You're listening to the identity of the center podcast, this is
the show that talks about identity and access management
and making sure you know who has access to what let's get
started. Welcome to the identity of the
sender podcast, I'm Jeff. And that's Jim.
Hey, Jim. Hey, Jeff, how are you?
That's a bad yourself. I'm doing great.
I well, I am a little bit sad. There's the last day of the
conference. We're here at the gardener.
I am Summit in the RSM podcasting, sweet.
The sweet sweet. We've talked about that, that
total joke. Yeah, that's the joke.
That's getting a bit too old, but fortunately we won't tell
them any more times. And I had a thought today.
Oh boy. What?
Is or what makes a person part of the identity arathi?
That's a good question. I don't know.
I think probably being part of the speaking tour, contributing
back to the identity body at large, right?
Although people were in it. So I'll be honest, I don't know
if I like the name because it feels like it's elitist a little
bit, but I get the concept of it.
I think anybody can be part of the identity riding.
But to do that, you have to be, you have to be contributing some
way back, right? You can't just be a consumer.
You need to be a producer of something.
That's how I would Define it. So who gets to determine whether
your, the identi Rowdy other people, or you, it's like a
nickname. You cannot pick your own
nickname. It has to be bequeath upon you.
Someone has to tell you that. You're part of it and there's
consider it. I think it's probably something
where I'm not worried about like you know it's not like a one off
thing. Like oh I gave us Once at nine
part of it, that's how it works. I think it's continued
repetition and continued production of things back to the
identity community at large. That's how I would think about.
It was just to bring It full circle.
So our guest today is Vittorio Bertucci and I asked him the
same question. What makes a person part of the
identity Rowdy and it's Vittorio Bertolucci.
Come on man. Show some respect.
Hey, have I pronounce anybody's name rights today?
No, no. Thanks for having me, guys.
Well, it's a very, very difficult question.
I'd say, you know, that scene in The Matrix in which the article
tells knew no one can tell you. If you're the one is like being
in love, only, you know, where it's porn, right?
You know, when you see it. Yeah, you know, he's when you
see it, but I think that there are two to meet two definitions,
come to mind. One is if you have a one degree
of separation from Ian, Glaser the SVP on Salesforce, then you
can call yourself an identity, right?
Even if you are a, he is to say baker.
I think that the hair if a nosy are and they are on a first-name
basis, you can call but perhaps and I don't care about you,
that's one little steps but another, which is a more
verifiable. I think that the whomever has
spent enough time and engaged enough with the community to
have opinions, on on identity matters, that will be considered
and respected by others as valid opinions, as opposed to just
like parroting the talking points that actually someone
that connects the dots in the context of identity and delivers
a statement which we might agree or disagree but you You see that
it is a competent and relevant and you see the rationale behind
it. So to me, anyone that is in that
position is an identity. Now, I agree that often that is
correlated with contributing to the community because it's rare
that people can be a lurker for a decade.
And then suddenly one day, wake up and say alright here is my
statement. Usually it's a dialogue, it's a
conversation. But yeah, that's that's very
Criterion. I use I think that's pretty
fair. R.
And for those who don't know, Vittorio definitely part of the
ident Irani. You've probably seen him
striding the Halls. He's been on the show a few
different times. So if you want to learn more
about his background, I would encourage you look into our back
catalogue with with that how. So, we're here at Gartner, I am
Summit. 2022 in Las Vegas. Jim said, sad to be done.
I feel like I'm more, like, relieved that it's over.
How is the conference been for you?
For me, this was a very good assistance of a God.
Yeah, the last one I attended was in 2019 and it was good but
this one was better. I think that maybe we're two
years interleaving or like lots of other details which I cannot
share but it's Vegas after all. But there it was good.
Like I came here specifically because I was lucky that I was
able to participate to a number of conferences.
Similar few But all of us conferences, apart from are say
they were all very technical. And so I felt this that's to be
farther toward what happens on the wire and like details that
as blue colors, pay attention to and a big part of my job is to
advise my feature teams and I felt I needed a full immersion
with Buyers people that to think about getting the job done,
rather than how orbit. I think in medium to longer time
Horizons running than the Tactical.
Yeah, I need to do X and on that respect.
It really delivered. I'm lucky that I'm fairly
recognizable like longer here, long ago.
So long chin everything long and people like, I'm not try to stop
me miles, and I just had so many impromptu conversations, which
delivered exactly on this. And I'm also very lucky, but I
know what? Number of enemies.
And so, apart from their 101 switch, we had scheduled as part
of a conference adjust that again in number of impromptu
talks with Felix with a henrique where with Eric.
So those were really good like was guys are super insightful
and it's a privilege to have a chance to speak with that.
And finally, these will be familiar with every conference
goers. You have a chance to catch up
with your colleagues colleagues. Which sure.
Now they are in the zoo. Zoom error and so we are used to
interact in remote, but having your legs, under the same table
is an entirely different level of Engagement.
And I very much enjoy that, it has been very cool if the
hallway conversations reconnecting with people.
You maybe haven't seen in person for two years, ten years,
whatever it may be. That sort of thing.
I mean Jim and I've been doing this thing for three years now,
the podcast and we work together all the time, but we don't
actually see each other. Real world all that often
especially over the last couple of years.
It is it is very cool to like have that camaraderie.
I almost felt like it was almost like a little bit of a
celebration of kind of people. I saw you on the street at RSA,
we were probably both going different directions and
different, you know, things and stuff like that.
But I also felt our essay was a little bit of something like
that to where it was like, okay, you know, we're back that sort
of that feeling like okay, we're kind of under the same roof.
Again, we're seeing people in person and I felt like this
conference as well had the same type of ideas.
I was I this is something I point out.
I think last week when we were kind of getting ready for the
podcast, was the Keynotes seem to be focused, not on
technology, or the market or anything like that.
It was focused on a lot of human-centric things
storytelling, you know, communication and taking into
account other people's perspectives.
And what are the things that have been happening throughout
the year? You know, the last couple of
years, you know, from from a health perspective Are there any
things that surprised you from a conference standpoint was like,
oh, that's interesting. I wasn't expecting that or
things along those lines, maybe hallway conversations or other
interactions. You might have had.
I stood there are two main things.
That, that surprised me and perhaps they shouldn't have, but
they didn't one was a, the session on the, on the hype
cycle from Felix and Felix. X is an excellent speaker and a
great analyst but I was somewhat surprised by how matter of fact
he was when he described some of those things.
Like I mean they have to cycle have so many things to talk
about and the time is short and he has a to take into account
that some people aren't familiar.
So there is this little introduction to what it is.
So he didn't have a lot of time left for every item.
But in general, he He was very, very direct and I really
appreciated that and think that so many people look at the
Garter for guidance, and that was good.
Okay. It was really good.
Again, it's not that I was expecting it to be bad.
I just didn't expect it to be so direct which was great.
And the other thing that I really liked, so it's fries
model like a marveled rather than a surprise.
It was a session yesterday from the attic.
About the identity fabric. The basic idea is that there are
you can think of like a maturity model between Vector connects
via traditional. I am with what we have been
calling modern identity and basically he interpolated to
what's next and he has this concept of identity fabric which
is basically a collection of capabilities into is.
It isn't really a product and the way in which the character
This was capabilities just hit it on the head for me, like, it
was a it was a very good way of describing what we should
expect. Like what we need to do for
moving to the next level and that was a vet was very good.
I plan to explore that aspect father.
I think when I heard terms like identity fabric I get concerned
around okay zero trusts itd are all these other things is like
every product. Chuck seems to like, glom onto
whatever the term du jour is, you know, I see products like oh
we are the zero. Trust blah blah blah.
We are the you be a blah, blah blah.
And I see things like that and it's like I'd any fabric.
I've been hearing it for years and I'm concerned that at some
point we're going to see we are the identity fabric blah blah
blah. I think you can best do that.
They could happen. Unfortunately, a marketing
event. Ali, Khan's, everything and even
Concepts that have technical Mary will be strained and
tortured and their arms Twisted to fit a particular, go to
market, because that's the way it is.
Like capitalism rewards, people could sell and so people sell, I
think it's on us. The more fantasy technical
people to try to keep our Our our own marketing's honest.
And she's like, I think everyone tries to do that.
But the other is also when we engage on actual projects to
make sure that we do use those Concepts Beyond hype that when
we are working with our customers or with people that
aren't as deep as us that we help guide them through like
we've objective things like this.
Think about zero trust reminds me like a bit of a growth
mindset. Sestero like a Visa mandala
keywords that people use for and, and very often as just
abuse. And the way to diffuse that is
to just break down into fundamental components.
What makes something zero trust and then say, okay, let's test
this thing with you just said, is it really easier trust?
And you can't always afford that because Vector requires a high
bandwidth conversation in a lot of people just go with short
hands, because We are just doing things on passing, but maybe
it's okay that I could think of like a how people of torture
also things like a seesaw or Federation, like sometimes a in
discussions, you just have to let it go.
You're like you have to choose your bottle.
So the say that there is a cure, it's probably going to be the
same. I've only so much energy.
Is that what is that about? I want to fight.
Yeah, exactly. So let's talk.
Let's see, we're kind of there. Two different things I want to
get to. For those who don't know though
you are a fellow podcaster, we have the distinction of you
actually announced your podcast a couple years ago on our show,
identity unlocks. And for those who haven't heard
it is fantastic, you get to hear Vittorio having conversations
around. Really the mountainous grab this
like the meat of identity, the specs, the standards that are
being put out there that are so important to the
interoperability of so many different identity things.
Things I'm probably butchering how you would probably explain
to someone else. So tell us about it.
I unlocked certainly go and catch.
It will have a link in the show notes so go check it, it's
everywhere. But how is that?
Any locked doing yeah. Far too kind and you gave a
very, very good description on the show.
Like, the idea is largely the fact that standards have such
impact on so many things in the context of a day.
He and Beyond and at the same time they are just like these
are hard things to deal with people very often deals with
them at their wrong layer. Like they think that we have to
re-implement stuff from scratch. And so we need to read the spec
as opposed to knowing what the particular spec unlocks in terms
of scenario and then just using tools like sdks and services
that will take care of the low-level stuff.
And the other thing is that they standards like the
specification, Is typically are very obscure and also very
essential like, every sentence is debated by experts for
literally years. And so the end result is precise
but it's a bit like the Ikea instructions in which if you
don't follow them. Exactly to the letter you'll end
up with something that rickety and some extra pieces saying
what did I forget? So the thing is that the so much
goodness so much knowledge A part of the process of building
standards and that gets completely lost.
If you are not part of the discussion.
So the idea behind this show, which we don't always manage,
but we try is it to take the experts, like the offer spec,
which share of the working group and talk with that the same way,
which we would talk at the bar here.
At the end of the day, talking about what happened, what we
found interesting. And with us, we are very someone
He's not an expert and so we know that we needed to not use
too much jargon and somehow go to the real meat to the value
proposition running than the how more of like a y and the
context. And so we try to do is we try to
democratize. The substantially was specs in
front of people about what they what is their significance.
Like, for example, we use a better tokens everywhere and we
covered these New ways of securing tokens, you don't need
to know the details of how it happens.
But you need to know that now where is this capability?
That allows you to have more secure interactions and a bit of
a context of like how this thing came to be in what situations
you can use it in what situation you can't.
So we try to do this and it's a privilege.
It's a privilege because I speak with such incredibly smart
people which are very generous with their time and I think it's
going really well, let's say that there was expecting these
to be ultra Niche and he said the numbers are surprisingly
good. Like we have a lot of people
listening to this thing and it generates a lot of good
discussions. Good questions.
It helps the people that are developing or standards to get
the attention they deserve which often they get lost in the
noise. So it's going really well.
Yeah, fattori. I totally agree that people that
you're getting on the shores, For smart, sometimes I listen to
it just to try to get myself. Smarter, what I'm wondering is
for the, I am practitioners or maybe they don't need that level
of detail. If you kind of pick a few of the
major topics that are happening in the, you know, in this space
of Standards Evolution, maybe top two or three and just kind
of tell us what thing, where we're at with each one of those
Sure. Absolutely and fought at least
some of those. We actually have also episodes.
So if people want to double click, you can go there at see
that. The one Earth is top of mind for
me, is 5.0, Multi-Device credentials, which is the
scientific name of a more common name, passkeys.
And in a nutshell, that's in a new type of credential, which
Sure takes, if you're familiar with the platform of indicators,
in a fight or two, we're both on, which are basically using
the secure elements on your devices.
So the TPM on your laptop or like this viewer Enclave on your
phone and basically use that to authenticate using public key
cryptography unlocked by the Biometrics of your device and it
takes this idea, which was an extraordinary achievement.
The file Alliance but that was mostly adopted by either
administrators or key were information workers.
So not by the consumer because everything being tied to the
device, makes it complicated for enrolling multiple devices or if
you lose your device, you don't know how to record it.
So obvious was, always mostly either for administrators or a
second Factor because you need the first Factor if you need to
retrieve. And finally, I'm getting to
watch. Passkeys, our past is basically
are taking the same mechanism but allowing the keys to Rome,
let's say that what has the traditional platform of
indicators. Tie the key to that particular
device by Design. That's gonna diminish traitors
might want to say, I want to know it's coming from that
device because that device as my security policies on it.
And so, they, it it has its its own part.
Opposites. But at the same time, it made it
difficult for consumers and so vendors, like apple, Google and
Microsoft had this idea of making this finger wrong.
And so what happens is that now and just it today literally we
published a blog post on the other Ciro blog and wherever we
also have a little demo of our integration.
What happens is the vector? If you are in a particular
ecosystem, say the Apple ecosystem and a you got your Mac
which day you Ready, do if you install Ventura, you go on a
website. Let's support spassky's you can
and run in the same way in which were running before with a
platform of indicator. In fact, if you look on the wire
it's almost exactly the same that could be called, the
already have will work and you can sign up to your website,
basically creating a local key. And then as soon as you do, that
your iCloud will start roaming the skin on your other devices
and then you can pick up your IPhone with iOS 16 land on the
same website and as soon as you get on the website that I can,
one of the really interesting things of these is that there
are so many Primitives that make the integration of this
capability. Very, very easy in terms of the
user perspective. So if you would just stop on the
username field and if your website use the new apis that
are u.s. offers this finger sees that there is a passkey For that
particular domains and then just offers you a little pop up
saying, hey, even if it's very first time that you land on that
website on that device, you already have anything available,
you just put your thumb or do your face ID and you are sadly
very dangerous Real Game Changer in terms of getting away from
the password, right? That's what I was just thinking
that if that's the word I was literally going to say was the
is roaming, is the game changer here because this concept
already exists, but is very limited being able to move Of
from device devices. I think that that's the part
that's going to really take off. That's absolutely, right.
I think you're absolutely right. And this is above convenience
for Multi-Device, but to me, the main, the main thing is the
recovery because again, today, if you use platform
authenticators, you can't just use that as one factor.
The only thing you do for authenticating, then there is
always with discussion is in its both.
You have in something you are or something, you know, because it
has to be a key with leaves on your device and the way in which
unlock the key is either by knowledge the pin or biometric.
So one might say it's to say it is multi Factor but various
controversy about like you need to use attestation in order to
know that these actually happened.
So let's pretend it's just one Factory or although it's
actually too. But the thing is that because of
that and because of the fact that this side of the device, if
you lose what it was, if you buy new device, there is nothing you
can do to recover your access to a website instead of now that
this thing is back to the cloud. Basically, in that scenario,
apple is the party responsible to help you do a recovery or
like you buy your device and you just restore everything just
like today. When you buy a new iPhone, you
put them side-by-side and The just transfers everything, so
that's powerful and it Game Changer and a big Improvement.
If your starting point is passwords.
Now, the controversy here is that, if your starting point is
platform authenticators, then it's kind of like a step
backward because a now you can no longer prove that that
particular authentication is coming from that particular
device or you are no longer in control.
The way in which account recovery is done.
So if you are an Enterprise or if you have like a federal
government, first things might not be good things.
In fact that I could very are lots of discussions about it and
the thing is this is going to be very vendor dependent.
Let's say that we were saying standards like a standard part
is multi multi device credential on the fighting side but then
where is how the values platform?
Is choose to implement this stuff.
Anyway, particular case of Apple, they decided that once
they will release the new virtual server operating
systems, which is just about to happen here.
Then we will no longer make it possible to create Keys bound to
advice. So Passkeys will basically
everything will be a passkey even if you have a key that is
on that one device and did a ROM yet, you will have a bit.
When you receive a key that says, yeah, I am back up a ball
device credential, and I haven't been wrong yet.
So, you have some chance of checking, but the thing is that
you can't prevent this from happening, let's say that the
true. Now I received this thing and I
know that it hasn't Don't. But one second later, this thing
might wrong or apple has this feature in, which you can
airdrop credentials, just like you do with passwords today and
I remember seeing like WWDC happened at the same time as
their say and we were like a couple of black watch parties.
People like watching these things happening and I've seen
people in horror because that very say audience is clearly
actually what he did, what is it just like a haircut rough inner
and private key. He basically to a different
device. So again I'm a if you read that
blog post with I mentioned which I tend you see that the our
position is is a fantastic Game Changer.
In our war with two passwords for consumers but so much
remains to be figured out on the 14 side, so good news but with
moderation with once so what else and of course I want you to
hit on the digital drivers Son says, one of the items on your
list. Yes.
So let's make sure that we don't, we don't lose that.
The mobile driving license is also something which is
happening in this space is being driven by ISO, which is a bit
less familiar for us in the identity space and to myself as
well. Like I am participating as a
liaison on behalf of opportunity like the openid connect
Foundation is Working with them. And in particular, for example,
Christina yes, udah from Microsoft is one of the main
people that is one thing with that and basically they're
trying to make the use case of a mobile driving license, used on
the web rather than impaction with devices to be done with the
experience that many years of about you connect brings but
just to summarize what this thing is this thing is a
Different of you are joining license in a format that can be
used with digital devices. So IG digitalization of your
driving license and a Visa is defined as c bar, which is like
a digital digital Json set. The batter in not digital,
sorry, binary, binary format, which contains the least of your
claims say and then it has a mechanism, which ties Sighs was
claims to one key which is only yours and only belongs to your
device. And so whenever you use these
with driving license, you can basically use the data that you
have on your device and disclose was proving that you are the one
disclosing it because you use your local key without the need
to go to any Central Authority, like if you'd be doing these
with ID token. So let's say, then every time
you have to present your driving license for some reason, you'd
have to Back to the provider and the provider with issue stuff
just in time. And then the provider would know
to whom you're going to disclose his finger.
And when and in what terms and instead by using this mechanism,
which is conceptually the same as the one is verifiable
credential, which is another of the things which is being talked
a lot about. But when people say that 50
credential, they often think about things, like the w3c
standard, which is a specific standard With a specific
structure and the mobile driving license is similar but not
exactly the same. What we concept is the same and
so it is a very powerful privacy-preserving capability.
There are challenges. Let's say that the in order to
do a trick that I just described you need a client software.
Like if you just do this with an ID token, you just do a couple
of HTTP redirects and you'd be done instantly not in here.
Now, Need one it and follow it. Right?
Where scan it. Seemed I quote because a while
it is such an overloaded term recently, but basically you need
a piece of software that runs on your device, which is capable of
requesting, but it's things. Those are like, verifiable
credentials /. Mobile, driving license.
Save it in place. So you keep it stored protected,
and whenever you need to present it, You do with three curved,
selecting the subset of things that you wanted to disclose, and
use the key to prove that it's actually coming from you.
And then, once in a recipient receive this think, there are
two parts in which you have to verify that this thing is
actually coming from you, so they need to check the signature
and they're typically the signature as a reference inside
the part which is sign it from your with claims that the ties
was the things together. I know.
I am getting in the Weeds now but unfortunately, some of these
things are just like advanced level if we were able to apply.
Well, let's just say that you need to have active software,
which runs on your device. The software is absolutely
critical, and it's not there. Like mobile driving glasses is
not the only reason for which has people might want to have
these software in there, which is why we had so many different
definitions of wallets which are largely interoperable and non
interoperability. This time and so they're like
they're in number of nascent groups or a number of electoral
alliance between companies that are trying to make things
interoperable. But at the same time, a lot of
the issuer's of us Wings want to retain a high level of control.
And so you can expect that some of those credentials.
Maybe not my mobile driving license, but some of that ilk
will give you also the application.
So basically it's like having a wallet for every card you have.
Didn't anyone if we multiple cards?
So we see that early days we need to see what happens but
like a lot of things are happening in this space and we
spray that last point you made makes me think I'm going to make
a statement in which is from everything you just described.
It doesn't sound like the mobile driver's license is going to be
following decentralized ID. In other words putting it on the
blockchain. Is that right?
Is that Not the direction that things are going so is far as I
know, there is no need for anything decentralize.
This simply are you dissing blockchain just kill it.
But if this is the case, if this if it's not going to happen for
digital driver's license, where's it going to happen?
He said landmine aware that I very rarely chooses to venture.
And this isn't going to be an exception.
So I'm gonna give you a very non-committal, very high-level
answer. But in particular, in this
particular case, this is one of those cases where you have an
authority, which is the department of driving licenses
or which is offered it--i've about whether you can drive or
not and that has been responsible to verify Your
identity. And it's actually self-defining
that when they usually think. So, to me, having the
identifier, or like the key material that you use for
protecting presentations of the sink wouldn't buy you much,
because sure you'd have your identifier that is entirely
under your control, but that would the only protect the
presentation in which is you show singing.
Yeah, I am the legitimate owner of this thing.
All that lack of these identifiers but if for some
reason they catch you driving High and the revoke your driving
license. And so the inner part of the end
of the presentation, which is the one that says yes Jim can
drive and he's over 21, it's no longer valid then having your
identifiers to check out won't help you.
Like if you were presenting with finger because you were banking
on the or forage or You sure of his attributes, then it won't
pay you much and internal infrastructure.
It's non-trivial to choose what use when we're and similar.
And and that's just on the holder side.
Then on the very Fireside, things got even more fun because
in a traditional scenario in which you'd ever like you order.
ID tokenism mentioned earlier, what would happen is that the
receiver would be fixed. Let's say that your provider,
the issuer knows the audience to which you are sending this thing
too. And so in the in Via Our
receiver would be in a trust relationship with issue.
Let's say that the moment in which to establish your
relationship, your choir with keys that you need to use for
verifying the, the signature, and all of that stuff.
Now if his word in which you receive your credential on your
device, and this credential is not bound to any particular
verifier, you can spend it with anyone.
The moment in which you sent your the URL presentation, the
verifier needed to take this presentation and verify that the
content actually comes from that particular issue.
And it's not obvious how to do that, because I guess who's
going to issue this thing is we're going to be like one giant
ether for everyone. Already going to have every
local department of driving glasses.
Every County that issues is something and then, are we going
to have all the different Is are an echo.
How are you gonna handle this like a Visa freedom of talking
with anyone? And everyone comes at the price?
So that being less rates it which again, you wouldn't tell
if you would be establishing trust relationships for
directions and similar. And so there again, honestly, I
have reacted to start the digging into the details of a
spec, but it's perfectly possible, that one solution
might be bi Ki welcome to 2020 zoo, in which you might have
Like one CA that issues all was activities and then anyone that
wants to accept those things. Can you say except I think
Society, the by that Thief is certificates that come from that
particular CIA. Even if it works that with be,
for the US, for one particular document and now multiply 24 by
these documents with various countries here at Gardener have
seen one session about decentralized, and I'm not gonna
say almost anything about that session, but the one thing that
I've seen, that have seen, which is a lot of entities was Visa
the of trust Fabric, in which people are just published Sounds
on these trust Fabric and somehow people put stuff in and
out. It was very unclear to me how
that would actually work in practice.
And unfortunately, it's a pattern because every time
people talk about this particular aspect, it's kind of
like, you know, that episode of South Park with the Underpants
ignorance, which we are big nose.
It's a step one. Collect Underpants, Step 2
question, mark. Step 3 profit.
Is that good? What happened between?
In was two steps. I don't know.
And this time also these addition of a graph that I am
didn't answer these question of mine.
I think there's so many questions so let's just that's I
think that's the issue is. There's good questions and there
aren't any good answers yet. I think like that the identity
Fabric or mesh that you kind of refer to just now where you can
publish anything to it strikes, me is basically what we're doing
is we're creating a Reddit for identity where the people have
to upvote and downvote. Oh Sources.
Do they trust? That's a very interesting way of
looking at it. I think that the challenge is
that we just like with baskets the exact same technology can be
an improvement or they can be a step back.
And so the thing with you just described which is a also pretty
popular in certain circles, like the social proofs, which wears
a, it's a clever mechanism, which will work for some
scenarios and would be completely unfeasible for
others, what you trusted, 40-acre passport, right?
Here's the first, here's, you know, here's a government
saying, oh well, you know, somebody just decide to spin up.
Our own passport service enough people are using it and say it's
good must be okay, right? I'm sure that's secure.
Luckily, that none of these is, is going to be a problem for
their driving lessons. I think with the the driving
less is being designed Again by the iso people which are among
the most rooted in hard, the have the core reality than even,
you can find. And I think I'm very, very happy
that the vast thing is happening.
Okay. I think of it is like the
paradigmatic artifact that can embody the verifiable
credentials like anything to be clear.
But with verifiable credential concept is a great concept and
it's just that a bit like what we were saying earlier about
marketing taking over, it's not only marketing.
Like sometimes also like technical people will get really
enthusiastic like I'm not saying there is any ill-will from Side.
But people will fall in love with an idea and push it without
necessarily having figured everything out and sometimes
it's fine because that's the way which share Innovation happens.
Some other times, if you are postulating and here, there will
be an Antigravity device. Well, if everything hinges on
you, discovering anti-gravity, that might be complicated.
So that is my only criticism to that.
But again, I love about dropping by licenses.
I love the concept of the sees. What I don't love is people
ignoring some of those details and then misleading, the people
that are not in this space because when you sell a really
nice story, which is, it is a nice store.
Like the idea of like you are in control of your own credentials,
you choose when to disclose and to whom and people will not know
about it. You are a huge truly is a good
story. But there are complications and
all this is not the entire story because a lot of privacy issues
happen at Sun in time but in my experience with bulk of it
happens when they observe your behavior like you could sign in
with incredibly secure privacy-preserving system and
then you buy something and you need to disclose where to send
me stuff which suddenly can be correlated to lots of other
things. I can almost see like the zeros
here live here in the integral here.
Very solution X4, B problem. Sure, absolutely.
But is it practical? Are you volunteering this
detail? When you are saying, this is the
end of centralized that's very thing that if a credentials will
unlock new scenarios that are difficult or impossible today,
but they will not necessarily substitute some of the scenarios
that are working well today and Said, you like it again, people
like very bright lines, primary colors, basic shapes, and simple
messages. And so, the idea of like this is
the next Evolution, which entails will stop doing what we
are doing. And we'll start using was tools.
Instead, again is misleading because some of the things that
are at has a privacy violations, in the concept of the in the
context of a consumer. Our activity can actually be
completed by Design when you are working with two suppliers and
you do need to share some information.
So, it's just a complicated thing.
I think that's where the magic comes in right, when it once, it
becomes easy enough for people to adopt or there is some sort
of cohesion between these different concepts.
You know, I think I met, I'm not sure who said it right?
But, you know, it's if it's magic or technology, doesn't
matter. As long as the result write,
Like that. So it's a 4C Clark.
It said any sufficiently advanced.
Technology is indistinguishable from Magic and I agree with you,
but one thing that I would add them enough.
So parenting is that most of us things to me are driven by use
cases as in people have an issue in very life or something that
they want to make progress in and it doesn't matter how sad
Something appears on the scene and had spent with that
particular problem. And in this space we are all
guilty of being so close to the matter into a domain.
That we often said, look at the principles and we say, OK, here
I have these new principal users must be able to control
absolutely everything. And what these website the saves
about website. Sure, and the outcome is some of
us have cookie dialogues that you see for European websites
that And they're only outcome is people just clicking okay to all
because like whatever. So if you just start with the
principal and then when we rubber hits the road, things
might not pan out the right way. And so I think that the the
pendulum has to swing a bit closer to the use case for some
of those things so that we can focus on what we can actually
do, to help the people using those new technologies.
Rather than saying, oh wow, this technology school.
I want To use it. You're such a great point is,
it's really important to step back and think about things and
kind of that philosophical way, which I think is always been
part of our industry, right? You can't just look at the
Tactical of. How do I do things?
You have to be thinking about the big picture.
I read a big picture and the people that will benefit or not
from what we are creating again. A huge fun of Suggesting to
Engineers with Award with to spend the time on forums and see
what people find it difficult, even if it's still at low level,
it always gives a glimpse of what people are trying to
achieve when you are using your tools and it's always better to
start from it rather than starting from technology and
then at a vadas engineer for me to what people might possibly do
with it, sometimes you're lucky like a remember the page rank
with Google. Okay.
When Google started then the pagerank.
It's that was incredibly successful, but no one knew how
to do money out of it. And eventually they discovered
it and I'd say, they lucked out because they didn't start with
this idea of making money, but eventually found it.
So, moving one level below, it's always possible to create a
technology and by sheer chance land on the create new use case,
I think pasta it's like we grew up, boss is very Trying to do
something else. They invented the positive,
that's fantastic. But those are rare events.
It's usually envisions better. If you start from a user need,
rather than a technology or a high horse, principal same
applies to Identity programs at large, right?
If know where you're trying to go and what you're trying to do.
A lot of times just like, okay I've seen before, right?
I would just bought this thing and that's going to solve our
problems. But you don't really know what
your what prime are trying to solve and then you're very
disappointed when the I know that the investment that you
made didn't line up with what you're trying to do.
For me a knife. If you'd rather die, always a
activate featured spinner, another one featured, Spinners
were everyone and I can, yeah, why I've got a cool one.
By the way, it's I have to as a tussle and I have and then I
have one that has lights at the end.
Well, I got a conference somewhere because it's like you
said, they're just paintings were everywhere.
They were like the swag thing back in like was it 2015 maybe
something like that. And I was like, all right, also
come to that one because that one that Was one I hadn't seen
yet. Then it's all right.
I think we've wax poetic around a number of different topics
guitar you're always great with your time and super generous and
super approachable which is Again part of the thing that I
love about the identity field itself.
But before we go I want to tell you that you have enthralled,
the identity Nation through your Twitter and this undertaking
that you took, when you before you even boarded the plane to
get here, you have a Co 2 meter and we're taking readings
throughout your journey here. First of all, again, in thrall
does the word of use because I've been following and looking
at your Twitter, it's at vibro net and you can see, you know,
the different readings. First of all, how did you come
out this idea? And then what were some of your
findings of your research here? So I stole the idea, I am Park,
okay? I told the person I'm still in
here so it's ok that if I well I guess the guy did liked the post
so I guess you have to it was. Okay.
So I'm part of a few Facebook groups of for frequent Fliers.
And one guy did this on, on the play energy a day like a, he had
a meter for proper reasons not to, like, adjust for a being
funny like I did, he is like his job.
That is like he had a number. Of it m on board and said, well,
I would be fine with to see what happens.
And so I did this post, which I found super interesting and I
said, dude, I'm going to see if his idea and I'm going to do the
same when I go to guard Elijah. So I hit Amazon and magically in
two days. I got this thing.
It was like 40 bucks, just so not particularly and finest.
Funny story after I started publishing the sweets they run
out of it because I kept having people saying oh okay won't run.
So they actually bought the enough of those from the
viglink, whether provided that they run out of it, hopefully
use like an affiliate link or some sort of referral link.
I'm not sure I might add because that guy do have a affiliate but
whenever I go on the website and never know everything, that's
it, but I found it. It's really interesting because
frankly I was surprised by the number of the things that I
found out like in particular who burn the Uber, which I took for
for going from my home. The Redmond to the Seattle
Airport, I got to almost 2000 which was like the highest
reading on the entire trip. And so what's let's establish
because people in a familiar what is Baseline like what is a
good number or good reading essentially?
So I started with my first reading outside.
They saw it was outside in the breeze and the and 400 and 400,
which like someone said that if I would have done these in the
cell, 90s. I would have been likely 200-400
because like there's almost cars.
And also, why did they do this with CO2?
They suit you to me is in many crowded places in a proxy for
exhalations of people. Hence potential potentially
covid risk. Like a a came back from a
diverse and a coffe coffee after her dodging, it for two years
and a half. So now I'm a bit sensitive.
I was always Stephen matter. But like really curious about
it, it's an imperfect measure because CO2, comes not just from
people, but like, in the Uber and convinced it was the exhaust
or a car at was going inside the car, which is not very healthy,
but also deck. There, the mass we face mask.
Want help with that, but I worried anyway, the other thing
is that you might ask still have a high level of CO2, but you
might have a keeper filters that take away the bad stuff.
Of and so high level of CO2 might not necessarily mean high
levels of potential covid. Let's say but anyway,
approximation. Also I did it for free.
No one paid me for doing it, so, whatever.
So that one was the interesting and and so the design is like
around 400 and then in an Uber was like, went all the way to
father as soon as he closed the windows.
Okay, energy. It was like 600 or so close the
windows started when soon. Went to do a deposit.
And then they think that was surprised about was, how well,
ventilated the airport was like they Lounge.
They like the public restrooms where, like, 700 800, which is
not great via the restroom in the lounge elitist.
It was a much lower. It was like a below 500.
I think the lounge was like, 500 600.
The gate was lower than launched with the literally Breeze.
I posted a little Video of my hair moving on and if a plane as
you might expect, the values went up during the boarding.
So during the boarding, if you want to wear masks, let's with
time in which you should wear it, well, I know it's like
people so also people can attract organizer which is good
but then as soon as we close with your and we went up, as
soon as we were in altitude it drops down.
Hmm. And then once we started What
the scent again I guess what we do something with specialization
and it started climbing back up. So that was that was also
interesting. And then now I am I I tried a
chat readings during the conference.
I didn't publish it because I didn't want a gadget freak out
this anger. This guy now is get him out of
here. Yeah but it was actually really
good. Thank most of the time.
It was like 500 600, which is a very good for anything.
Close the place was only one particular session which was in
it was a vendor session and it was in a smaller room with a
weird layout, it was a very wide and very shallow and there I got
to 900 but that was the only place, otherwise talk safer than
being in an Uber. Oh yes, definitely safer.
So, it was a fun project. So I think there's like a Snus
like, seal of approval and I can picture like a little sticker
with like, Your face on it, maybe the hair blowing in the
wind and then like a number that's like oh you know this
this session or this conference or this room is you know
Vittorio approved or something like that.
He ho to look low CO2, Vittorio prove.
Yeah, something like that. And love that.
I'm gonna go on zazzle.com and get the stickers, ready?
Yeah, there we go. Make sure you are well, I'm sure
we'll see like this, the shop link on Twitter?
Yes, Josh, I want to just follow up with something.
You were saying about this area being generous with At this
time, we say that a lot because everybody is very generous to be
on the show but I also want to just point out that butter is
not generous with this. I'm only to us but to everybody
and I sat down at a random to a random table for breakfast this
morning like I always do and you came up right because they want
to know who's going to be on the podcast today.
And I said, if it's Oreo and they didn't really know you, but
they do who you were. This is just go up and talk.
On like he's one of the most friendly people out there.
So this podcast kind of Time Capsule.
I think if you're listening to it and going to a different
conference type of tutorial is going to be at and maybe you're
like I'm a little intimidated because I don't know him and you
might not be friendly. No, you're wrong.
He's very friendly. Go up and say hi.
Thank you. Thank you.
I'm always happy to talk with people and I have to admit that
my ego swells. Every time someone comes and
takes a selfie Be with me and I'm so spoiled because at every
conference almost every day it happens and I always ask them to
tweet it but they usually say, yes I will.
And they don't I always feel about.
We're going to take a picture and then I will tweet it.
All right. One down, thank you.
Oh thanks. Alright, anything else you want
to cover? No, it can we let Vittorio out
onto the town? Let him loose upon Vegas, we
will let him loose, okay? All right, Victoria.
Thank you so much again, for being part of this really do
appreciate It looking for the future conversations, check out
identity unlocked. It is a very good podcast and
I'm not just saying that, but it is something that adds a lot of
value for folks, and I think it's good for people to kind of
see different perspectives, get into the Woody weeds little bit.
I will admit sometimes I get a little bit lost and sometimes
I'm learning that little bit through osmosis but at least I
am picking things up and I feel like I'm more conversant around
a subject that Victoria is touched on.
So it's definitely worth it. I don'ti unlocks find it
everywhere that podcasts are at. Basically, thank you so much.
You can find us on the web. I don't eat the center.com on
Twitter at IDC podcasts. Take a look for a further
picture that will be posted there.
You'll hear this far later than when that picture will go up,
but appreciate it. So with that we'll go ahead and
let everyone go. Thanks for listening and we'll
talk with everyone in the next one.
Thanks for listening to the identity at the center.
A podcast if you like what you heard, don't forget to subscribe
and visit us on the web and identity at the center.com.