This is identity at the center. If it has anything to do with I am this is the go-to podcast. So if you're a beginner or an expert or anyone in between you've found your new home welcome to Identity at the center now your host Jim McDonald and Jeff Steadman Welcome to the identity of the sender podcast, I'm Jeff. And that's Jim. Hey Jim. Hey, Jeff, how are you?
Oh, not so bad yourself good. I was wondering, do you mind if I start the show off with a complaint, it wouldn't be an identifier podcast of the last, like three months, if you didn't. So my complaint is around the idea that okay, you have a pre-production environment, you go through testing, and then you go to production and you start finding Errors, really. What the hell? Why didn't they just get caught in pre-production testing?
Because they didn't match. Yeah. Well that's usually the case, right? Yeah. Is like your pre-production testing environments like one server node load balancer. All that, you know, yada yada yada. Yeah. You hit the nail on the head, but in this almost like a been through that before you've been through it before, but you know what? I was kind of like mapping that to was, we talk a lot of times about what makes a good entry into I am. And I think, you know, Fundamentals of being an it.
That's a good starting point for identity and access management. Yeah, I mean, I started at the help desk very very very long time ago, back in a galaxy far far away. And so you know, moved into and I am operations rule certainly got a lot of exposure to all the things that can and will go wrong, especially as the help desk, which is always been my pet. Peeve is when things get rolled
out. And they forget about operations, like, oh, well, just have help desk, or service desk or whatever your first line is, Right deal. The issues that come out. So I make it a point to make sure that those folks are included, you know, when we're doing work on the real world. Yeah, I give a shout-out to Andrew Cheng the phone who was a guest. On our show feels like centuries ago and he's kind of dedicated himself to, you know, a YouTube channel where he kind of helps
them doobies kind of understand. I am, and I say what I mean by newbies is newbies to, I am so wherever And they're starting point happens to be kind of like a what are the single sign-on what is identity governance and administration, what does privileged access Etc? And someone can watch a video and kind of get up to speed on those things. So, check him out. And through to Andrew chat, the phone is on the identity of the sender podcast a while back and he's got a great YouTube channel.
Yeah, actually, referred Andrews channel to my new friend, kozara, who is looking to, potentially, get into dining space Well here's here's someone who's certainly spent some time putting together trainings and kind of demystify ocation of some identity things. So difficult. So person number one resource is the identity of the center pocket. Let's not forget about that.
Yeah. But you can't watch us which is probably a good thing for everybody's eyesight so you can only listen, at least this my unless you catch us live when we're at you know like we did at Gardner which is a lot of fun where we're going to be doing at identification. A few weeks which is going to be fun as well. But yeah, we're for the most. Part Audio Only. Yeah. Looking forward to identify verse. I mean, besides kind of scheduling all the Fantastic guests that we're going to be
talking to it identifies. I've also been the social planner. So anybody who's out there, who wants to hang out with Jim and Geoff. Reach out to me. I offer reaching out to me on LinkedIn, just saying, hey looking for stuff to do and I'll let you know what we're doing anyway.
And certainly if it's possible for me to Like your long, I'm not sure which of the events will have control over, but certainly, one of the great things is that we're going to be doing the podcast live during the opening reception just outside the entry to the expo hall.
So if you've ever wanted to see the podcast, be recorded will be there, we're going to have some great guests, who just going to drop in, let us know what they're looking forward to in the, in the conference and things like that. I think would be a great opportunity to kind of just you know play a part in it. I'm sure we'll come up with a few questions and ask for hand raises and things like that.
Yeah so it's kind of a weird thing to say it's like we're going to be recording it live in front of a conference audience. Maybe I'm not sure what that's going to look live studio audience. Yeah, it'll be you'll watch this record, we're going to be. I think we are scheduled for 7:00 p.m. Tuesday night which is May 30th. We're supposed to go, 45 minutes. We'll see if we go along there's plenty of stuff going on so we do want to keep people away but yeah we got some some cool folks
on a come through certainly. You know if people want to come check us out while we're doing our thing and you know maybe get a microphone shoved in their face, he like be feel like being, you know, on the show as well, you know, certainly think about how we could do that. But I'm glad you mentioned identifies gym because we have partnered with identifiers for people who aren't familiar. It is coming up. It's only a few weeks away. It's heading to Vegas.
I don't ever 20:23 is coming. Join the digital identity community at the Aria Resort and Casino in Las Vegas, May 30th to June seconds. Jim, as you mentioned you and I are recording May 30th at 7 p.m. just outside the expo hall. You're going to have me stuck in a room for, I don't know. 700 different recordings. It seems like they were going to
be doing the we do that. We had a we had a messaging exchange where it was kind of like you're like trying to spec some time to actually work on the Pikes and like we're going to be in Vegas where you just a touch. Now, Fred say, I don't even know, like we're gonna be recording when we're not in like Keynotes or stuff like that from, but it is, the must attend annual event.
That brings together over 2500 Security Professionals for four days of world class, learning engagement, and entertainment as an identity at the center listener. Which is you, you're listening to this, you're invited. You're able to receive 20% off your identity verse twenty. Twenty three tickets, using the code idv. 23-0, icen. 20, you can register identifier, Scott, Cam tickets are going fast. Want to get their hang out with genuine self, hang out with
other people. In the identity space I'll have a link in our show notes because there's an easy click that you can do to just click there and we'll put the code in automatically and actually that helps kind of support and support the show to. Right? Kind of shows, people are listening to our drivel every week and talking through identy things. And we hope to see people there. What do you think? They just doesn't just benefit the show.
It benefits. The people use the code because I think I've looked around Four different discount codes. If you are going with a bigger group and things that I haven't seen a discount code, that's any better. I don't think I've even seen one as high as 20%, so from what I've seen in my limited research, that's the best discount code available. Well yeah, I mean those are saying I mean, identifies people been really cool.
We had Andy and you know, not too long ago, kind of gave a preview on that and there's gonna be a lot of a lot of really welcoming and You know good folks that are attending. It's good spot for both Neo newbie and Veteran alike to kind of, get in congregate, learn some stuff. And yeah it'll be a fun time. So I'm looking forward to it but it's been a whole month since I was at a conference. So it's time for another one. What are we going to talk about
today? Jim, because I know that you were instrumental in getting our guests lined up for today and I wasn't quite sure what to call this episode.
So you could call the episode something around I am user experience or User Journeys, as I've been calling it a lot lately because it's kind of the idea behind, you know, giving a terrible user journey to go ahead and register your account or change your password, or manage your profile or one, that's matches the rest of the web environment that you're, you know, going to be using. So anyway, that's that's kind of my thought. What were you thinking?
Well, that's way too long. First of all for our show title it's got that But something a lot shorter. Like something like I am. You xor like B2B b2c bde. Be 2x. I am ux, I don't know. I've got a kind of figured out your perked up when I said be 2x B 2x, I think you should. You should stamp that you should remark that. Yeah, trademark yeah, yeah, okay well let's get into it because we've got Larry King on. He's the vice president of product with serve acity.
Welcome to the show Larry. Hi everybody. Thanks for having me on. Yeah, thanks for joining us. And, you know, looking forward to Relation today, you've got a lot of background in actual product design and I'm sure you can tell us what's wrong with I identity user experiences, but this is the first time you've been on the show. So we like to always find out a little, about the backgrounds of our guests. How did you get into the identity and access management space?
Is it something that you chose, or did it choose you? Yes. So yeah, like you said, I'm from a ux background instead of a technical background like a lot of product people are So Jim when you're talking about customer Journeys and user Journeys and stuff like that that my ears perk up because I'm glad that the vernacular of the user experience practices, it's gotten out to other people as
well. And that means that we're being effective as a ux journey or a ux community of getting out the message that these things are important. But yeah, so I'm I started out in user experience early 2000s.
What did a lot of Consulting work in like Guy worked at, you know, one of the big, you know, five Consultants did worked at a smaller agency and then I got, I decided that I really wanted to get into internal product teams for in ux because I saw the incentives and Consulting were more like, you know, sell hours rather than make product better. So, I wanted to make product better. So I had a somebody acquaintance that was running. The ux department at a little
startup called mandiant. And we and it was, you know, there are security company. They do incident response and they had product security products controls and things but I had no idea what security was at that point. I thought I was going to be working on login screens when I went to an Indian because I didn't know any better.
And then I quickly found out I was going to be working on this instant response product for endpoint security and as like I learned a lot about Windows internals that, I didn't think I would ever need to know, or want to know. But I learned them very, very quickly. So I started making, you know, designing products for incident responders and then when Keith and Steven moved on from, because that's where I met Keith.
And even the founders of sebasi, I started working with in there and they went off to a company called secureauth where we all work for a while. And we worked on, you know, bde Workforce identity there and Workforce. Any product and then went away from there. Went back to a fire I which had been brought in by that many had bought in them and then I came and then Stephen and Keith started. Strove a city about three and a half years ago and I've been with them ever since and so, I
don't know. Yeah, I was gonna say I just didn't, I didn't choose identity. I just kind of got into it because, you know, the people that I work with and trusted and and got along really well with were the where the That kind of went into their kind of follow them along. So here I am. That's been my running thesis, I think you know a lot of people fell into identity not necessarily by choice but sort of like by happens to it happen stance.
And we did have Steven on back in, I want to say September 20 21 I think was episode 112. So if you want to learn more about Steven and kind of what he works, over the works on Mister vassily, but for those who aren't familiar, with strove acity, you've got people now give us like the 60 second elevator pitch. We don't want to be a Commercial for, you know, for sure of a city but at least give people some awareness of what are what do you guys work on?
And what are some of the, you know, the the solutions you bring to the market? Yeah, absolutely. So we are we, you know, we started about three and a half years ago so we're very young in the industry compared to some of the competitors and the but we were purpose-built for identity management when it comes to customers. So see I am is all we do. We don't do you know, bde we focus on b2c and B2B use cases for I am will talk, you know later about what the differences are between those.
But we, you know, our elevator pitches. We believe that remarkable sign-in Journeys are forgettable. In fact, we even sometimes, if you look at our press releases, it says extra Varsity. The company aiming to make customers sign in turn, he's entirely forgettable, which I love that line. And we mean that forgettable in two ways, it's forgettable for
the Brand's customers, right? We want to make their, we want to have less friction as little friction as possible when they're going through the login and registration process because they're not there to Login and register their there to do, you know, something with that particular brand. So we want to make sure that we are not the roadblock.
We are facilitating a forgettable experience for them because they don't even realize it were there but it's also forgettable for our customers when they deploy us a lot of times when you're putting in big enterprise software, it's a big lawn, painful process and we want to make sure that that process is not something that people remember forever about how terrible was they forget about it because it was so easy.
So again, And we think, you know, identity and Workforce are do different things and that's why we focus on customer size of things. And, and that's because we learn so much at the BD or the the business Enterprise, the workforce. I am that, we worked in trying to force those use cases, that that platform is built into into customer. Use cases, was very, very difficult, very, very expensive, very, very painful.
And so that's why Keith, and Steven decided say we can do customer in a different Way that's much easier and much better for the market customers. And so you're a VP of product which is an awesome Title by the way. And if I wasn't watching Breaking re watching Breaking Bad, the moment I would have different thoughts on that. But what does a VP of product do in an identity company? I mean, obviously got the user experience side of things, but is there, is there more to it than that?
I would say. A better question is, what doesn't PP product to, especially in a start-up? Like, we are. So I wear a lot of hats. That's so, but I, you know, I run the design and documentation team. So the, you know, the, the customer experience when it comes to the product and the
documentation of that product. So I work closely with engineering, obviously to set priorities helps translate those customer needs into feature, just definitions for, you know, engineering teams, make sure that we're trying to get as much good customer information into the The engineering teams themselves so that they can be autonomous and make really, really good decisions. As opposed to me, making all the decisions and being the bottleneck for that.
I'm a big believer of getting the information to them as much as possible so that they could be autonomous, we do that, I do demos I you know I work in. I do Solutions, engineering for customers. As we're going through, boy, do analyst meetings, I do vendor management, coordinate, marketing, and customer success in four releases, Poof marketing, I do podcasts and write blog posts as well. So, again, I do a lot, a lot of stuff, but especially since
we're a start-up. So that's my that's my day to day. It could be anything which is what I love about it. Really? Yeah, it sounds like a fun game. Kind of get to dip your toes into a lot of different pools. I'm curious about the analyst type of things, I guess, from a, like a briefing perspective of in my imagination and run something like hey, you know what, analysts XYZ, whatever company you have.
To be from, you know, we'd like to kind of give you a briefing on or maybe they might ask for it of the products that what are some of the questions that they ask, and I am Thunder like yourself, you know, dudes? It's is it feature-based, is it, you know, kind of run the gamut any kind of pull back a little bit. It's probably a little more Feature Feature based than I would like it to be honestly because, you know, features are like the, the trees.
And, you know, really I feel like when you're talking to analyst, you should be talked about the Forest. Right? You know, like you know what are The high-level problems and what are the things that we need to be doing, you know, at a high level to, you know, to address those issues in the market and then what's coming in the
future, things like that. But then when they get down to, it's like, oh, if you don't have this thing then we're going to Mark you you know down because it's like well that's a feature that our customers. Don't even need at this point or we're not even getting demands for that. So it's a little weird when we talk to analysts because, you know, they expect certain things that just maybe not isn't really relevant for our context, but they'll didn't you in the report
for that? That's interesting. I think, I wonder how much statement, you know, a statement like that, where our customers are asking for it and it's sort of a use case or a feature that really doesn't have rounding in the real world how that influences, you know, both the
analyst thinking. And obviously, you're not on that side of it. But on the product side when you hear things like that is that you think like okay well I guess we probably should think about maybe putting that in or do you stick to your convictions and say? Well, I don't think that's important because we want to focus. Asan. These three or four or five other core functionalities. I didn't make that balance. Yeah, I think I have to consider
a lot of different things. When we talk about, you know, making product decisions and roadmap dishes and things like that, an analyst is just one of them, obviously, you know, we, you know, the customers and Prospects conversations that we have are really key to all of that as well as what we, you know, as a company believe. And and you know what our strategy and go-to-market are so that you know, there's a lot of
influences. To, you know, the product decisions that we make, you know, how we're going to go to market. You know what, you know what, industries, we're going to focus on, you know. And you know what analysts are saying about what's going on in the future? Because you know, analysts you
know, things are important. You know, we actually were recognized as leader and Forester and it's because I think our vision for customer identity and the vision that that that analyst has is very, very very, very similar. And so I think that's good validation from our point of view that, you know, we're Doing the right things, moving right direction. So Larry, given that you had that good review from force or mean. How impactful was that for you guys?
I mean, is it important to be at the leader side of an analysis? Absolutely, especially a Forester one. Apparently, that's really influential in in Europe and you know, about things outside the United States. So we've actually had we've actually had two customers that were directly. One of them was in in And because of that, and the other one was, you know, a pretty big step in their decision-making to go with us.
So we've had and of course, that's really kind of blown up our pipeline as well since that was announced in November. So it's we've had good success with that. I saw that report came out and I mean, you guys kind of came out of nowhere to be all the way at the upper, right? Which kind of like, you know, for a lot of people are probably like, who's the strong fast. City next to like you know whatever it was like octave Microsoft or what? Or I don't remember Wing em and rack for truck.
Gotcha, both the Thomas Bravo company's so it's based its us and Thomas Bravo like duking it out up there. There you go. I think they I think they got you by a few pounds. Yeah. So let's talk a little about, I guess user does user experience and design and Journeys and things like that. And let's start a very high level. What's wrong with user experiences today and identity and access management know where he use cases are flows, you're like, oh, that's terrible, we've got to fix that.
Well, I'll tell you what, they're much better than they used to be right. You know we've collectively learned as an industry you know, a lot since you know the 60s when we first started having passwords on digital systems right? But I think the I mean down to fundamentals I mean I'm going to just going to you know come out and say it's like it's frickin passwords like passwords are so
bad. If somebody did a human factors review of passwords and how to use them effectively for humans, it just it would never pass the test because the only way passwords are secure is if you have a unique, lung complex, non memorable, characters, string of characters, on every single thing you need to log into and this is just fundamentally at odds with the capabilities of humans, right? But yet this is what we force everybody to do, right?
So and you know you know the solve the problems that we have with passwords being insecure. A lot of them is a lot. The reasons that pathogen secures because a human behavior not that you know passwords are inherently insecure. If you you know do all the things you need to do to make them secure but humans just aren't compatible with that.
So and then like all the misinformation around passwords and what's the best practices is, you know, isn't helpful either, you know, you still here on a regular basis that, you know, you should change your password regularly leg. I complain about this in my kids school all the time because it's like they have this thing on the wall, says, back. Good password, you know practices and one of them is change it regularly. It's like actually no that's
actually not, right? That is that one of the things, in fact, missed even you know, recommends Don't force people to do that because that forces people into bad habits that make, oh, you're that Sperry even worse, right? Oh, yeah. I know. I am that parent. So, you know, so that's one thing. And then another thing that just drives me crazy and and really is a debt. Little to experience is like when an your identifiers not something that's unique to you, right?
Like your your email address or a phone number, you've got a lot of Legacy companies and you know, just going to be General using like just you know random you know usernames and then if they're persons user name isn't available, then they have to change it. And then when they come back, they don't remember what it was. And, and like organizations. They only see, you know, themselves and it's like, well, you know, it's not a problem for us because, you know, we just
You know, this is our thing. But this is like you're not thinking you're thinking about your company but not all of the other things that a user has to log into and into, you know, to
live their lives these days. And so you don't you don't see that and so they make these decisions like oh yeah we'll make a usernames just you know, whatever but don't let him use emails or their phone number and then you know then people have problems remembering what they were so those are two of the big things that are just Really, really hard to get rid of.
I mean, obviously there's some, you know, things about passwords that are, you know, we've had some good updates on going password, list lately with, you know, Fido to and web off and and all the major vendors being able to do interoperability with those. I think that's going to have a huge impact on on the experience of logging in is just getting rid of passwords basing on Fido to based on devices that you have with the Biometrics and things like that. I'm with you on that. I mean.
So Larry you mentioned, you were excited which for Bessie to take your user experience, focus and put it on customer. I am. And I wanted to ask you a question about, like, what's different between customer. I am be to see. See I am versus bde Workforce identity to meet used to be a stark contrast, maybe 10 years ago, 20 years ago, where it was like, you know, for our
customers. We have to have a very custom experience that Makes it very easy for them to do business with us and our Workforce. Like we can feed them dog food, the meat it because we write their paychecks, right? And but I found that there's been a pretty big shift on the bde side where it's kind of not acceptable in as many cases as it used to be and I think it's pretty significant. In fact, I was logging into a cloud application today.
And it asked me for a sign in for my company signed in really how inconvenient? Why doesn't it just recognize me as the person that I am using the same device that uses every day and just let me in. You know, so like even my perspective as part of the workforce as change that my expectation now is I shouldn't have to login. I should just just recognize I am who I am and let me in and that's really where it should go.
But my expectation, the past with being an employee is like 04, how nice that it's the same username password and it will have 50 different usernames and password. So what are your thoughts on the kind of those differences nowadays? Yeah and I think I think what your you know what you're talking about is really indicative of the entire, you know, user experience industry, you know. And It's all about really
incentives. You know, back in the early 2000s, when you ex started to you know, become you know, a real thing you could see the the effect of doing good ux on the bottom line. Right. And, you know, it's all started with, you know, like Amazon and and and, and e-commerce. And people abandoning shopping carts because they didn't know what they were. Didn't know how to complete the the sale or they came up across some barrier that they couldn't get past all that.
And so user experience techniques allowed us to make
better experiences for that. And then, you know, one of the big thinkers in user experience Jared spool has this article about the the six billion dollar button and it was this button that was designed wrong and Amazon like changed it and was able to like you know, if they were able to you know increase their revenue by six billion dollars because they made this, you know, one single change and that kind of impact of, you know user On the, you know, the shopping experience was huge,
right? So then, you know, you X became really, really big. But, you know, when you talk about enterprise software, we've got two different people. We've got the person that's buying the software and the person that's using the software and often their their goals and motivations are not aligned. So and who has the, you know, who has the authority of the person buying the software. And so we've got, you know, we've all been in working for
Enterprises for a long time. We've had Experience has a really, really bad because there was never a focus on employee experience, that is changing. Now, there's a lot of focus on employee experience of it, especially in very, very large organizations where they have formal employee experience programs and their they partner with it.
Making sure that you know, when you on board, you know, some consultant that's not even ever going to come into an office, we can make an experience that makes them feel. Welcome to get them up to speed really quickly and what they need to do, get them access to all of their And and all that. And so and then they do, you know, do you know, play engagement surveys and have programs to increase that
engagement? And so Enterprise, you know, employee experience is something, is this like next thing that people know? If I can keep my employees that cost me less money because I don't have to train a new person. I don't, you know, lose the effect news's of the the productivity of this person when they leave all that stuff. And so as you know, the The the bottom line gets, you know, starts going up. The stack people are starting to realize that.
Yeah, actually user experience is really important for Enterprise Workforce to because it actually saves the money in the end. They've started the figure this out. And so now user experiences is a part of Enterprise, you know, Workforce experience as well. I wish it was getting better faster, especially on the Enterprise side because I feel like and we talked about David Mahdi about this last week and he said it and I think I've said it before to it's like it's a Audience, right?
You're dealing with workers where it's basically the company's way or the highway go find different job you like the way we do it in the real world? Most workers do not have the ability to really influence identity and access management within the organization other than complaining. Now, if enough people complain then yes. I think things start to get better, but I love the fact that
it is getting better. I just wish it would move faster and become more of a thought pattern within I am programs and cisos and cios and I think I'm starting to see it. I just don't know if I say enough of it because it's still still feel still very much to me that it's good enough mentality versus do we want to really have a Best in Class employee experience? What does that even mean? Right, but I wish you would get better faster.
Larry, I wanted to move on to another question because a lot of feedback that I've Gotten I think Jeff has gotten in terms of the podcast is that, you know, not having one. Common vocabulary is one of the biggest problems that we run into in digital identity, your identity, access management.
And at a very fundamental level, we talked about bde B2B and b2c all the time, I think everybody knows what bde is but, you know, for me it's not just your employees but it's your contractors, it's potentially your guest users or There are some combination but it's not like large companies that that partner with your organization. But there is some gray area
there, right? Then there's the b2c which, you know, I think of as, you know, maybe they're they're your customers, but if your government organization, they're probably citizens, or if you are an association or nonprofit, they are your constituents. But PDP seems to me. Like, it's this gray area where things get thrown into it. People are sure. Always exactly what it means. So when you use B2B, what's your definition?
Yeah. Absolutely. I'm fact, I think I see b2c and B2B being very similar because they're both that be in B2B is customer, right? It's just a business customer as opposed to an individual, right? And so from my point of view be to Be really means you're selling to a customer, but that customer could have multiple users that are involved with that particular account, right?
And so that can come in, you know, many forms that can become in form of, you know, just, you know, selling enterprise software, say you say, well, you know, security software, and SAS application to a security team in the business, right? So, you know, it's more than one person needs access because you have a security team. So you're, it's basically in my mind, I think of B2B As you're selling to it's a customer. They just happen to have more than one user.
And so there's some collaborative things that have to happen and things like that and you know, different permissions to like you were talking about you knowing a single user that person has, you know, one, you know, you know, one permission level for their individual account in B2B, you got to have, you can have multiple, you know, roles in that be to be, you know, maybe you have a role that can manage the users that are a part of that business.
Then maybe you have another role that just has access to that account. So for me, B to B, the B is cut as is really just to see with multiple people and all of the things that comes with selling and interacting with a business versus an individual. Yeah. And I think, you know, when it comes to some of these common use cases or use cases, when it comes to be, to be versus b2c, I think that's where some of the differentiation comes out. So I was going to ask you a couple of areas.
As in if they're kind of the same that's fine. But the first one that comes to mind is like on-boarding and off-boarding. It seems like this is an area for user Journeys. At least four be just b2c B2B, might be a different story. Yeah, absolutely. There you kind of have the same, some of the same problems that you have with, you know, with Enterprise, right? You need that you've got, you know, joiners, levers and
movers. So there's sort of A governance thing that's involved with with you know B2B as well and typically you know you'd have to be able to integrate, you know, via orchestration with, you know, whatever they're using for governance so that you can, you know, remove those users or change their access at various parts of the lifecycle of that
particular employee. So, so there's definitely some, you know, some very some overlaps there between B2B and b2c B2B just from the, the, you know, the governance side of things. You know, as far as onboarding, I mean, the identity proofing seems to be a large Trend within industry. Now, getting people to use some kind of like government-issued identifier identification card and marrying, it up to kind of a live selfie. Are you seeing a lot of traction for that?
A lot of customers who were saying that's got to be part of our onboarding process? Yes. Absolutely. Especially when it comes to healthcare and financials we are getting a lot of that. We built document ID verification into our product as a first class citizen so you can not to be a commercially. But you can buy a product without having to transact with somebody who does identity verification. We take care of all those relationships for you can just
buy that as a as an add-on. But, yeah, and we built that because we were seeing a lot of interest in people doing that, especially, you know, you know, after covid were every, but everybody's remote, you know, how do I know that personally? Other side is the who they say they are. They are, you know, that became a lot more of a problem, once people, you know, stop going into 2 into physical spaces. So, yeah, we're seeing a lot of uptake on.
That's why we built that in as a first class citizen or product. Yeah, I'm also wondering about the next use case was was pastoralists and I'm kind of wondering, you know, it seems like there are a lot of companies that have built pastoralist capabilities into their product. Some organizations have taken that approach Then there's smaller firms. That specialize in pastoralism they can bolt onto products and provide that password lets capability. What's your perspective on that?
What's the, what's what makes the most sense from a password this point of view? I think we it's going to come from demand from from users, right? Like a lot of what we do comes from that demand. Like I was just having a conversation with RCT or their day about verifiable credentials. It's like it's a thing. Not a lot of people are using it
yet. Now, we know we've had a couple of news stories recently with with clear and Linkedin now doing verifiable credentials and on LinkedIn that, you know, you are indeed, you know, work at Microsoft or something like
that, right? And so I think a lot of that going to come from, you know, demand from users to be able to like, you know, especially you know the, you know, you talked about like smartphones and The amazing transformation that has had on our culture and, and people in the, you know, and all of that. And just the fact that, you know, we have these biometric ways of logging in that doesn't people didn't think about it anymore.
I don't think about that. I'm unlocking my phone when I when I'm unlocking it and I'm authenticating because I don't even think about because it's just skin in my face and it was it's me right? And so when we get that demand for that really easy experience, I have my phone and then when I can't get that same thing when I am going to, you know, target.com to buy something like I'm, you know, I can go to Amazon to do that or I can go somewhere else that has a better
experience, right? So in the consumer world, it's very easy to go from, you know, one vendor to another vendor based upon experience. And so, once the demand gets, what's becomes more commonplace for like, hey, that just, you know, I can log in with my face anywhere. Then why can't I do it here? And then, that's going to be a barrier for people to Even use that service. Another area that we've talked a lot about on the podcast that one query on was delegated Administration.
So this is something that's used pretty heavily in the B2B space. So you have a large organization that is a customer or dealer or some organization that that interacts with you and having somebody from that customer organization, manage the identities of the other folks that work there become responsible. For I think kind of always felt like this is something that is underserved in the, I am space.
Why doesn't say why does somebody come out with a package or why aren't there are several packages competing for how to do delegated Administration? What's your perspective on that? Yeah, so we, you know, with with B2B customers that's almost table Stakes anymore like, you know, like you know, I am say I'm a security company and I'm Like, you know, buying software from the SAS vendor. And if I can't manage my own users then that's a that's a huge pain, right?
I don't want to do, couldn't get a ticket to add this new person, right? I want to be able to control that to myself because I you know, I work for this business and I know the business the best and I know who should be here and who shouldn't be here. So you know, enabling that a delegation of that Administration I think is hugely important to be successful in the B2B World in customer
identity right now. Like I don't think there's and so we've taken the approach of like We are embracing that.
And so for on an organization organization basis, we actually have hosted component user management portal that we can grant permissions to member of that organization, to be able to log into and do all the management stuff that we can do in our admin console, in a separate portal that they have access to. And then, we can also, of course, you know, hook that all up via apis so that they can, you know, embedded into their own experiences.
And it's really, you know, No, I don't, you know, it's, I think it's going to be table Stakes for any sort of B2B. See, I am in the future, to be able to support that delegated Administration and it's not just the user management, it's mostly user management. There's other nicety things too.
Like if you can have somebody configure their own Enterprise SSO, so you don't have to put in a support ticket little things like that, we even enable people to, you know, change the, the MFA or the authentication levels. So like maybe you have a security team. And they log into the all their software, and they can only use you be Keys. We can support something like that, for just that organization into a that SAS application.
So, lots of different things when it comes to delegate Administration that are and I think will become more and more important for. See, I am vendors in the future. You know I think the so back on the beat in Seaside something you see all the time is like log in with your Facebook login with your Twitter seems like maybe the players are different. So now let's log in with Google Microsoft or Apple ID, I mean there's the most common ones I see these days but how important
is that spaces? It's just considered, you know, are we already figured that out move on or is that something that from Product standpoint is something that you see, as, like continuing to evolve, it's definitely continuing to evolve.
I think, you know, you pointed out that the fact that it's in used to be more social, you know, social things like Facebook and Twitter. I think that's becoming less and less something that people do, and it's more, like, you know, oh, I have Gmail and I can just log in with, you know, Google. I already have an account that then, you know, I as a consumer, Google seems, you know, like a big company and pretty secure.
So I Kyle trust it. I think maybe there's less truck and trust and Facebook as the years go on but you know you still going to have a you know a segment of the population that you know, are still going to do that. And then that runs into the problem too, like we talked about is like consistency across all the things I have to log
into. If like, if I have, you know, 30% of the things I log in to have Facebook but nobody else does then it's like, well, do I want didn't then like, you know, how do I manage that as a user like like, oh, did I? Log into this using Facebook last time, I don't remember, that's when I check it and then I accidentally create a new account, you know. We kind of helped prevent that by we do like an account linking thing where we can detect.
If somebody does that and say hey we gotta we have an email address that matches that Facebook account you want to link the two, right? But you can run into some really bad experiences by you know, good intentions of trying to make things easier for people. But then there's all these other unintended consequences that can come up based upon that.
But we still see, you know People, you know, asking for Enterprise, you know, you know, or social logins but like, in Europe, for instance, a lot of them have, like, IDs that are that can be tied to their digital identity, and then they can log in Via, like, sort of like an Enterprise login, but it's specific to the that country and that country is ID.
So it's really important. Like if you're in Europe, be able to integrate with that and be able to, you know, use somebody's country ID. To have them log in as well. And then you don't have to do that. The if you have identity verification issues right there, you can that kind of gets past some of those because you're based on already basing it on the country's ID.
I don't think we'll ever get there in the United States because there's too much pushback and privacy and having a national ID and all that stuff. But in Europe, they're already embracing things like that. May I ask you a design question because I am always curious as to what is the appropriate number of logon? Boxes should be him. I have indications screen. Is it to? Is it 3? Is there a magic number? Like what if I'm a?
If I man, I am program manager out there and I'm trying to figure out, you know, what is my identification experience look like is their guidance, you know, rule of thumb, maybe from a design perspective to say, you really shouldn't have more than x number of things on the screen. Once a man like most design questions. That is a big old. Depends. It depends right. The the best number is 0, right?
That the application. Just knows who I am based upon whatever signals are going on. Whether it's, I have a remembered device or, you know, or you know, the the biometric or the, you know, the having both can combination, which is, you know, what, you know, Fidos, sort of built upon. But yeah, so, Oh, it's the optimal amount is zero now. And the, the real answer is you add in, as only as much as needed, to be able to, you know, get the security level that
you're looking for. So there's also a debate like and we hear this a lot. It's like, well, do you know we've got, why do we have username on one screen and then password on the next, right? It's like, well, and there's like prevent work force attacks, right? Is that kind of like the intention is supposed to break it up, somehow. Oh, there's yeah, there, that's
one of the reasons breaking. You know, mitigating Brute Force attacks, not eliminating but making it harder, I'm doing things like routing you to the right log in experience based upon who you are because it may be, it may be, it's a password is flow. Like well then, why am I putting in a password in here? Because?
Well, we don't know if it's a password of float until I know who you are, and then we could say, oh, okay, then pluck password, you know, so there's reasons to break that up right now, thinking like I'm answering a lot of AI questions, you know, pick the cat wearing the pirate hat is my new favorite one that I've seen as I've going through the Authentication?
Screens. Oh, I saw one of those the other day, the, the recaptcha where it was like, asking me, like, pick all the ones that are vinyl and everything was a circle. I saw that same 12. Yeah, I was like, what is this now? What if I didn't know what vinyl was. Yeah, it's like it. I know it's I'm old. So I know it's a record but like like is a 12 13 year-old going to know that that what a vinyl
is, my daughter would. But well, that's what I was wondering with the it depends question was or answer was so Are you doing like Focus? Like the use of focus groups? I mean, it seems to me like that's what big organizations will do with their e-commerce environment. You know, have focus groups come in, but I think another situation was probably just comes down to what's the best practice? Well, I think, and it's focus. Groups are not a good way to evaluate user experiences.
The best way to evaluate a user experience is actually Actually sit a representative user in front of the user interface. Give them a goal and a task, or it's actually better if they already have their own goal in tasks in that and then watch them, right? And then watch multiple people from, you know, different personas and understand that. So, I would say, going back to the, your last question, there's this myth in ux, it's like well, let's click says better less
clicks is better. Less clicks is better, and that's actually not true. What is you need to make sure. Is that every step that a user is going through that user feels like they're getting closer to their goal right now, you can take that to an extreme and then eventually somebody's going to get frustrated because it's like, you know, ten different steps that doesn't seem to make sense but having two steps versus one step, one step is not necessarily better to steps is
okay? As long as the user still keeps you know feeling like they are moving and progressing towards their goal. So an Optimum number of steps. I don't think there is, it's really just a it's a balance of security versus usability as, you know, security always is. And the, you know, we have to make that balance depending, you know, and contextually on who the user population is. What the product is, what security levels are, what's the risk level of that particular Enterprise.
So all that has to go into the, the decision of how many steps is this. And you brought up another pet peeve of mine, which is forgetting which login mechanism, I used to get into a resource, right? Did I sign up with email? Did I use Google that? I use LinkedIn, you know, whatever it may be. And you mentioned this idea of kind of profile like you behind the scenes, what you think is great.
I'm going to tell you a story because I'm going to call out who burned the carpet here, because I have struggled with Ubers profile management system for almost a decade. I think. Here's the situation. I was an Uber Rider signed up for an account, no problems. Then I said, hey, you know what? What's this Uber driving thing? Like so I was like, let me try it once to just see kind of, you know, what it's like. So I drove once for Uber.
And now my profile, as an Uber person, is I have a driver profile and I have a rider profile, but I cannot manage any of that information. I can't change my picture. I can't change parts of my name etcetera, without having to Get in contact with Uber and they don't seem to have a way to say, look, I'm never, I'm not going to drive for Uber anymore, so they don't have the seem to have a way for them to kill off my driver account without also killing off my writer account.
Now, I've got a very, you know, if I have to I will kill it off. That's fine. But here's the other problem is, if I were to re-sign up, I couldn't use the same email address, right? So I can't create, you know, I'm stuck in a catch my juice. Okay, well I don't mind. Go ahead and pull it away. Just re-sign up and just kind of clear things out. But what do you mean? I can't use the same email address. I'm not going to create a new email address to sign up for ruber. That's stupid.
So now I think well I don't have this problem with lift, I'm going to go use a lift because I feel like it's more. I have more control over my Persona within, you know, that are within that app and the ecosphere. Now, politics aside, whatever may be right. I'm talking purely about the user experience. I have a really hard time with boober, I don't have that problem. Um, with a competitor and me as a consumer. It makes me want to use their
competitor. In this case, lifts, much more often than Hoover. Now, Uber, if you're listening and you can fix your stuff, please do so, because I would love to be able to just manage my own profile and somehow, you know, divest my writer profile away. But since I can't do that now it's costing you more money because every time I need to make a change to my account, guess what? I have to reach out to support.
And oh, by the the way it had provide like eight different pieces of information to validate my identity border over email, it's really frustrating. And I just wonder if that is a scenario that when you're talking, you know, for example, with clients and animals and things like that, that scenario comes up is this really frustrating for me, and it really makes me kind of bitter about it. Yeah, a very smart person. Once said that the experience is
the product. And then your case right there that I think that just really kind of nails that statement home so much. And if you don't understand what the experience of your product is, then what are you even doing? You know, like you don't even you don't even know what your product is. If you if you don't, if you're not regularly watching your
customers, use your product. And in my mind because of you know that statement there, it's like if you don't see what users are doing what they're getting frustrated with, I had so many just like, you know, back and forth with Engineers about like Oh, that's stupid. We don't need to worry about that detail that doesn't, you know who cares about that? And then I showed them, you know, five videos of customers like struggling with that very thing.
And it's this it's this issue of its it's just another part of the human condition where it's very difficult for you. And I to put yourself in the shoes of somebody that doesn't have the knowledge that we do, right? It's very difficult it's called The Curse of knowledge. It's very difficult to to Unknow what, you know, so you can get better empathy about what this person is struggling with. So, in user experience, that's why we do so much user testing
and user observation. Because that's what gets past that cognitive bias that we have of our own knowledge. And that's how we, you know, sort of make better products as, you know, making sure that people who are making these product decisions are able to you know, watch users, use and struggle and then understand what their goals and motivations are and where they get frustrated and then we all can make better decisions about. You know what?
What the product is. And so your case Jeff, where you have those two accounts that maybe just like an edge case that, you know, it's like, oh well, that's just an edge case. Not a lot of people do that. So we're not going to worry about that, because we made a whole bunch of architectural decisions that makes that really difficult to problem to fix. So I think but, you know, you always have to prioritize.
But again, yeah. The, the experiences, the product, and you need to watch your users, watch your use your product. Otherwise, you don't know what your product really is, what effects that you have on the
people using. It. What I love about what Jeff just said was that it showed that I'm not the only complainer on the podcast, but what I'm about to say next week about that, I am the biggest complainer on the podcast, which is my gripe is everything, that's a brings in the way, I talk into the user experience, which is everybody seems to be moving toward these chat Bots and they suck. I mean, let's be honest, nobody wants to try to get their
solution from chatbot. You, you wouldn't mind chatting with a person, I'm not busy for you because there are some good ones out there. There's no. But I will agree that most are terrible. No Jim you have to just contracts this very elaborate prompt that will get you the right answer. But if you don't know at the prompt right there that just gives you vanilla stuff. It's even better is like first off, I hate picking up the phone calling. I'd rather use an app for everything.
When you do pick up the phone and then you get, I'm in Ai and I understand complete sentences. And I would like to, and then you say something like, I'd like to speak to a human. I'm sorry. I didn't understand, we had to say it's like, okay, you can't understand complete sentences.
Anyway. What strikes me is like I keep hearing about oh I shouldn't take over, it's like we're Terminator. 2 is coming next week and like these chat Bots, that are Ai and everywhere that I see that as a, I absolutely. Ox, and I really wonder if it's going to, then the other thing I heard today was, you know, they're they're building an AI version of Microsoft Word. Microsoft Word is such a pain in the butt to use nowadays, they moved everything around.
Like why not focus on making Microsoft Word easier to use rather than some feature that? Yeah, but that's what they're doing. I kind of feel like I don't
need. I love what Microsoft is doing with introducing chat GPT and other open a you know, other AI products into To it. I tested one out today is called Jama and this isn't Microsoft, but the idea of being able to create a presentation using a prompt and then using a i to tell it what you want the slide to look like and having it do that and make changes, I think that's fascinating. I think it's not great for people who do that stuff day in and day out and that's our primary job.
So that's something to be concerned about but like that kind of stuff is an accelerator like being able to go into word type in and out. Fine. And then say convert this to a PowerPoint presentation and it does whatever it needs to do. Right. I think that's like time-savers stuff like that is going to be
really helpful. I think that's more valuable to me right now then like a knowledge base because I still think AI is not getting me, is not 100% accurate, enough of the time to be trusted with results, but to do design shortcut, you know, formatting type things. I love the idea of it, so I am totally on board. Border that kind of stuff. Yeah, I'm very interested in the space as well.
I think Jim you're right. And a lot of cases the the they do suck right and I think we're in such a early phase of this. This is like, you know, we you know I don't know a good analogy for this like you know my your blackberry was like well I've no that's a bad example. I'm trying to think of a good example of something. You know that was just really terrible at first but Everybody still used and then every it
got, you know, way way better. I think even just like the regular phones cell phones in general where anything is really cool. I can call anybody. But you know, I can't really, you know, I the text messaging I have to like, do with the, you know, the the T9 where you had to type the numbers that would like convert it to like actual letters and stuff like that, which was really terrible. And it wouldn't get on the internet. And the internet was really, really slow because it was 2G
and all that stuff. And then now we have a transformational product that like, you has changed every one of our lives, right? So I think, Think AI is in such early such early stages right now. There were there's a lot of stuff that sucks but I still believe it's going to be transformational a transformational technology and 10 years from now we're going to be like wow I remember back and when we had to like you know do XY and z and now and now we just have a I do it for us.
I think it's going to be transformational. I'm in the the I have a dream' phase of, I see the promise. I want it to be there and I can't wait for it. So I'm willing to suffer through the pain of it and, you know, kind of know that it's not perfect. But again, maybe that's just the Leading Edge early adopter personality that I have. Yeah. And it's really good for those low stakes things, right. Like if you're putting it in our Power Point presentation.
Oh yeah, put an outline, it puts out a presentation. Okay, now I can go through it. It's like, okay, I'm just going to change this because this wasn't Right? And all that stuff. So you have to still have to have somebody. Who knows what they're doing. Be able to review that, maybe will have ai Bots. That review are the the other a bike that's and then we can, you
know, have them. So that all my question then is I think he'd be It could be naive to not think that AI is going to have an impact and, you know, 20 years from now is doing a lot of things that we aren't doing. Say might be the term AI but it's basically technology. My question is like, do you think the hype is overblown? That AI is just going to destroy Humanity?
Because I mean that's that's like again, we've been under great, so many different times by electricity indoor plumbing, you know, R rated movies video games. Yeah, I feel like this is we've been destroyed. We bent the impending. Doom of man has come several times before we're still here. Yeah, yeah, exactly. I don't know. I don't I don't there. I think there's some concern there that. Absolutely, I think we should be cautious, you know there?
Because there is, you know, I mean, 10% of the people that actually work on, you know, artificial intelligence think that's absolutely a possibility. So that's a little scary when the people that are actually in the no working on this. And a ten percent of them think that it could absolutely could do that. That's a little scary, but I can't live my life thinking about that all the time.
So nothing I can do about that. All right, we went down the AI Rabbit Hole. Once again, I feel like we end, we're ending up there quite a bit. So let's start to wrap up and let's go to a lighter note because I feel like I need a palate. Cleanser and and I pick something way out of left field on this one. This is inspired by a Reddit post that I saw the other day. What is the largest animal that you think you could beat in a fight?
And we're talking, you know, one-on-one, you know, no weapons or anything. Thing like that. It's just you versus whatever animal you think and this was inspired by a infographic. I saw that was I think the size calls statista and it was basically a survey that they did of Americans and Brits and they were shown a list of different animals and they were asked how many, you know, what percentage of Americans versus Brits do they think could take that
animal in a one by one. So, an example was a rat. And surprisingly I don't only like 72% of people and Americans thought that they could take a rat and sixty cents. Let's call it like sixty six ish of Brits thought that they could take a wrap on and one more on versus a grizzly, bear. We're like 1% of Brits. So they could take a grizzly bear and like let's call it like 5% of Americans. Of course, a much more American Course right?
Yeah, of course of course we're gonna take others a spoiler. No, you're not. And that's worth inspired this question. So I'm curious and Larry will start with you. What do you, what do you think is the largest animal that you could take in a one versus one fight? Oh my gosh. I just, I've heard people talk about this before. And in the context of like a goose because like a lot of people like look at A Goose's, like, oh, I could this isn't that big. I can until it starts chasing
you and your sandwich. And yeah. Like everyone else. Yeah, exactly. It's like I don't I think a goose could totally rip you. Rip you a new one. If it needed to write. So I'm going to go smaller than maybe cat. I'm just like a cat cats cats have sharp claws and teeth, but I still think I could probably take it. Not that I would want to, and I don't want to. I don't want to find any animal. I love animals. I've got two doses, not a scenario. Where condoning violence. Okay, good.
I'm a big. I'm an animal lover. I have Dogs cat, you know, all that stuff. I'm fine with that, but I'm just curious it from if you had to it's, you know, fight or flight. What do you think you could take? I think I think the cat would be the biggest. I can take anything bigger than that. I think would be difficult Jim. What about yourself? Large, never fought a cat. I can tell. Never here's what I think. Is that humans? The human body is not designed.
For fighting animals, almost every animals is armed with something sharp teeth, claws. Things like that, we don't have
any of those things. What we have is a huge brain inside our skulls, that enable us to think and use weapons, sticks, Stones, whatever, guns, sharp objects, as I was thinking like, oh I if I climb in a tree and throw a rock down, I could probably kill a lot of animals that That were way bigger than me, you know without that I they might climb a tree and come back to me. It's going to be pretty small.
I saw a video the other day of a lion climbing a tree to go after a hyena and stealing their kill up in the tree. Yeah, and you can barely hear that. I had a bear come up on my deck. It's two floors up. I don't think Maraca watched a video of like a bear, killing his prey is not try not to, it's not a, not a normal viewing habit of mine. Oh, no.
It's not a pretty picture. And so I was thinking maybe a sloth because they're socially, like, maybe you could punch them in like stomp on their head or something, but I don't know. I mean, I'm kind of going where Larry went with like some themes smaller than that and I was thinking like, chicken. Chicken would be delicious. At least. Yeah. Well people are killing chickens right hand for a long time. So yeah, and I've broken many chicken bones in because I actually buy this is my second
career. I used to be that's like back in the back in the day. So I've like I've like broken a lot of animal bones but they were already, you know, dead deceased surprises me Jim, I thought you would pick something bigger because I feel like I could take on A dog. Maybe like a not maybe the like a super large size dog. Now what I'm saying is, I think I will win. The question is at what cost am I going to be scratched up,
buddy? Bit, probably, yes, but I feel like I could take on something like that. Not that I wanted you. Yeah. So so usually I saw, I'm the negative 100. Like, how could you come over to this topic is terrible? I thought it was weird. And it was kind of like there was a, there was a well-thought-out Reddit That was like, why? I think I can beat a bear and it was like, I don't know, like three pages. Long of all the reasons why this guy thought that he could take
out a bear one versus one. He couldn't do. Yeah. No, definitely not. And that was what most of the comments were like, you know, see you in the, ER, if we see you at all ever again, you know, stuff like that. It would be funny, but I thought it was interesting was like, all right. Well, you know, let's, let's analyze this, you know, what do you think? We could take? But anyway, it was meant to be silly and I think mission accomplished Each. So let's go ahead and wrap up
for this week. You know where you're right, a fount of information. I'm hopeful that we'll be able to get to fist bump in the future at some conference. I don't think it'll be that identifies this year but maybe at some point in the future, that's something I like to do for all the guests we've had on, is the official fifth fist. Bump of thanks. So I'll give you one here virtually and we'll have links in our show notes.
You know, it's for people who want to connect with, Larry asked him questions on LinkedIn. Learn more about strobe a city. That's true a sativa. Cam, that's St. RI V A CIT Y and kind of learn more about what those guys are working on. And we have links to, you know, also are identifiers, registration code idb 23-0 icen 20, make it really easy to sign up. We hope to see a lot of people there and you know, definitely follow our show on Twitter at idac podcast and visit us on the
web at idac. Podcast.com what else we gotta run, Mastodon. Speaking of animals that we definitely couldn't take one versus one. At idac podcast at infosec that exchange, connect with Jim and I and Linkedin. Jim is our social party planner and is trying to figure out what we're going to do while we're diverse. And when I'm not busy, either recording and or editing the plethora of episodes that we
have planned for that. So, so reach out to us, if you've got questions, comments ideas for the show, or just want to tell us, you know, how pathetic we are about the size of animal that we We could take male 1 vs. 1, any of those are welcome. So with that, we're going to go ahead and leave it for this week. Thanks Laurie for your time, Jim. Thanks for your time and we'll talk with everyone in the next one. You've been listening to
Identity at the center. We hope you've enjoyed the show, make sure to like rate and review and we'll be back soon, but in the meantime, hit the website at identity at the center.com and find us on Twitter at idac podcast, see you next time on identity at the center idac podcast, see you next time on identity at the center