and write that
to a blockchain then I'm probably going to pay my bank to
do that. And there are.
Then you can start to see where there's a whole lot of new
services that pop up. Today when I go to on board with
with a company they're paying the fee to proof me versus me
paying the bank to proof me and then being able to use that all
all over the place. That's the paradigm changing
that I'm talking about and and yeah, that's that's I'm used to
getting something for free that I now have to pay for.
So I could see where that end user's like, wait, why, why do I
want to pay for this? But I also think that they'll
see a ton less friction if I only have to do that once and I
can reuse that proofing all over the place versus having to go
reproof every single time. If potentially your next
question is, well, why would a company want to do that?
Less less expenses of having to do proofing.
And from what I've seen for the past 1520 years, friction is
still a huge factor in onboarding a new user.
We got to keep that friction down.
And if I can rely on somebody else's proofing to to to reduce
my friction, that's going to get more customers on my platform
where I can then interact with them and and solve them or
whatever the platform does. Yeah.
I've mostly been listening here and learning a lot.
And it's interesting when I think Jeff was talking about,
well, how would I get started, I was expecting you to maybe say
hey go out and check out some of these services that Microsoft is
starting to create like around the web 3 point O around
Microsoft intra verified IDJ. I'm totally talking way out of
my element here. Can you even, you know, based on
what I just said there, can you give us kind of a high level
explanation of what those pieces are and whether or not that's
something that people could get into to start, you know, using
blockchain to build applications, maybe those are
identity applications. I think that it's this is, this
is that paradigm change is. I'm not going to go to the big
cloud providers and go sign up for a service.
I absolutely can go spin up a blockchain over there.
But if I'm going to go build, I'm probably going to build on
something that already exists and almost everything in the
space is open source. And and I want to remind you, if
we go back to 1997 or 2000, a lot of the Internet was open
source too. And that's that's where I find
these similarities. And So what would I have
recommended in 1997? Go learn HTML, go set up a
website and go play with this and try to see what you're going
to do and you're going to build on top of open source.
That's kind of the same thing I'd recommend somebody today.
Logging log in with Ethereum is a great example of an open
source construct that there's many possibilities that you'll
see when you get in there. And that's actually a a great
place to start, even if your goal isn't identity because
you'll see all the interconnections and you'll be
able to find whatever it is that you ultimately want to build.
But it this is bringing us back to our open source roots and I
think that's hard to believe sometimes when you see a lot of
commercial enterprises deep in this space.
But the reality is, is that that it it's open source at it's at
its core. Jay, you mentioned you were old.
Thanks, thanks for reminding me. Reminding you of that, no.
But I've heard you speak several times, and when you talk about
blockchain identity, you bring up PGP, which is like a thing of
the past, right? Why is that even relevant to
this subject? And what is PGP?
Pretty good privacy Back in in 2000, when I wanted to go send
an encrypted e-mail to somebody, I would encrypt the e-mail with
PGP and send it, you know, with my private key.
And they'd use my public key to decrypt it, much like we do in
blockchain. If that sounds familiar, Amongst
many other things for that matter.
And it was clunky and painful. It worked, man.
It worked really well. But part of the problem was
always, how do I know it's really J on the other side of
this message? And so there was the PGP key
server. And it's amazing to me that that
2324 years ago that was still housed at MIT and it is still
housed today. And I bet you can find, you
know, my, my 2324 year old public key sitting on that
server. But there's also something part
of that that was the web of trust and that was the idea that
three of us are on a podcast together.
And I'm like, guys, this is really my public key.
And you vouch for me and say, Yep, I've met Jay in person.
This is really Jay's public key. I'm going to to to cosign the
key so that you can see that that it's real.
And obviously the more people that validate that you're real,
the higher up your trust level goes.
And and I look at that and I mean brilliant in its time and
kind of left behind as a lot of the capabilities around
encryption and SSL and and a whole bunch of other things, you
know, SAML and all these things come to fruition that allow us
to do that process a lot easier. But honestly, you know what's
old is new. Again, I feel like there are
people building on top of that philosophy using a blockchain.
And I think that it's important to think about some of these
failed experiments from the late 90s and early 2000s and revisit
them in light of new technology and that, you know, that's going
to be true of AI and a whole bunch of other new things that
are coming out as well. But it goes to show you back to
the the first comment you had Jeff is this a solution looking
for a problem? It it takes time for these to
develop and I'm confident that when we look back over time,
blockchain's one of those things that holds up.
And it'll be interesting to see what very dated old balding
technology actually reappears now in the age of blockchain and
AI and a bunch of other new technologies.
I kind of feel like what we generally do with new technology
and identity is try to map it to a real world use case where we
we don't have technology, we have driver's licenses and we go
to the liquor store and that person just wants to see that
we're of age to buy their product etcetera.
So you have like this issuer and relying party and so we tie that
concept back to this. Now thinking about that I'm the
OR the Internet practice manager, you know I I run the
Internet consulting practice. And I think if you're in that
role you would have said and by the way the Internet does not
have a construct for identity for how you identify yourself.
And that's kind of one of the core problems that we've been
trying to to solve forever. And I don't know that there is a
parallel, you know, real world use case that maps to how you do
it on the Internet. So you're talking about this web
of trust in the PGP world where other people wind up attesting
to you. I think the parallel is that's
the block chains that attest to you.
I think that's a pretty fascinating concept.
That's probably why it's hard for people to wrap their brain
around this kind of approach, do you think?
I not only do I think, I think your example really resonates
with me because we we added passwords and we said, gosh,
that's the end game, right? Passwords work.
We've secured everything. And then it turned out passwords
aren't that great. And we said, OK, two factor.
And we've tried a whole bunch of different kinds of two factor,
right. UB keys again, really, really
secure but pretty clunky. Text messaging, really easy but
not necessarily that secure. And again, at each one of those
steps we kind of say, hey, we solved the problem and we we
kind of stay that way until something else better comes
along. And I think that that is in fact
the best analogy where a lot of these things we think are solved
when in fact something better is being built and developed that
will at some point realize, you know this is better than a
password. You know, this is better than
than two factor and we kind of move on.
I mean I I think about 2005 doing Access reviews and man
like I have there are definitely some companies out there that
thought they had nailed Access reviews and they had the
fanciest Excel spreadsheets and man they were on top of their
game and then the sale points and of Access come around and
it's like whoa this this we could do this a whole lot
better. And then you look at where we
are today and there's a lot more automation underneath it to make
these things work better and it and and I think that's that's
the piece we don't know it's coming or we don't think it'll
work because of our pre-existing thought process.
But when it actually comes time to to use it it's better and
that that's hard. And I don't think that's unique
to blockchain. It's certainly not unique to
identity, and I honestly think not to make, you know, go on an
AI rant, but I think I think we're going to have a really
hard time with AI for that exact reason.
Oh, you're going to tell me that AI can do an access review?
No way. And somebody's going to
implement AI on top of a governance platform in a really
unique way and they're going to kill it, man.
And I think that's hard to see as it's coming.
But once it gets here, you you kind of see the whole
perspective. So, given all that, PGP Pretty
Good Privacy Pretty Good kind of hints at the idea that it's not
perfect. Jay is PGP pretty good.
That's pretty good. That's the big moment with the
podcast for today. There's our teaser, the shortest
teaser ever. Jay, I want to ask you about
some of the applications of blockchain in the identity
management space. Is there I guess, Is there a
blockchain tool for identity? Is there a tool built on it
already today? Are there other features maybe
like ldapse or graph databases or things like that where there
are parallels that exist? So all the the graphs and and
other repositories are going to be built on top of blockchain.
Again, horribly, horribly slow on purpose.
And so that is one of the, gosh, why am I doing it this way if
I'm so I'm going to go pull all the data off the blockchain and
go put it into a graph to go access it better.
But again the immutability is, is the reason that you're doing
it. So login with theorem is is
probably the the, the beginning stages of a full identity suite.
But again, I don't look at this as let's go log into a website.
I don't I don't think that's the use case here.
I think and and let's weave in AI because I'm usually the guy
that can drop 100 type buzzwords in a a 45 minute podcast.
How do I know that. And I was my daughter and I had
a fun time listening to AI generated music.
And is this is this the real artist or is this the AI artist?
And it it was a good time. We had a a good time doing it.
But there's a lesson here in not do I want to know whether this
is real or not. But creating AI music is in fact
a skill set that I want to get credit for that.
So how do we identify the AI artist, whether that's music or
video or a picture? And so we're going to be
entering an area where identity is going to look a little bit
different and it isn't going to be the common username and
password, e-mail address and things like that.
Where blockchain identity may not actually replace LDAP, it
may not replace all of the O auth and all the different types
of of identity we do today. It may actually fill a new niche
of being able to identify some of these non traditional types
of users or or entities right? Authenticating a bot in a a
unique and definitive way so that there's again kind of a new
world of the Internet that we're going to face and I think that
the blockchain identity is in fact concentric circles versus
replacing some of the existing technology that's out there.
Sounds to me like time is a flat circle for all your True
Detective fans out there. So one of the things that I
think vendors in, well, really any space but the identity space
like to attach their products to whatever Wave is cool at the
moment, right? We saw a whole bunch of zero
trust marketing over the last few years.
When vendors come along and say, oh, we're a blocked, we have a
blockchain product, what do you think they're really trying to
get to? And I know this is probably a
little more speculative, but I feel like there's a lot of
marketing speak out there to say, oh, you know, we have the
best zero trust XYZ, we have the best blockchain XYZ.
Like what do you think vendors are thinking about in the
technology space around this? I mean I I This is why, why it
is so important for for people to go play with the talk and
understand it in a controlled research, research oriented
mindset. Because when the vendor shows up
in the room and says now with blockchain inside, you know,
with a little stick around the box, you want to be able to ask
the the really thoughtful questions that get to how are
you using it, why are you using it, what are you actually doing?
And so I I can't speculate and I'm sure there's going to be 100
different answers to those questions across the the vendor
ecosystem. But if you're not armed with
that first layer, I've touched it, I kind of understand enough
to ask the good questions. You are kind of left in the dark
with with marketing speak and I think we saw in 20/17/2018 a ton
of the built with blockchain I think that's gone away a little
bit and we're we're seeing a lot more thoughtful inclusion of
blockchain and vendor products. And so I I don't, I don't want
to say that everything's perfect, but we're getting to a
better place where it's a lot more thoughtful than it has been
in the past. And I think that's just part of
any. I'm sure we saw the same thing
with zero trust, right. Everybody puts it on the the
cover and now we're probably to a better place where it's used
more judiciously. Yeah, it was at RSAI, don't
know, a couple years ago and I I came back, my report was you
know to the to the podcast crowd, good news, zero trust has
been solved. Every product now has a part of
their you know, solution setter features.
So everything's good now. You mentioned, I thought it was
kind of interesting what you're you're talking about I guess
with your daughter trying to figure out AI music versus
regular music, right. What was the kind of the artist?
It's it's clear obviously generative AI is kind of taking
over. It's having a moment right now.
And I think there's a lot of people who talk about ownership
and rights and things like that and being able to verify that,
you know this is authentic. Certainly I can see the benefits
of having something like an immutable Ledger out there that
kind of tracks this. But then I also hear things like
NFTS, which get a bad rap as well, right?
I'm, I'm selling a picture of, I don't know, board a parade or
whatever that whatever those are right for 10s of thousands of
dollars or even millions of dollars.
And I guess how do we balance the two to make sure that we're
really not getting too crazy with how we're trying to
leverage this? Yeah.
And I'm, I'm going to come at it from the other side because I
think if we assume everything is fake, then I want to know what
is real. And that leads me to how do I
know that that what I'm looking at came behind the lens of the
camera. And yes, I think we need to
authenticate all the AI generated content.
Me personally, I'm not terribly excited about reading a book
that was completely generated by a computer.
I think there's some value in in human being having written a
book. And so I think at some point
you're actually going to authenticate that this is a
human generated what percentage of this book was generated by
the author, human being. But but let's take that picture
for a second and there's if this were a video, this, this will
encourage you guys to do more video podcasts.
There is a picture of Jared Leto at the mat dressed up in this.
I think it was a Bunny costume. And when you look at the
picture, it actually looks AI generated, it looks fake.
It it turns out it's real. It's a real photo.
And so having that authentication that this came
off of a Canon or a Nikon or a like a camera is going to be
hugely beneficial. There's actually a standard that
a lot of the camera manufacturers and others have
created, C2 PA if you want to go Google for that.
That is a really interesting standard.
That by the way, anchors itself to a blockchain.
I've been, I found it fascinating to look at kind of
how how that standard gets implemented.
And there's a camera from Sony, a camera from like, I think
there's a a camera coming out from Panasonic.
And like if we compare the styled app, everybody's
implemented the standard. It's a little bit differently.
So it will be interesting to see, you know, what this looks
like in a few years. But again you can see the
identity of the the camera person, the identity of the
camera, the identity that that they were standing in this place
and actually hit the the shutter button and took that picture is
going to be valuable. And I think the genesis is that
that photographer will likely get a higher fee for that piece
of artwork because it was it was real versus completely AI
generated. I pay a buck for an AI generated
sunset. I yeah, I'm just throwing out
fun fun numbers. I paid $10.00 for a real sunset
taken by a photographer. Interesting conversation, but I
also think that over time, the nature of art is going to
change. I mean, I look at things people
create in Photoshop or, you know, it's some of the computer
generated video. I'm just blown away.
That's real art. There was some human behind the
scenes, but of course there's a lot of technology brought to
bear as well. I can see, you know, potentially
in the future people don't just deal with paint brushes and
canvas, but actually they use some kind of like virtual
painting and you know, it probably feathers out the paint
and things like that. That doesn't mean that it wasn't
human created art, just that. Not that doesn't counter
anything that you just said, but it just it got me thinking that
I think the nature of what we consider human generated will
change over time. Let me add on something to that.
Where is a good example of that paradigm shift I was talking
about what if Photoshop was free and the art that you created
with it, they got a cut of that art.
That's really hard to do today. There's no way to do it right
Try. It's it's just trust like that
that you're going to give them 10% of of whatever art you
create. If we anchor these pictures to a
blockchain and Photoshop has an identity and I have an identity
and when I sell that photo that that there's some automation
behind it that gives Photoshop their 10% cut and I get 90% cut.
Now, now that's a that's a completely different dynamic and
I think that's what is exciting to me about blockchain
technology is that's really hard to implement today.
For Adobe would never enter that market where they're giving away
this product in the hopes of getting some artistic return.
But if we can, if we can actually put some some contracts
on a blockchain that enables that, that's really interesting
and that's really exciting. And that Jeff going back to what
are the economics that make it work.
That's why it's hard to predict you know what the right
economics of running a blockchain is.
But you could see that that's a good example of an interesting
model that some upstart AI image company might choose.
We'll just take a cut. I feel like my head is spinning
a little bit because we went into this with trying to
demystify this. I think we've done a good job
with that. But I think there's still so
many questions that it's just kind of like, how's this going
to work, right? Where is this thing going?
If you had to put on your prognosticator cap on what do
you think blockchain looks like as like a market and sort of
like an industry and two years from now?
So first I think I need to come back on episode 300 to to do a
follow up to. The time zone just.
Throw that, just throw that out there.
Right now I I think we actually talk less and less about
blockchain. I think it becomes this boring
thing at the bottom of the tech stack that enables some stuff
that we kind of just forget about.
I I actually think the blockchain will be most
successful when we don't think about it.
How often do we have really deep conversations about L DAP?
We don't. It's just there.
It kind of works and we take it for granted.
And is that going to be in two years time?
I think we'll start to be on the road.
I definitely think that the retail user probably doesn't
think about blockchain very much, even when whatever product
they're using actually uses a blockchain.
Now, does that mean IT people and identity people?
Yeah, well, obviously still be in the middle of all of it, but
I would hope that that this is not a front and center thing.
I do not think the sticker on top of the box that says now
with blockchain inside is actually going to be that
exciting. It's really the ultimate use
case of being able to get a product for free and they just
take a cut of whatever I developed with it, that's that
is going to be the front and center value.
That you may ask, hey, how how did they do this thing?
But the reality is, is we're just not, we're not going to
spend a lot of time talking about it.
Well, we're hitting here an hour, and I want to wrap up the
conversation with a little bit of a lighter note.
You mentioned one experiment that you were running with your
daughter around the AI music. We were talking before we hit
record about another one that you were working on regarding
eggs and coffee. You want to care to explain
yourself, Jay? So I got I got three daughters
just in case anybody's confused at home as to what's going on
here. My oldest daughter and I share a
lot of music and so we're we're listening to that.
The middle daughter is working on a an interesting science
experiment. I hadn't thought about this
before. We are taking eggs and dying
them with coffee. I I will pause for a second and
say, gosh, why did she pick coffee?
She has this strange feeling that she's going to get to drink
coffee during this experiment. So that that's how how she
picked coffee and we're testing a cold cup of coffee, a room
temperature cup of coffee and a hot cup of coffee to see which
one is going to die the darkest. And that is what's yeah,
everybody asks me so what's on tap this weekend?
That is what is on tap this weekend.
So that's coming up. We're going to have to look for
an update to see, do you have any theories or posits that you
want to put out there and say we think that this might hold true?
I mean, I I'll be honest. I asked ChatGPT what what the AI
bought to the world thought and I learned all about the pores of
an eggshell and when eggs are or sorry, when the temperature of
the liquid is hot it opens up the pores and allows more dye to
come in. I'm I'm actually I so I I'm
pretty sure the cold coffee is not it's it's probably going to
be pretty light. I'm really curious where
lukewarm falls in the spectrum so I'm I'm still going to be
surprised here. But it it I'm really curious why
no egg dying company at Easter recommends warm or or dare I say
hot die for their eggs and that it it may be that there's some
real world applications of our little science experiment and I
can report back exactly how we should be dying eggs in the
springtime. OK, So what I'm going to do is
what we typically do is put out like a little teaser.
And so when I tag you on LinkedIn on Monday when this
comes out, I'll be looking for an update to say, so which one
was it? Was it hot coffee that got the
pores open, which, hey, logical makes sense, right?
That's how humans work, I guess. What is the temperature that
allows the pores to open enough, right?
Maybe there is a big difference in cold and lukewarm, maybe not
so much difference between lukewarm and hot.
I don't know. I'm not an an agologist or
whatever. I will put my risk management
hat on for a second. And for those of you who are at
home who might have a young child who's going to stick their
hands in boiling hot water, probably not the best idea.
And so I highly recommend you check the temperature of your
your dyes before choosing to die an egg.
That's that's my disclaimer of the day.
That's Identity Center for you. Safety first at all times.
Jim, have you ever done anything like that with your kids with
like any sort of like scientific experiments or anything like
that? I don't have kids, so it'll be
difficult for me to do that. I'm sure I have, but I, you
know, it's been a long day and I actually don't remember what
they were. But you know, I spend a lot of
time with my kids, like trying to fix things.
And you know, I'm not the most handy person in the world.
My, my father was like, he'd get out under the car and replace
the brakes and do all these like, crazy things.
And then I became an adult, got into computers.
And now I I can't even, I can't change brakes on a car.
But my son is now 19 and he got a motorcycle.
He's like taking it apart and fixing.
And I'm like, I guess that Gene kind of skipped me, 'cause he
seems to have it. I don't know where that came
from, but not a lot of science experiments.
OK. Well, other than this podcast,
this we'll call that this is our experiment.
See how this? Goes what are you doing on the
side, Jeff? Are you doing science
experiments? I'm always tinkering.
I wouldn't say I would say computer science experiments.
How about that? You know what's a better way to
use, you know, this tool or that tool?
How do we make the podcast better or things like that?
I'm always. I'm always tweaking stuff behind
the scenes. Yeah, no.
And you do a, you do a great job with that.
Well, thanks for that. I think that's a good spot.
I always like hearing compliments and that's how we'll
close the show out today. So Jay, thank you so much for
taking the time with us. I know you're a busy guy, but we
definitely want to have you come back on and be looking for an
update on the the egg experiments on on Monday when
this goes live. And hopefully we'll see you
there. We'll have a link in our show
notes for people to connect with you if they have questions about
this or if they want to tell you you're wrong or you're right or
what maybe people are seeing in the market, etcetera.
Obviously, please be respectful that we'll go ahead and leave it
for this week. We're on the web,
idacpodcast.com. Try our new voicemail feature
you might get on the show if it's something we think we can
use. For that.
We're on Twitter at IDAC Podcast, Mastodon, Hey
Decentralized, at IDAC Podcast, at Infosec, dot Exchange.
And of course, Jim and I are always looking for feedback on
LinkedIn, especially for these new sponsor Spotlight episodes
that were going to come out later this week.
So let us know what you think, what works, what doesn't work.
We want to hear it all because the goal here is to put out
something that we think is worth our time and your time to listen
to it. So with that, thanks everybody
for listening and we'll talk with everyone in the next one.
You've been listening to Identity at the Center.
We hope you've enjoyed the show. Make sure to like, rate and
review and we'll be back soon. But in the meantime, hit the
website at identity@thecenter.com and find
us on Twitter at IDAC Podcast. See you next time on Identity at
the Center.