This is identity at the center. If it has anything to do with
IAM, this is the go to podcast now your hosts Jim McDonald and
Jeff Stedman. Welcome to the Identity at the
Center podcast. I'm Jeff and that's Jim.
Hey, Jim. Hey, Jeff.
How are you? Not so bad yourself doing great.
So I put a post on the ID Pro Slack channel the other day and
asked, you know, who are people that folks would like to hear
come on to the show as guests. And I got a response from Trigva
Holland Hobland and he mentioned somebody from Microsoft and I
asked him if he saw the episode with or heard the episode with
Pam Dingle and he hadn't. I went out and listened to it
and said oh that's fantastic. Hit a follow up question.
So I'm gonna bounce this off you.
Do we have transcripts of the episodes that people can go and
and search? We do not.
Not yet. I'm trying to figure out how to
get it done, but one, it's expensive to do 2 It takes a
long time to figure out. There's automated services, but
you're kind of left to. You still have to like read them
to see if they make sense and. I don't know.
I think ultimately, yeah, I'll try to figure something out.
But today we do not trying to think actually the Spotify app
does. So if you're a Spotify listener,
you can go into the Spotify app and I believe there are
transcripts there. It does it automatically.
I don't have any control over it.
So I, you know, I will say that is all on Spotify, whatever.
Our words get translated into what shows up in there, but.
Not today, but it's something I'm trying to figure out how to
do. That doesn't just take an
inordinate amount of time. Yeah, I mean, you hit the the
nail on the head there with it's expensive.
One thing we didn't, I didn't realize, and I'm assuming you
didn't realize when we started doing this thing four years ago
is how expensive it is from a podcast.
So one of the things you you went out and got us was software
so that we could take all the episodes and put them up to
YouTube. You know, it's not like a full
video, but there is some visual, you know, sound bar thing kind
of thing happening. Waveform I guess is what it's
called and we've already got 150 subscribers to the YouTube
channel. But I would just ask everybody
to to go out there and you know hit subscribe that's going to
help grow the channel. It's it's funny when I go into
Apple podcast and I type identity, it's like our podcast
comes up right away but you almost have to type out identity
at the Center for it to show up in YouTube so.
Well, identity's such a fake term, right?
It's we know what it means in our context, but it means
different things in different contexts.
So yeah, I also just wanted to mention the the website which
you created. I I know you put a lot of time
into creating it. I'm assuming that it kind of
takes care of itself for the most part now, but I did want to
point out one of the features that I wind up using all the
time myself is the search feature.
So you can go into idacpodcast.com, click on Listen
and search. You know, either by name or by
topic, you know, type in RBAC or something like that and see all
the episodes where we had a significant amount of content or
discussion on a specific. Topic Yeah, it took a while for
that to get in place, but yeah, all of our episodes are.
There automatically. And yeah, the search box is very
simple, it just searches for keywords right?
So you type in RBAC like you said, and if it's in the show
title or in the show notes, it should pull back entries related
to that, which I'm sure we have a few at this point, Yeah.
So the last thing I'll I'll point out.
So for folks who are part of ID Pro who have access to select
channels, awesome. It's probably the the biggest
benefit of being a member of ID Pro, but the thread is still
open. So folks want to, you know,
nominate somebody you know that, especially if you know the
person and will handle doing an introduction, that would be
great. But I wanted to shout out to
Sarsourcetti and Ian Glazer because they gave several
recommendations, so we got a a good little bit of a list to to
chew through in 2024. Yeah.
And you're responsible for all the show bookings and guests and
things like that. So that's right.
That's, that's that's the weight that I carry.
Yeah, you know, Speaking of the Spotify app, something I started
doing recently is they have a feature where you can add in
like Q&A and like poles. So I've started to do that on
some more recent episodes. And if you remember, a couple
episodes ago, this episode, 245, we were talking about which
universe we would like to live in, whether it was Game of
Thrones, The Matrix, or The Walking Dead.
And based on a very limited sample size so far.
The winner right now is Game of Thrones, which surprises me that
people would want to live in the Game of Thrones universe.
Seems very cutthroat and brutal. Matrix is in second by like 1
vote. And then nobody has voted for
The Walking Dead, which I believe was your choice when we
started talking about that. Yeah.
And and I mean none of those options are great.
The reason I mean just just to go back why I picked The Walking
Dead is that I take prescription medicine and without it I don't
think I would survive. So I had the idea that you know
if I was in the Game of Thrones, like I wouldn't last very many
weeks, but if I was in Walking Dead I could probably go and
raid a pharmacy and get the medication that I need.
So it was like a logic based answer.
I know that kind of takes the fun out of it.
To some degree. But it just, you know it's it's
a it's a question that shows our personalities, right we're I set
the Matrix because I like air conditioning and being
comfortable and Wi-Fi. I can do that in The Matrix.
Do I know I'm a battery? I don't know.
Maybe I'll find out at some point, decide to pursue that
rabbit hole. Either way, I don't have to
worry about having my head chopped off or being bitten by a
zombie or anything like that. Isn't that blue pill?
Yeah, the red pill is the one that I'll take you out.
The blue pill keeps you in 'cause you've never seen the
Matrix, right? I didn't even know that was.
I thought it was like if you were taking the blue pill, that
meant you didn't know what was going on then.
Basically takes the red pill that.
OK, it's like you. It's like you.
This conversation never took place and you just kind of wake
up and it's like you're back to being a battery.
Gotcha. Let's see.
So Thanksgiving this week. I've got family in house pretty
much all week. They're doing their best not to
make noise, which it's fine. Whatever.
Like, you know, we should be OK. My dogs will start barking,
maybe at some point. My brother-in-law is apparently
a trigger for my youngest dog and just howls his face off
whenever he sees them. Which is really, It was cute at
1st and now it's gotten really annoying because it's like every
time like, Nope, Same person. He just went upstairs.
He came back downstairs. Same person.
Yeah, but I so you're having a an exciting week, but less
exciting than all the people who work for Open AI.
Yeah, no kidding. Open AI has got some got some
things going on over there. I'm not qualified to speak on
it, but hopefully they get things sorted out because I'm a
big fan of AI and hopefully things work out.
Let's see. So this show's gonna go live on?
It was at the 27th, I think it is a which is a Monday like
usual. And then I'm gonna be in New
York City for the Identiverse regional event that's taking
place on Friday December 1st. So I'll have a link in our show
notes for people to check out if they can make it.
Probably best for like local people not to be there but it's
free and the only and the way you can show your support is
using our registration link to to show up.
So if you're there I'll have stickers.
I'll be given fist bumps with gratitude instead of checking
out what that's all about. So.
I think it's all the promotion I've got before we get into our
main topic, which is decentralized identity.
Do you have anything else, Jim, or should we get going?
Well, let's get going. All right, so to help us with
decentralized identity and figure out what the heck we're
talking about, we've got the identity woman herself.
She's Kalia Young. Welcome to the show, Kalia.
Great to be here. Thank you so much for taking the
time. And we've got tradition on the
show. Whenever we have someone on for
the first time, as we like to find out sort of their identity,
origin story, you know, where did they come from?
Who made them what they are? Did identity choose them?
Did it choose? You know, did you choose it?
Those sorts of things. Tell us a little about how you
got into the world of identity. Sure.
I had a pretty unconventional path in the year 2000.
I went to a conference called Planet Work, which you can think
of like planet and network mushed together.
And that that conference they had like the chief scientist of
Sun talking about what you know, what we would now call Uber,
like you're going to have cell phones, they're going to pick
you up. And we're like, no way.
Like it was so cool and and after that conference that
community of people who were there met for about 18 months
and wrote a paper published ultimately in. 2003 called the
Augmented social network White paper Building Identity and
Trust into the next generation Internet and I started hanging
out with the folks who wrote that paper in the fall of 2002
and totally understood what they were talking about and they were
saying like look, we need user centric digital identity to
support. People connecting to each other,
not being intermediated by governments or businesses, which
will happen if we don't build open standards.
And I was like, you're so right, I'm, I'm there.
And I started working with the guys who were trying to make
that vision a reality. I became one of the first.
Employees of what at the time was called Identity Commons,
which was their project to do this, and I started networking
with other people who might share this vision and ultimately
ran into a bunch of user centric digital identity oriented people
at the big Identity conference at the time, Digital Identity
World, in the fall of 2004. The Identity Gangly mailing list
started out of that. And then.
I've I've been working in the field ever since.
So you've got a pretty long story to history.
You've also published a couple books.
What are those about and how did you get into the book writing
game? Sure.
So the first book that I wrote was actually coming out of was
that. Yeah, that was.
I I wrote it first, but I think it was published after how's
that was the domains of identity, which I wrote as my
master's thesis in the Master of Science and Identity Management
and Security program at UT Austin.
And it really was born out of a frustration in the field of
identity management to put everything into one big BLOB.
And you we cannot solve this problem as one big BLOB.
Should the border agent take your biometrics when you're
crossing the border is an identity management problem.
So is enrolling your kids at soccer and proving their age.
But they're very different identity management problems,
and we might want a a a landscape of choices to to
categorize problems. So it has 16 different domains.
All of them existed 100 years ago, so it's not particular to
digital identity, but it's very useful for thinking about
digital identity problems and challenges.
That was formally published in in 2020, and I also published
the very first book about self Sovereign Identity, called A
Comprehensive Guide to Self, Sovereign Identity.
It's up on Amazon. And unfortunately it's a bit out
of date that the sort of second-half of the book, it's
like the current state of the industry just ignore that part,
read the the the beginning part and and it's a great kind of
orientation to how the work of decentralized identity and and
self sovereign identity got started and and ways to think
about it clearly. I can't imagine trying to write
a technology that is so I don't know.
Futuristic. I don't know, for lack of a
better word, like Self Sovereign.
When we're. I think we're still trying to
figure that out. I'll have links in our show
notes at both books so people can check it out.
I think. Fun fact, if you are a Kindle
Unlimited submitter subscriber, the comprehensive guide to Self
Sovereign Identity is actually free with your Kindle Unlimited
membership. So.
I don't. I hopefully that helps you.
Yeah, I'm. I'm.
I don't know, but people can check that out, at least for
free. If they're a Kindle person.
It helps Amazon. It helps Jeff Bezos.
It helps. I mean they're they're a
struggling company, you know, hopefully they'll be able to
make it to the next year, but I'll put links in our show notes
for that. You also Co founded the Internet
Identity Workshop or Iowi have not been there.
I don't think Jim's been there either.
It's something that we've kind of heard about.
I think I've talked about this on a show before.
I feel like I would be a little bit intimidated going to there
because I feel like these giant identity brains are there and
they're gonna be talking way over my head.
And I think the only way that I would learn something would be
like through some sort of osmosis or something like that.
Who is this conference for? Can you kind of take us behind
the the curtain of it? Sure.
I mean we got started in 2005 really.
It was an opportunity for the mailing list that formed out of
that identity gang era to talk to itself.
And the the first Iowa was actually one day of
presentations from all the different sort of.
Leading user centric potential protocols at the time and then I
said like hey let's stay for another day and talk to
ourselves. Doing it using a method called
open space technology where you facilitate and support the the
participants Co creating the agenda live the day of the event
and we use that format now for all three days of the event.
We'd literally sit in a big circle the 1st morning and each
morning afterwards and people stand up and on a piece of
cardstock articulate the name of the session that they would like
to convene. And it can.
Sessions take many formats. SO1 format is asking a question
and inviting people to come and help you answer it.
Another one is, you know, people presenting for 10 or 15 minutes
about some aspect of ongoing technical work or problem
solving that they're doing and and sharing it with the
community. Another is just talking about
critical issues that could use more discernment.
And there's a broad range of what those topics entail.
So they go all the way from, like, deeply philosophical.
Sort of like what is identity and the meaning of the universe
to like super down in the weeds, technical nitty gritty.
And that broad range is part of the magic of our space is that
it's not, it's not like all of those things are welcome and I
think it helps us maintain our grounding into the complexity
that identity has while at the same time.
Creating an opportunity for really practical problem solvers
to move their work forward. I've never been to an
unconference before, but it sounds Is that what an
unconference is? So I I actually also have a hat
as an unconference designer and facilitator and work with many
different communities. And I think of unconference
formats as anything that is more organized than.
A cocktail party and less organized than talking heads on
a panel. So there's a whole range of
potential formats and one of them is the format that we use
primarily at Iowa, which is open space technology.
We have a little interlude on Wednesday where we had demo hour
where we have 20 different people spread out throughout the
venue space where our lunch tables are.
And they demo for 5 minutes and then they kind of circulate and
you can see like 10 demos in an hour after lunch on Wednesday.
And are those things that I guess people have built, are
they like vendors, like what does that look like?
Yeah, it's it's it's things people have built, protocols
people are have working prototypes of.
You know, now we're seeing more and more like actual products in
market. So last IW, we had the folks who
built the mobile driver's license application for the
State of California sharing what they had built.
Yeah. So it's really an opportunity
for the technologist to have another medium in which to share
their successes and work. Sounds like a lot of fun.
I think Jim and I have to try to figure out how to get there at
some point. I don't know how you find the
time to do all this. Because you're writing books,
You know you're helping with this conference, you're doing
identity stuff in the real world.
And then you also put out a newsletter, A Dentosphere.
Great name, by the way. How did that come about and
what's that about? Sure.
So I I collaborate with my colleague Infominer on that, and
we really survey what's going on in the decentralized Self,
Sovere and identity space every week.
We actually have some public our our our feed RSS feed aggregator
is public. Like if you want to filter
through what I filter through every week, you're welcome to do
it. It's sitting there on the public
Internet, but it really felt like a good thing to do with the
time and we got a really great rhythm.
Every Friday I spend about 3 hours going through all of the.
News and filtering it out and deciding what is worthwhile for
many other people to read and by Monday or Tuesday info miners
got it all formatted and ready to go in in sub stack and I I
think of it as you know if you're ACEO.
Or anybody working heads down on shipping a product, It's really
hard to pull your head up and like pay attention to what's
happening in the rest of the industry.
And I I feel like the newsletter is if you're gonna lift your
head up, you could pay attention to the newsletter and get a
sense of it, and then go back to doing your work right?
That it's keeping a pulse of the latest relevant information?
Both in terms of new companies and products, but also standards
work and government announcements and and sort of
movement in the space. I think I appreciate that
because I think there's just so much content out there that
sometimes kind of figure out, OK, well, what's clickbait?
What's not right is there? Like, what should I be concerned
about and kind of working through things?
I think it's, I mean that's one of the beautiful things about
our industry. It's so open.
This is both a feature and a bug.
The bug being, it's so open you can't figure out what to pay
attention to. And in fact, that's one of the
core sort of value propositions that my colleague Lucy and I
have in our work is helping people figure out where they
should pay attention to based on all the all the buzz that's
happening 'cause it's certainly getting a lot of attention these
days. So when I ask you about the
Identity Woman sort of moniker, how did that come about?
Because I thought I read something that kind of
interesting way back when. And I want to make sure that the
rumors are, are there, like, you know, you're the only woman in
the room or something like that. And I'm like, oh, I've just
become this. Is that true?
Yeah, I mean, back in the day, you know, I shared a little bit
about working with Identity Commons and those guys were
really fun to be around and work with.
And I. And Doc Searles was kind of
going around to different community members on the mailing
list and really strongly encouraging us all to start
blogging because he understood this emerging medium was
important for supporting us, sharing our work beyond just
ourselves in a mailing list. And it also gave people a way to
express themselves in their own space and then post the link
into the mailing list. So they were, sort of.
Putting less pressure on being seen and heard in the mailing
list, if that makes sense. And you to start blogging you
need a cute pithy name for your blog.
And I was like, I guess, I I guess I'm the identity woman
looking around. I think I sort of had seen like
Pam Dingell and Mary Reddy maybe across the room at Digital
Identity World, but there was certainly nobody I was working
with in in the small community on an ongoing basis.
And so, yeah, that that was the name.
And then if you look really carefully in Kim Cameron's loss
of identity, he thanks everybody in the opening paragraph.
Or you know. Sort of, yeah.
Like the preface or something like.
That, yeah. And.
And he in that he says identity woman Kalia.
And I read that and I was like, Kim, what are you doing?
Like, that's how I named, 'cause everybody else has their first
name, last name, right? And he's like, no, no, no,
you're the identity woman. And I was like, well, I guess if
Kim Cameron's going to say that and refer to me that way, I'll
just go with it. And it's kind of stuck ever
since. I mean, it's hard to top being
bequeathed that by Kim Cameron. Definitely one of the giants in
the industry. So I I I would run with it,
that's for sure. You also have this identity
woman in business. What is that about?
Two years ago, well, actually during the pandemic, my
colleague Lucy and I started working together on the COVID
Credentials initiative and we LED that work for two years and.
So eventually we're nested inside Linux Foundation Public
Health and had a had a fantastic working relationship.
And as the pandemic was sort of winding down and I was getting
knocks on the door to support enterprises figuring out the
decentralized identity space, I said, hey Lucy, do you want to
join me and help help get these? You know, reports and other
research materials together to serve, you know, the clients
that were showing up and she said yes.
So it's our consulting work together really supporting
clarity and discernment in the industry and one of our favorite
things, favorite types of client work is working with different
companies. And organizations who would like
to support more discernment about key issues, whether it's
wallets, different protocols that are emerging and those
reports are publicly available but sponsored by different
companies. And and I think they're our goal
with our work is to really serve the development of the
technology and serve the community and the, you know,
development of good. High performance, open
standards. So Kalia, we've got listeners
that kind of span the the whole spectrum in terms of their
experience in the space. We call them the I am
practitioners of the world are identity practitioners of the
world. So we like to kind of start off
with baseline understanding not to kind of blow anybody away.
And I was going to ask you, could we just start with, you
know, defining? Decentralized identity or as a
self sovereign identity, are they the same thing or
different? And you know, how would how do
you explain what you do to people who have not even that
baseline of being in the identity industry?
Sure. So I often start by talking
about people's lived experiences today that they have in the
digital world, and one of them is.
Showing up on a website and being invited to like log in
with Google or log in with LinkedIn.
I I explained to them that that underlying that is a protocol
that we invented in the first, you know 10 years of the life of
IAW called Open ID. And that that shape of that
protocol involves Google or Facebook or whoever that
identity provider is seeing everywhere you go.
And they kind of intuitively get that because they're used to
that user experience. And then I say we're working on
a next generation of protocols that changes that, that supports
individuals sharing authoritative attributed
attributes about themselves with other parties but without that
identity provider in the middle because we've got a new three
party model of. Issuers who issue credentials to
a holder that holds them in a digital wallet and that holder
or individual can choose where and when to share it with what
we call a verifier in this model.
And that the really different thing about this from the
previous paradigm is that the issuer and the verifier never
actually connect or speak to each other.
So it it it ends that. Sort of disintermediation that
happens with the identity and identity provider role and also
you know in terms of like addressing key challenges that
have come up with the the previous model, it's it's
surveillance capitalism enabling right like that identity
provider is like seeing everywhere you go and and
another thing is we do not want in western liberal democracies
that identity provider to be our government.
But at the same time, there's more and more need to prove real
attributes about yourself from authoritative sources like
governments. Whether it's like to open up a
bank account, to buy a plane ticket to, you know, prove prove
that you're the right age to watch adult content or buy an
alcoholic drink like these are all reasons that.
Attributes from authoritative sources matter, and that those
authoritative sources may not be good entities to see all of your
transactions. And so this, this new sort of
paradigm is it's made possible by this decentralized identity
technology or three party model. I love the three party model
because it makes me think of an example of OK, so I get a
credential issued by the government.
So they're the issuer and then the relying party might be the
liquor store. I don't want the government to
know. Oh, Jim goes to the liquor store
a lot because too much. Well, you know, if it gets out
of control, I don't want the government to know that.
No. Yeah.
Although is that? Am I on the right track with
that? You are on the right track.
Definitely right. It's none of their business
where you use the credential, just like.
You know, it also mimics our paper based system today
architecturally, right? Like the paper in your wallet
that you use to do that proofing today does not ping the
government every time you pull it out of your wallet and show
it to somebody, right. So I actually have a paper
called Seeing Self Sovereign Identity in historical context.
That basically makes this case and says look, we have this
history of paper based documentation in the West that's
about 500 years old and we have computer technology that's about
7 years old. And until SSI the two
architectures didn't actually look, didn't echo each other
that the, you know, the phone home model of the computer was
not in alignment with the paper based architectures that we've
had working in our. In our societies, for hundreds
of years, I'm going. To ask you a question I think
makes sense. So where does the term self
sovereign come from? Because it's not like you're
issuing your own identity. Right.
And I think this is, you know, we can, you can find lots of
philosophical debates about the meaning of this term and and
what its implications are. And and some people will say
like, yeah, that what you just said, like you aren't issuing
your own credentials in fact. You know there is value to self
assertion of information and this technology.
You can issue your own credentials to yourself about
things you care about and other people might find relevant.
Like your favorite color is blue and your shoe size is 10.
Or you know, stuff that is fine, but things that really matter.
It matters what other people say, but there isn't 11.
Authoritative source of all truths in the world and that's
part of what the SSI and you know, the decentralized part is
about is really how do you have, how is the individual the locus
of control for this system and able to manage who can see what
and when and how do you also give the individual.
Almost their own technological base from which to do those
interactions and that led in this case is the wallet, whether
it's on your phone or in the cloud, is that until now you
didn't have your own kind of domain of self-control about how
you were managing that if you were always at the affect of an
identity provider and they were really in charge.
Another thing about our podcast is that we reach an audience
outside of. North America, so 40% of our
listeners are outside the United States, not even just like, oh
that you know, most of us are in Canada, most people all over the
world. So I think we can end up taking
a very, you know, North America, focus on the podcast and think
about some of these things. But from my understanding there
are some other countries, Estonia for example, that has
gotten a lot further along than the USA for example.
And so I'm wondering why couldn't USA kind of follow that
Estonia model? Sure.
I mean, this is a fantastic question and one I wish people
would ask more often. I think countries like Estonia
and Singapore have done remarkable work, but they also
have certain features that mean what they did in those contexts
is not scalable outside of them. So they're both incredibly
small. Geographies and numbers of
people. Estonia is about 1.5 million,
Singapore's 4 million and they're very high trust
societies with strong Government Accountability.
And there is sort of 1 jurisdiction.
There isn't multiple levels of government with, you know, a
federal government, state government.
In the United States, you've got county level government and city
level government. So that's four levels of
government. In the United States, you have
over 5000 jurisdictions that issue birth certificates at the
county level, right. So that's already like super
decentralized, right. So we need to think about how
the complexities of federal systems.
Cannot be held or managed in the same way that you manage, almost
like city States and their capacity to issue their
citizens. A simple identity that can be
used many places within that jurisdiction.
And Estonia, in fact, actually has a system where, with citizen
transparency and accountability, all of the major databases are
actually linked to each other. And people are have the data
moved from one database to another when they need it to
interact with a new part of government.
And that would just be completely unfeasible at the
scale of a country like the United States.
Could you manage every every government database at every
level of government being somehow linked to each other?
It would be a security, privacy, accountability nightmare.
And that the way to scale. Information sharing amongst
entities that people are interacting with is really with
themselves as the pivot point where they can take a record or
information from one service or system they're interacting with,
hold it, have a cryptographically signed by that
entity so it's it's trusted from the originating service provider
and then they can share it with who, who they choose to and
when. When you think about government,
one of the challenges that they face is that it has to be
accessible by everybody. And I just think about the
person who uses the exam, my poor dad, trying to figure out
how to use this stuff. So I think there probably has to
be some kind of, you know, I would imagine that's one of the
challenges is people who either don't have access to the
technology or have no interest in, you know, changing at this
point in their life. What are some of these
challenges? Yeah, I think those are
challenges, but I think. They're also addressable, right?
There's a lot of conversations about guardianship models so
that you, Jim, can be a steward of your father's identity in
interacting with certain systems.
Or you know, parents are going to be the stewards of their
children's identities, right until they're of the age they
can manage it themselves. And I think you're also going to
see. Like service providers show up,
like I don't manage my money, I hire a bank to do it right.
Like there is they are experts at that particular thing and we
just haven't progressed far enough to see that happen yet.
But I think we will, because it's really critical to have
service providers that have a fiduciary duty to the people.
Whose identity information they're stewarding and we don't
right now. Everything you share with the
service provider is sort of owned by them and they can do
what they want with it. Now that's that's a really great
idea around the the stewardship model or the guardianship model,
I'm sorry. It seems like that potentially
could solve the issue. Of course, that probably makes
the data model much more complex.
I can just imagine, you know, bring this.
Back to the good old USA and kind of where we have states,
where my mind goes is around the mobile driver's license
initiative. Is is that a good example of
self sovereign identity? Is that am I thinking about this
right or is that something totally different?
Yeah, so that's one of the standards.
The ISO MDL 18O13-5 standard is is an example of the the kind of
architecture. One of the challenges with that
that standard is that it has an optional phone home option which
many people aren't necessarily tracking, but some states are
using that so. When you get pulled over by the
side of the road, you share a token with, you know whoever's
stopping you and they take that token and they go get your
information from the state database.
And I've from the beginning said, look, we shouldn't be even
creating a protocol that has a phone home architecture because
we have confidence and faith in our governments here in the
Liberal West, but. This is going to be used by
governments all over the world. The good thing is, is that
there's more sort of scrutiny and awareness of the protocols
and hopefully that will help better choices being made.
The ACLU actually published a really great report sharing some
of their concerns about these optional features in that
architecture. But the Verifiable Credentials
Standard, which was, you know came out of the community around
IIW and the Credentials Community Group, with the W3C
and the Decentralized and the Foundation.
There's a lot of different forums where the core standards
are being worked on. Doesn't have that architecture
at all, partly because we've always been very concerned about
how people are empowered and. Have have the control that makes
sense. I think that's the keyword
control, right. How do you manage your own data?
And I think some of this is, where are you going to manage
this data? How you gonna store it?
You wrote a blog article recently on Medium and we'll
have a link in our show note about this as well called
Exploring Approaches to Digital Wallets.
I'll put a link in our show notes, but for people who
haven't read it, I guess what's the take away from that?
Because I feel like we're in a risk area of fragmentation when
it comes to wallets. Are we gonna have one wallet?
Through them all? Or is it gonna be like a key
chain where I look like the key master for the matrix and I have
like 80 million keys on it and that's each of those Might be a
wallet. I'm concerned.
Right. Yeah.
I mean it's a place of much market activity and we wrote
this report we we spoke to six different experts around the
world. And we we, we came up with some
key characteristics about wallets.
One is that they're sort of, they need to be almost like
invisible. Like you shouldn't be thinking a
lot about the wallet. It should be a tool to help you
accomplish your goals. That we need to be mindful of
inclusivity and how these work for a broad range of people.
Portability. How can you move from one wallet
to another and not get locked in interoperability?
Like, can your wallet work in a variety of contexts?
Since we still have, and I think we'll have many, many, Not many.
Not like, not like. 30 or 40, but we're going to have a small
number under 10, hopefully different formats that are
coming out of different industries for different reasons
and we need to get it all to work together so consumers
aren't going and end user experience.
And I think collaboration is really the key to solving these
wallet challenges right now because it's a core piece of
infrastructure that everybody needs and needs to work really
well and isn't isn't where you're going to make your money.
And whatever your business is, it's going to involve hopefully
interactions that leverage the information in a wallet or if
you're in the service provider or software business, like
helping businesses connect and use the tools.
Much like in the early web, people made money because they
were helping people make websites with HTML, not because
they owned HTML, right Like and I think in terms of critical
issues and we didn't really get into this into the report, but
it's definitely circulating in the communities right now is
really key control inflection points.
So there is a term that's really about one of these inflections
points called wallet invocation. So if we have a plurality of
wallets in the world, if I as a consumer have the right to
choose which software provider I trust to build and and you know
build and and and be the software that my wallet runs,
how do when I interact with other tools and services, do I
get them to pick the right wallet on my phone if I have
more than one of it to deposit a credential in?
And when I want to share a credential, how do I connect the
right wallet with the credential I want in it to that service?
And that protocol is one that we have to push really hard right
now to make sure it comes into being because otherwise we could
end up in a world where the platform providers are like, oh
don't worry, let us take care of it.
And. And then the only option if
you're on an iPhone will be your Apple Wallet and potentially and
Google, although Google's been much more clear that they're
more aligned with having a plurality of wallets.
But you could still end up in a world where the platform
providers are the deciders of the wallets.
And and I don't think we want that, just like we didn't want
the operating systems to be the decider of which browser we
would use. Aydo is going through a little
bit with this right now with passkeys and sort of you know,
being associated with a platform and I think now we get into this
areas. OK, well how do I make my
passkeys portable to move from one platform to another, which I
think it's the logical next step if we're gonna get there.
I just, I'm, I'm just concerned about here we are again with you
know 80 million wallets and some.
Garbage looking Oauth prompt. It's like, oh, which of your 80
million wallets would you like to select to connect to this
service? Like that's just not going to
work. That's not user friendly at all.
Well, that's what IIW is for. I mean we had extensive
conversations over the, you know, I went I, I I saw them
happen. I wasn't actively participating
in them, but key people from across the industry trying to
figure out how to solve this challenge in a way that works.
And I think we need to put significant, just like Fido put
significant user experience, attention, resources and efforts
into getting their UX right, the decentralized identity digital
wallet folks need to do something similar in the next
year. Well, there's certainly a lot of
smart people working on it, much smarter than I am, so I will
hope and support those efforts. I gotta ask, is there
competition between like decentralized identity
standards? Like how does this work behind
the scenes where maybe people have different ideas?
Or is there like, OK, we'll take the best of this standard and
then bring it over to this other standard and form like the Uber
standard? Is that standard supposed to be
global or is it meant to be, Well, this is the US standard
versus the Canadian standard versus the Indian standard.
How do you see that? This is a great question.
In fact the last report Lucy and I wrote was focused on standards
based digital credentials and the different formats that are
are currently in market. I think one of the challenges is
the real world in the sense that we have incredibly high
ambitions and ideals for what the protocols could do.
Selective disclosures, EKP like amazingness, right.
But then it's like, Oh well the algorithms to do those things
are are new. They haven't necessarily been
vetted and oh, we have hardware that has certain algorithms
connected to key management there and those aren't really
compatible with the fun new interesting selective
disclosure, right. So there's been a real kind of,
I don't want to call it a wall, but sort of like, oh, reality
intervention saying like if you want to support credentials
being anchored to a particular phone, which governments.
We can have debates about this. I'm sure you can have people on
and talking about these trade-offs, but for for now, the
government folks who are talking about issuing anchor core
credentials in Europe is sort of a national ID card.
In the United States, it's something like a driver's
license to a phone. They want to know that you can't
extract that credential and move it to another phone.
Well, in order to do that key binding onto the device, the
cryptography is whatever is in the phone which is not capable
of doing the type of signatures that the selective disclosure,
the algorithms do, right. So there's been a lot of
discernment and gnashing about how do we ship product in the
coming year and how do we support it doing as good a job
as it can and and hopefully in the coming years get to those
more advanced you know, features of selective disclosure and
privacy. You know, ZKPS even, but still
have it anchored to the phone in a way that governments are have
confidence is not being moved. I don't think that we as a
community really thought about all those things early on when
we were innovating in the verifiable credentials
community. But we've certainly been you
know, challenged and pushed by folks coming from another
direction, which is the ISOMDL protocol work coming out of that
much older, more conservative SDO that is driven by long
standing, you know, folks who've been working on developing
credentials that are issued by governments for hundreds of
years and governments themselves.
So there's I think a healthy kind of interaction between
different protocol development communities and their needs in
the marketplace. And hopefully in the next, you
know two years, the best of these different worlds will
align more and there will be I, I I don't think competition's
gonna be go away back to like, you're gonna have a wallet.
It's gonna speak more than one protocol, but there'll be a kind
of steady state of good options. I feel like most things, there's
probably some sender compromise that needs to come through
because I guess I think about this as a bystander.
What good is a protocol or a standard if it's not usable in
the real world? And the fact is that there are
things that we have to get done in the real world.
That will, you know, cause consternation amongst different
parties and it's just about trying to find the right
balance. Is that, is that a healthy way
for me to look at it or is there another way that I should be
thinking about this? Yeah, I mean that's one how
that's that's one way to look at it.
I also think like key actors have a significant influence on
what will happen and we're seeing this right now with the
EU digital identity initiatives and their architecture reference
framework for wallets where they're deciding like which
versions and which profiles of those versions of the protocols
will be required in digital wallets that are part of this
sort of EU wide effort. All right.
Well, I want to be respectful of your time, who's been very
generous and speaking with us. Today I'm going to shift
completely away from identity, a different identity for Kalia
Young, that of an athlete. The Canadian National team water
polo. I can't imagine playing water
polo. I I think I would just sink
right to the bottom of the of the pool.
Talk to me about, you know your your experiences being part of
the national team. Do you have like really cool
water polo moments? Is there like, oh, that was
like, you know, awesome. Or maybe there's like, maybe a
not awesome story you've got. Yeah.
I mean, I started playing when I was 10 years old.
I was always drawn to the water. My name in a Hindu mythology is
a sea serpent. My Canadian parents had no idea
this was the case. I learned just after the
Internet came about. And you're like, take your name
and you're like, that's interesting.
So I was always like, you know, sign me up for swim lessons when
I was four years old. Joined those, one of the swim
teams at six, joined the more competitive swim team later on.
And water polo was free in the summer if you were under like
12. So mom's like go to water polo
and then we could play water polo in the fall and still keep
our summer swimming status. And I just really thrived and
loved it. And I happened to be quite tall,
if you've met me. So I had some like size
advantage. And we actually played mixed
water polo growing up because you had to have two girls in the
water at the time, all the time being the large girl that helped
to and not playing dive. And it's hard to describe how
much it meant to me in terms of a place to go where I was
supported, coached good. Like, I remember being in
elementary school and just being like, school sucks, but I've got
water on the weekend. So, like, let's do that.
And it was really me. Like, some people have, like,
you know, athletic parents. I was the athletic kid.
Like, let me play more, please, Mom and Dad.
And they're like, OK, so another fact where I grew up, you know,
sometimes kids are in sports and they're like competing for their
spot on the travel team when they're 10 years old.
We were like begging girls to come and play.
So we had enough people just to make a team, right?
We're like, OK, we've got eight kids, we can go to the
tournament and like, the Max on a team is 14, right?
Like, So then I tried out for the the junior national team and
that was totally trippy because I'd never had to try out for a
team of my whole life, right. And what?
Was the try out like like what did they like?
Is it play a match? Is it like, yeah.
I mean, it's sort of like a weekend of really intensive both
like, you know, times like swim tests and like drills and like
kind of practice where they're like watching everything you do.
And it was very hard for me in terms of mentally, 'cause I just
never done that before. And I turned to Western sports
psychology that wasn't particularly helpful.
And then I turned to some Eastern sports psychology and
that was very helpful. It was much more in alignment
with sort of my demeanor in the kind of sports psychology where
you're like, thank you to my opponent for helping me run
faster on the marathon. Like I'm like there's a
different kind of, you know, not like beat them like or whatever,
you know, Western sports psychology.
It's like, well, yeah, and I managed to make that junior
national team I I that led me to play water pool at UC Berkeley.
I was recruited after I sent letters to different teams
saying I'm here in Canada playing for the junior national
team. I'm interested.
I was recruited by UC Berkeley's new coach in May of I Won't Say
the Year. Can we bleep it out, Jeff?
Can we bleep it out like I was recruited to Cal the first year
they had a women's varsity team and I still hold the record for
a leading scorer as most number of goals scored as a freshman.
Wow. And I ended my national team
career winning a gold medal at Pan American Games.
That is super cool when you watch, I guess water polo Now is
it like me in the restaurant business where I used to be a
server and I can, I know what's going on behind the scenes?
Like, do you watch technique? Do you watch strategies?
Like, I have no idea. I'm just like, I don't know how
these people do it. Like what should I be looking
for? Is like a I actually went back
and started playing with the local, mostly men's masters
pickup game. I stopped last January partly
because practice was too late at night and I had to keep waking
up at 6:30 in the morning for work calls.
I was like work swamp, but I think too.
The other thing that's been frustrating for me is they keep
changing the rules. So the the, the rules and the
game that I played growing up has shifted and I kind of like,
could you just leave the room because they keep wanting to
make the game more exciting for European television audiences
like. What's an example like what
rule? Has changed that is like that
you can now if you get fouled outside 5 meters you can take a
shot. They've been, they've changed
how they call fowls in the center forward position to be
much more aggressive on leading to kick outs.
It's sort of like, yeah, but I love watching water polo.
And in fact, I'm super excited about what we're seeing with
some of the new, you know, like this year I've tuned into
international matches that are being broadcast online.
You know, there's lots of people who play esoteric sports who
would love to watch their sport if only they could.
And now they can, right, 'cause I, you know, I didn't play
baseball, football, basketball, are those.
There's four of them. Hockey.
Yeah, no.
None of them hockey. I grew up in Vancouver.
There's no ice here. Jim, could you play water polo?
I mean, you're tall. I've played like modified water
polo where it's like standing level water and I love it.
I mean, I think the form of the game is great, but being in deep
water and treading water for a long period of time is very,
very difficult. If you've never done it, like
don't take it for granted. So Khalid, I have a ton of
respect that you can like you just do that part.
I'm impressed by but I played. Baseball growing up and a lot of
what Kalia said, like, resonated with me there, you know?
Well, one thought I had was just kind of watching the game on TV
Now, like, I'm so impressed by some of the athletes.
And I realized, like, no matter what I did in my life, I would
never be like that person. You know, I played third base.
I watch. I remember having this thought
like 10-15 years ago about Chris Bryant, who was the 3rd baseman
for the Cubs. And he made some play.
And I was like, yeah, I I never could have done that no matter
what I did in my life. But also there's the sport that
they're constantly changing the rules now they do a pitch clock
and some various things like that.
And it's my feeling is it's like they're very focused on drawing
in. People who don't like baseball
just start liking baseball. And in my experience, good luck
with that one of people who don't like baseball.
We'll never like baseball. Case in point.
I just don't get it. I mean, I get it.
I understand. I just, it has.
I have zero interest in baseball.
I don't know what it is. It's not.
I mean, I'm AI guess I'm a Cubs fan.
It was nice to see them finally win something.
But, you know, this goes back to the first time Jim and I met.
The first thing he said to me is, hey, do you like baseball?
And I said no. And he walked away from me like
I, you know, I just, it's just not my thing.
I'm an NFL person. I like football.
I mean, I grew up playing basketball, soccer, you know,
football. I did Taekwondo and stuff like
that. I even did gymnastics, did
swimming and stuff like that. Was just kind of more of a
general purpose athlete than like a specialist in anything.
But there are certain things that I gravitate to.
Baseball is is not one of them. All right, we've been talking
for over an hour here. Kalia, you've been so generous
with your time. We're gonna have AI think this
might be a record for the number of links that we'll have in our
show notes. We'll have a spot where you can
connect with Kalia on LinkedIn. You can ask her questions.
We'll have a link to the blog that you wrote exploring
approaches to digital wallets, of course, the link to
identitywoman.net, so be able to check that out, what you're
working on, the links to your books, the Identisphere
newsletter, the Internet Identity Workshop or IW.
Jim and I will have a link for the Identiverse conference,
things that are coming up. There's the one in New York City
on December 1st, and then on the following week there's one in
Chicago, albeit the New York City one.
Not going to be at the Chicago one, so hopefully people come
and check that out. Of course, you know, you can
always connect with Jim and I on LinkedIn.
That's where we get a lot of good conversations and stuff
going like that. But yeah, well I have one more
thing that seems like it would be great to share with your
listeners is that we've we've actually this year expanded our
IIW universe to include regional events.
So we have a regional event in Europe called the Digital
Identity on Conference Europe that's happening in June and
we're exploring a regional event in South Africa in March.
And we're exploring a, we did this last year in in the spring,
but it'll probably be in the fall, in 2024 in AIPAC in
Thailand. And those use the exact same
format that we have at IW. So it's an opportunity for the
your global listeners to potentially connect and not just
have to get to North America to participate?
Yeah, that's so cool. I mean, the world doesn't.
I mean, it seems like sometimes the world revolves around stuff
going to the US, but not necessarily.
Shouldn't I see some things on the website
internetidentityworkshop.com ethics referencing the April,
the spring and the fall. Those are the ones you're
talking about. Where where do people go to get
more information at? Is that just on the website?
Yeah. And then next week, probably by
the time most folks listen, we're working on getting a
regional events page up that will have more information.
Very cool. That's good information.
So hopefully people can check that out.
And yeah, I think that's a good spot where we can leave it for
this week. Jim and I, we're on the web,
idscpodcast.com on Twitter at IDSC podcasts, at Mastodon or
no, we're on Mastodon at IDC podcast at Infosex dot Exchange.
I still hate the way that that name works, but it is what it
is. Thanks everyone for listening
and we'll go and talk the other one in the next one.
You've been listening to Identity at the Center.
We hope you've enjoyed the show. Make sure to like, rate and
review and we'll be back soon. But in the meantime, hit the
website at identity@thecenter.com and find
us on Twitter at IDAC Podcast. See you next time on identity at
the center.