AI, Big Tech Power, and the Passwordless Future of Identity Management | TSG Ep. 962

Hey, everyone has AI killed the Innovation Star you're watching Textron Gang. Hi everyone. Happy Friday.

It's Alan Shiel and welcome to another text on gang. We've got some good stuff to talk about today. Start your weekend off bright and cheery or down and depressed either way, but nevertheless, the weekend's coming.

We got our Great Friday panel to talk about it on. You know, Fridays really are, that's panel of the week usually, and a lot of it is because of, of these folks right here joining us from, it looks like a subway brick rack background, probably in New York. Ira Winkler going across the other side of the country, probably up near Seattle.

Our good friend Fred Wilmont, and it looks like she's home in Colorado, the one in only Kimberly Bates and of course, high up in, uh, hi, his attic in Harrison, New York. Mike Ard, gang members that People's Republic of New York. So there you go.

The People's Republic of New York. Well, that would be the city. You're kind of, Hey, We were the People's Republic of Boulder a long time ago, So yeah, you were, I remember when I first started coming to Boulder in 2001, it was very much the People's Republic.

Um, anyway, gang, it's, it's Friday, but this big, there's just big things happening in our world beyond the, the election this past week and some of the results there. Um, Mike, why don't you kick us off here. Well, it seems like the tech leaders are all calling for innovation once again, that happens to spend a lot of money in this time in digital health sector, but you have a post suggesting that maybe they should, uh, you know, heal their own issues first before we get too far into other people's problems.

But, um, you know, you wrote this piece, I think you're spot on, but, you know, walk us through it all right, well, you know, and by the way, the piece is up on Techstrong. It, it's called Tech Heal Thyself. And I also am talking, I talked about it on our shim.

My shimmy says episode this past Thursday, which by today you'll be able to see on YouTube and, and everywhere else. It really grew out of a book review on a New York Times article. Uh, the book was written by a former, I, I think it was a Biden administration antitrust person.

And I know, you know, they're not in favor these days, but basically he was lamenting, you know, that we need the government to kind of step in here and, and stop this oligarchy of big tech vendors monopolizing ai and, and while we're at it, throw in robotics and quantum and everything else. And, and the real issue is, is this AI revolution that we're seeing has become such a big boys game. The, you know, the bar to entry is measured in the hundreds of billion, billions of dollars, not even the hundreds of millions, right?

The play in this, you've got, you know, circular things where, you know, Microsoft gives open ai, a couple of hundred billion OpenAI buys a couple of hundred billion dollars worth of Azure services. The same thing goes on with Oracle and AWS and Anthropic and Meta and Google, and they're all just kind of passing the salami around here, hide the salami, playing with this money. But if you don't have that kind of dough, if you don't have that kind of gravitas, how do you compete?

How do you play in this market? You know, one of the great things about tech, I said it before, I'll say it again, is that you could get two guys in a garage and they could reinvent an industry or, or launch a new segment of industry and, and make untold riches, whether it was WA and Jobs or Serge Sergey and, and Larry or or whoever, you know, bill Gates and Paul Allen or whoever we've always been, you know, that's been the promise of tech is that the little guy can become the next giant. Yeah.

Alan, I'm gonna disagree with you. If I could go ahead and let me tell you why. Because what these people are doing is very specific to creating the infrastructure in many ways.

It's kind of like saying, oh my God, I was cut out of the telephone system because I can't put together my own internet provi. You know, I can't put together my own lines and cables and everything. And I think that that's the more critical aspect of this, that what they are doing is enabling other people and smaller people to use, and I hate the term ai, but they're allowing people to use AI related technologies and providing the infrastructure required for people to develop and deploy their own models, not that they are, you know, locking other people out.

And I think that's a difference. So, IRA, Let's go. com.

It was very similar, right? You had, you had big, you had at t the original at t before it got broken up, right? Mabell, and, and they broke that up.

And you had the, the CL but you had, it wasn't just a handful of companies that controlled all the fiber, that controlled all the data centers. You had the CEX and the IL and all of these other carriers, if you remember those words, right? Who could, who could bring connectivity to your office or your house or what have you.

Anybody could open up their own. How many little ips did were, were, were started, you know, some became big, some didn't. How anybody could be a hosting provider and open a data center.

You did it, it wasn't measured in hundreds of billions of dollars. You didn't have the government with their thumb on the scale owning equity in these companies. So not to get around the government side, but I, I, Alan, I think, and I'm gonna agree a bit with Ira about what he's saying is that this is a level of infrastructure that's being put in place because none of this matters, in my view, until it executes on a use case out in the wild.

And then I have the ability as a company, as a user to go look at, you know, the, let's say there's five LLMs out there. There's usually only, you know, you know, the, the rule of three is usually there's only three big companies that will have that big infrastructure. And, um, you know, going back to Jack Welch, if you want 1, 1, 2, or three, I'm jetting you.

And so where we're now in that is that they're building this and we, we actually need them to be this strong because if we're gonna keep ahead of China, which is a fully government institutionalized LLM sys system, we need the strength of these very large companies to keep on that stay on the edge and that money behind it. And then all the, so Lemme get this right, Kimberly, you're using a red scare to, to, no, I'm Not using, no, I'm not using just the red scare. I'm saying that my biggest worry about where we are on the AI bubble is whether or not this is gonna actually, all this investment in these huge LLMs is gonna end up in use cases that we are actually using it.

Because until it goes to use cases that infrastructure is of no value. That's kind of like, you know, what Sun and Cisco did and everything else in 1999 and 2000 where they were just shipping gear constantly, and this is like shipping gear. com, it was the real applications that got out there, there was, there was a stability in that internet and how it was being used.

I see that we're in the same place here with the ai. And so I'm very anxiously looking at the end users to see how are they using this technology? Where is this going?

Because that's where the real big value is going to be. I think there's a couple of important points there, Kimberly, I like, uh, around the story that, uh, Alan, let's use your analogy. So these big companies are laying the fiber, right?

Deep sea fiber across, uh, transcontinental fiber, you know, these types of things. But until somebody's going to be able to weaponize that, it's akin to the same problem of the last mile bottleneck to get into your ECT conversation, right? And so when we think about what that means, um, the use case that, and Kimberly's talking about here is the last mile bottleneck.

Why did we have to figure out how to solve a last mile bottleneck with, you know, plain old telephone, uh, pots lines, right? Because bandwidth demanded it, because applications that demanded that bandwidth demanded it. And, and in this particular case, and we're building the fiber lines for all of the, the, the telecom model across the, the US and the globe.

And these data centers are a part of that, uh, fabric, uh, for the purpose of being exposed in that way. I think the use case, the last mile bottleneck is absolutely the rationale behind the innovation. And I i it's also cyclical.

We've seen this before where, you know, at first we, we thought everything should be centralized, and then we thought everything should be decentralized, right? 32 70 terminals and, you know, frame relay circuits and all these things, and then all of a sudden, right, you know, we, we have this very decentralized way of doing things, but it creates a whole set of, of, of issues around how to manage the economy on scale. So we get, you know, monolith, uh, behavior.

Again, it's, it's cyclical. I think we're in that right to frame it up as we're in this process of, uh, you know, aggregation and, and maybe, uh, extraction. But I think the value proposition is what happens as a result of that, which we don't see yet.

I have one concern, it comes down to price, and to your point, Kimberly, I'll use your cloud example to prove the opposite. So I have five big providers of LLMs, and right now, to be honest, they are subsidizing the cost of ai and they're charging people less than it is for them to actually produce that thing. And eventually they'll run out of VC money and start charging people what it's gonna really cost.

I have noticed this interesting trend over the years. We had three big providers of virtual machines, and you know what, amazingly, the cost of virtual machines never changed. No matter how much alleged competition there was, it was always the same.

I think the same thing's gonna play out here. I think a big number of companies are gonna own access to these GPUs and their LLMs, and people are gonna be like, Hey, suddenly I'm getting gouged on pricing and I got nowhere else to go unless I go build smaller models and get my own systems and put my own LLMs over there, and then I'm not gonna be hostage to these guys. That's what I think.

And I would agree with you, Mike, on that. I do do that. This is a fair, very fair point, um, in terms of pricing, et cetera.

Um, and I also agree with you in the smaller models of seeing these, you know, we have the very large MA models and then we have the unique models that are going to be by each industry. We haven't gotten quite gotten there yet. I mean, we're starting to see a few of those coming out.

And as those do come out, yes, that will drive comp, you know, that will drive innovation. It's out there. I'm sorry.

I also think this whole pricing model around tokens is just flat out crazy. A token is an input and an output, and if you're gonna pay for every input and output, you're gonna wind up spending a fortune. So there's gotta be a better way.

But the, so here, there does have to be a better way, Mike, but the problem is when you, when you anoint these companies is too big to fail, and the government, you know, takes off the referee's striped shirt and puts on the team jersey, right? You, you don't, you don't open up to allow a better way to happen, right? For, for all intents and purposes, what we're building in the US model is a Cadillac, right?

It it's a very expensive, very heavy, these big LLMs. It may not be, it may prove may that it may not be the best way to do this, right? You know, when when the Chinese deep sea thing came out, it stroke, you know, it struck fear in the hearts of the US AI industry.

Like nothing we've seen since Sputnik, you know, had wor LeBron up all night. But, but that's healthy. That's, that's what the healthy market does.

People innovate, they come out with new ideas, with better ways. They out innovate, they out nimble, the, the be myths the big guys. But what I'm saying is this time the big guy's advantage is so ingrained.

We're not looking at the government for antitrust. Well, who expects that? But I am looking for a level playing field.

I am looking to give the little guys a shot to out innovate here and come to market. I'm worried that we're not going to, we're not going to allow these people to come to market because the, it's, the decks are so stacked. They, they've built the barriers so high.

So who is, who can assist in, in this? I mean, we're talking about VC investment in, um, some other models, but they are overly tied into the success of these companies. I mean, if you listen to the guys that are all you, you know, sure are they, they are, you know, they, they are tied in those, those companies making it as big as they are.

And, and frankly, so is a lot of our investments in the, in, you know, in the mar stock market. No. Let, let, let's, let's face it, the AI economy is responsible yes, for the majority of the GDP growth in the US this year, right?

So, you know, and it's tied into seven companies. It's not, or eight companies. It's not healthy now.

But I'm glad you asked the question, Kimberly. Kimberly, you know, I'll turn you back to Jurassic Park where Jeff Goldblum says, life will find a way. And I firmly believe that innovation will find a way.

It may not come from Silicon Valley. 'cause there, they're too wrapped into this. It may, unfortunately, I'm hoping it doesn't come from Beijing or Bangalore or Moscow or, or, or somewhere like that.

But maybe it comes in Austin or Boulder. Maybe it comes in in Raleigh. Maybe it, it has to come from, but it will come, it's gonna come from, you can't bottle that up, right?

You know, I, I'll give you another analogy. Star Trek world, right? The warp drive.

I mean, humanity appears to have been in the, in the crapper in some weird dude up in Idaho, Zein Pike. Can I give you a, can I give you a world example? It's called the oil industry.

And how many years did they invest in finding ways to make sure that there were no alternative forms of energy invested in? And how many times did they just buy something up and just tuck it away somewhere? And that was the No another great, another that all over again.

We, we might be dealing with that all over again. You're right. Mm-hmm.

But life will, I I I am optimistic life will find a way that, you know, innovation will succeed and it'll probably be in somebody's garage somewhere. And I'm too, because if you look at all the, the different industries, you know, you've been involved with, I've been involved with, yes, we've seen is is kind of like the, in my world, when I was, you know, running in the data storage site, EMC was the big guy and they kept on buying, but they, there was very little innovation coming out of them. They, they bought data domain, they bought Isilon, um, and several others that became huge offerings into the market.

Um, and we saw the same with, you know, IBM um, and, and others. And then we've, we've got companies like Pure Storage that came out of investment and vast data. Both of them are challenging the entire market as we've gone into new application areas.

It's literally, it's because of the new applications that have driven that, those innovations and not the old stuff. So I think that yes, we will see the innovation and I, you know, applaud article Alan that you wrote that was really, really super good. I encourage everybody to go and read it.

I put it up in my LinkedIn, so go check it out. You'll find it there. Are we, are we gonna re, are we gonna remake network and are you gonna like, scream out the window?

Like, I'm not taking it anymore. How far are we going with this? It wouldn't, wouldn't be the first time I've screamed out my window.

But anyway, I, you know what, Kimberly, thanks for the plug. The article is up there. You can watch the Shimmy says, I'll go dig deeper on it on that.

But, um, we've got, we've got more to talk about here on the gang. So let's take a break. We're gonna come back.

I think IRA's gonna kick off our next one here. You're watching Text on Gang. You've earned it.

The spotlight, the responsibility, the weight of teams, companies, and entire industries fall on your shoulders, lives depend on your decisions, your home life included that work. You are protected physically and digitally. Nothing gets through your team without a fight.

But in a globally connected world, everyone sees you, including those who mean to cause you and your organization harm. And now home your sanctuary attackers see an opportunity. Your digital front door is wide open.

And what compromises your home can breach your boardroom. Because the devil's greatest trick isn't targeting your workplace firewall. It's convincing you that your personal life isn't at risk.

Black clerk, digital executive protection, defending the new attack surface your personal life. Hey folks, we're back and we're talking now about, well, law and privacy and security and all kinds of fun things, but there's an article up on Security Boulevard by Mark Rash that talks about, well, one of the reasons we don't have privacy regulations maybe, is that there isn't enough lawsuits out there because, well, the way we frame these legal standing issues results in people not being able to sue. But I, you're a lot closer to this than I am.

What's your take here? And, you know, is this a conspiracy or is this just something we overlook all these years and we need to fix? So let me be upfront.

I've been a cl, I've been an expert witness on a variety of class action lawsuits, mostly around privacy, fair Credit Reporting Act, and things like that. And when you look at these lawsuits, you have class action attorneys essentially crawling outta the sewers and essentially finding cases where they can apply the Fair Credit Reporting Act or another law that has statutory claim, you know, that has statutory claims. For example, every violation of the Fair Credit Reporting Act is a mandatory a hundred dollars, a hundred dollars penalty.

Now sounds not like much, but if there's a million people that's almost sudden a hundred million dollars lawsuits. And when you are looking at these things, frankly, there are companies that do major wrong, and if they're a fault, they should be held accountable. However, the current class action framework doesn't necessarily benefit the consumers.

At the end of the day. The way it theoretically benefits the consumers in the eyes of these class action attorneys is that they are bringing a lawsuit to hold these people accountable so that they are better in the future. And they believe that they deserve tens of millions of dollars for their efforts of filing paperwork.

And at the same time, the people who are actually wronged get nothing. There was actually a class action lawsuit where some attorney sued Google, they got like $10 million in fees while the people who were aggrieved got nothing, literally nothing. That was the lawsuit because they made the situation better.

Now, when these laws were, from what I read, the, the article was highlighting how very specifically attorneys are out there and they have to actually show people were damaged. In other words, they have to actually show that somebody's information was stolen, which is one thing, but that the information was used or abused, which is another thing, because I could download a hundred million records and not be able to go through and process it unless you can prove it was put up on some malicious website or used in some way, shape or form. In theory, the people, according to the, the court decisions were not harmed in any way.

And so that might be true. At the same time, what's really the problem, in my opinion, is how are the penalties being enacted? Who are the people actually benefiting?

Which is a real question we should be asking because at the end of the day, class action attorneys walk away with tens of millions of dollars, and I'm not exaggerating. While the people who are harmed get very little. For example, you know, when there was a class action against dog food companies where they had killed dogs because of poisoned dog food, which is rightfully, I own a dog, and boy would I want somebody to pay for that.

The people who had their dog die or get harmed, they were given a coupon for free dog food while the attorneys walked away with tens of millions of dollars. And at the same time, was anything changed? I would argue, no, I don't think whoever the company was, whether it was Purina or whoever, I don't know the first, the, the company, they don't want to kill dogs.

It's bad for their image. So did the lawsuit do any good except getting people who had to buy a new dog a a bag of dog food? No.

And this is the environment we're in. And now taking a step back and saying, unless you are actually harmed, you can't be put into a class, and the cla people put into a class just inflate the numbers. It inflates the potential threat.

The lawyers hold over the companies, but it's not benefiting the consumers. So, while I believe me, I want companies who do wrong and undervalue security to theoretically be punished and held accountable, but the current class action environment is not the way to do it. I'll leave it there.

Alan, You've been a lawyer in the past, and I think what I was now campaigning for, I don't know what office exactly, but tort reform, is that what we need here? Well, yeah. That, that is what he's campaigning for.

But you know, in law, we, we have this theory of what we call judicial restraint. Judicial economy. Judges don't like to make decisions unless they have to.

Lawyers don't like to write opinions unless they're really getting paid for it. And if you look at Mark R's article that this segment is based on it's typical judicial economy, right? And lawyer restraint, what, what they're fundamentally saying is we don't need tot reform.

We don't need tot reform the, the, the art, the cases or the theoretical cases. I assume he's changed the name to protect the innocent here there is no Elephant Insurance Company. But what he's saying is the court has said there's a difference between could be potentially harmed versus being actually harmed, right?

The fact that your social security number might be available on the dark web or your driver's license number, your date of birth, you know, some PII might be available on the dark web is not a nexus to damage. You haven't actually suffered any damages yet. We have to wait till you can prove that as a result of your PII being on the dark web or, or being used in a nefarious way.

You've suffered real damages and until you've suffered real damages, you don't have standing to bring a lawsuit. So you can't be part of that class action, right? We, you know, in essence, it's going to kill off the class actions and limit it to only people who have actually suffered real harm.

So in and of itself, it's almost taught reform, right? Because it's changing from, Hey, my, my PII was stolen, I could be at risk here and therefore I'm suing you. And what Mark says is no, the, the remedy's gonna be, Hey, I'll give you some, some credit monitoring, but until you got real damages, take a walk.

You know, a Alan the other thing this talks tells me is like they separate, you know, the article in Mark separates personal information or private information from personal information. Private information is your hipaa, your personal life about how you and your spouse are talking or something. Um, and from understanding, we are responsible individually, we should be responsible for our information.

And knowing that once you put the information out there, the probability that on the dark web is really high. And so therefore it's like, okay, you know, we need to, as individuals be wary about all those kind of phishing, um, things that come across your email. Um, you know, the bizarre stuff that we happen.

And so I, I hear, you know, holding the companies accountable, but I also hear that we have to hold ourselves accountable for our own, our private information and be judicious with what we do and how we, how we monitor that, that data. Just one sec. I, I think it's unreasonable expectations for the burden of proof for managing my information that I have given through consent for the use of a specific company is on me to validate it won't be used against me at some years following.

And I'll give an example. Uh, knowing where I went to high school, knowing where I went to elementary school, I don't care. Public basis, you can go find that information anywhere.

Being able to build an umbrella identity off of all of my information that's identifiable information. But personal information, not personal facts, is something that no person can predict the likely outcome of what happens when this happens. Imagine elderly folks that have, uh, you know, their entire lives tied up in 4 0 1 Ks and IRAs and so on and so forth, an account takeover adjacent to that because their data's been exposed and they don't really use the internet, right?

Suddenly puts them in crisis where hundreds of millions of dollars of folks that are over the age of 70 right, are now at risk and they have the burden of proof required for them to justify whether or not that's causing harm. I think it's incredible to suggest, and I think there has to be accountability, and you don't get to bump that to me just because I should be a, you know, consumer reports, you know, person that understands the likelihood and the possibilities, right? That's, that, that is, that is a type of, I revocable trust that you put in into a company's hands.

You can't possibly sign away. Well, I'm, I actually started out, and I want to be very clear, I a hundred percent agree with Fred because there is a difference in having your information theoretically available to a criminal versus putting it in criminal forums like the dark web. So for example, if you just say, gee, some criminal had access to, you know, what's a recent one?

The Marriott database, some criminal had access to it, and therefore who knows what they could have done? And I'm gonna have like a gazillion class members, so I can charge you a hundred dollars times a gazillion. That's one thing.

However, if that information ended up in the dark web where it's hard to prove that somebody did or didn't, you have to act like they did. And that's where I differ from what they were saying in principle to the specifics. And again, I agree with the, the line that Fred is drawing.

So can we just automate this a little bit and say, okay, I should be able to discover on the dark web when people have been harmed. I should be able to create a law, a website that aggregates all that information. And then I should be able to invite people that participate in my class action suit because I can prove they've been harmed.

And yeah, this is just a business process workflow. I I say no over what period of time and with what magnitude and what adjacency, right? So Fred Wilmot, right?

Or my grandfather's name, Francis Wilmot, right? The ability to stack identities together in a way that's meaningful with personal information is a very, very robust way of stealing people's identities. And when that information has been given out, right?

Then you're now subject to, there are no rules that stipulate these artificial identities cause harm to the originating the originating identity. But you can build up credit card profiles, you can buy houses, you can do any number of other things. And there's no way to materially suggest that is directly tied to the consumer who was exploited until somebody comes knocking on the door and saying, oh, well, you know what?

We tracked all this back all the way to you somehow. And it's up to the burden of proof is on the human who stands there, whose identity was exploited they had no idea about, and suddenly they're called to account. So Fred, I think what you're saying is that you're finding that these companies should be held accountable and having to pay these fees and okay, yes, the trust sys the how we do tort right now and the fact that the lawyers skip away with, you know, 90% of the money or whatever it is, and the people that are harmed get very, very little is of no cons, is not of consequence as it is with having the threat of the company being sued, being the consequence, and then buttoning everything down.

Exactly. And that's where the v bigger value is, is that the companies have that threat. They know they need to do something differently despite the fact that the only per, the only people that are really benefiting from these torts, um, are the, uh, the, the lawyers.

Yeah, Kimberly, exactly. The bottom line is you should fear Tron the user, not the class action lawsuit. And in this particular case, if you're accountable to the user or whomever, right?

That's the real, the real impetus. Go ahead, IRA. Um, no, I was just gonna conclude.

I frankly, I frankly agree in large extent, and I'm just trying to go ahead and say, look, you have to understand because a lot of people say there's a class action lawsuit, go get 'em. Not realizing it's really just a transfer of wealth from the company to a lawyer not getting, you know, retribution or I shouldn't say retribution, but compensation to the aggrieved parties. And that has to change.

Like, again, you know, it, it's just like a total 'cause I don't think any attorneys really care at the end of the day. Let's face it. And here's the, you know, here's the elephants in the elephants room.

Fundamentally, this is all covered by insurance. It's the insurance people who are paying for this. It's not the companies who are paying, they just hire other attorneys to deal with it.

The insurance companies bump up the, you know, premiums of everybody and we all end up paying for it. And people don't realize the ecosystem of what's going on. It's not just The insurance Ira, let me, let me make this real for us.

Let me make it real for us. Recently came across a case all too personally of one of these West Hollywood, California law firms sending out a mimeo, not a mimeograph, a xeroxed copy of a letter stating that, uh, a website has some, uh, data broker service in there. And they, they claim they have a person who came to the website and was therefore harmed by having her information exposed to data brokers.

And pursuant to the US wiretapping war in the California Privacy Act, they're gonna start a class action lawsuit. Unless you pay him $10,000, 10 grand, 10 grand don't sound like a lot of money, but remember, there's a reason why they're sending out Xerox copies of this letter. They're probably sending them out by the dozen lawyers.

You hire a lawyer to go look into it. Absolute nonsense. You, you have your teas and Cs in place, you have your cookie warnings, you have everything you're supposed to have.

We could fight this thing. We gotta make a motion to dismiss $15,000, $15,000 for the motion to dismiss. Now you're a businessman.

Do you pay the 10 grand to put the troll back in the box or do you go 15 grand on your principles? And, and, and, and that motion's not guaranteed to win, by the way, right? Because they don't like doing summary judgment.

Ju courts don't like granting summary judgment. If we gotta do discovery, it's 25, 35 grand to just keep playing. That's the problem in the law system here.

That's where we need to reform. That's, and, and, and it is, it's the lawyers, right? There's a reason I stop doing law.

I hate these lawyers, these trolls. They're, they, they are making a bet. And, and I spoke to a lawyer about it.

They don't go after large companies who don't mind, who have lawyers on staff, and we'll fight 'em till the cows come home. They go after small medium companies who in a business decision will pay the 10 grand versus fighting it out for 25 or 50 grand and ultimately winning. That's where the system's broke.

And that's what we need to fix. Mm-hmm. I, I'll step down off my soapbox now.

I think we're supposed to say amen and end the session here. We'll end it right here. You're watching Techstrong again, Discover Techstrong group, the epicenter of tech innovation.

We are your go-to for reaching IT leaders and practitioners worldwide. Our secret impactful content that sparks awareness, engagement, and top quality leads with us. You'll access editorial websites, streaming videos, virtual events, custom content analyst research, and more.

Join our satisfied clients. Let's revolutionize your tech journey. Contact us today and tell your story to the world in the most powerful way with Textron Group.

Hey folks, we're back with our last block and we're talking about the acquisition of Stitch by a company called Twilio. And some people are heralding this as an advance in how we're gonna manage identities. 'cause it'll make it easier for developers.

And other people are saying, well, it's an episode of Twilio extension. Maybe it's just gonna be one more cartoon. Fred, you looked at all of this stuff.

What's your take on what's going on here? And is there, are we gonna see more of this? Um, I love it.

Uh, and also the, the subtle knot to Lila and Stitch, I'll say it outright. Um, remember when you used to have to, uh, pay your HR company for SSO as a special feature? Remember when people said, ah, you know what?

Passwords are terrible, everything should be passwordless. Or, Hey, you know what, I have this amazing SAML token, you can just connect up into your thing so life will be good. Well, it turns out all of those have both a cost and a complexity and, you know, a challenge.

And they're designed for people they weren't designed for, for non-human identities. And so what we're seeing here is a movement, right? That's begun to say, Hey, look, standardization is a requirement.

You know, your Jot tokens for your web session have to use an actual standard. You can't poorly implement, you know, HCDP like we have in the past in a way that suggests that often a, a function of that. And that coincides with things like, hmm, proprietary SDKs and, you know, non-standardized delegated authentication mechanisms.

And for the, for the, for the uninitiated, what that means is, uh, I want to connect up with my Google identity to the things that I use. Okay, well, there's a standard utilized there called OIDC that allows you to decide that the same constructs or the same, you know, scope and the same entitlements are things that I can pass from place to place. It's a unified way of doing this method of authentication and the method of authorization.

So is this revolutionary? You know, I don't, I don't, I don't think it's revolutionary, but I think what's happening here is there's a whole host of new cohorts that are looking at this in an entirely different fashion that are accounting for non-human identities, which demands, uh, without human interaction demand standards in order to operate. So you can imagine that, you know, historically we've had folks like auth zero, uh, a staple in the industry, um, not without their own security concerns over the last handful of years from exploitation, but in addition to that, other providers that have, uh, non-traditional methods or historical methods for authentication, uh, one of which at least when, uh, when I was the CSO at JumpCloud, right?

Uh, terrific identity provider, right? Had to support skim, uh, in the implementations of the providers in which that skim was, uh, designed, right? So they'd have to copy the directory from somebody else in this particular case.

And, you know, what we're doing is we're taking the, uh, the insecurities with us as we go based on the implementation of said providers. So identity providers now are starting to move past this construct and suggesting, Hey, look, you know, there's a lot of B2B platforms, a lot of SaaS platforms, a lot of requirements for us to tie into, you know, MCP servers. And so those requirements illustrate why it's more likely to have competitive, you know, a APIs and, uh, ways of integrating with, uh, standards, uh, based authentication methods.

And, um, I think it's terrific. Do I, do I think this particular acquisition is, uh, a harbinger of the entirety of change in the industry? No, but it's certainly a big one, right?

And if there was a shot across the bow for an auth zero, I would probably be taking notes today. Alan, what's your take here? We need to just make this easier for developers in the first place, and then we wouldn't have all this crap on the back end that Fred's talking about.

We've tried to make it easier. Like you look at like SendGrid, which is, isn't that part of Twilio too, Fred, right? Didn't they buy SendGrid?

So SE SendGrid was great if you, if you wanted to have sort of an email verification or something like that kickoff, uh, in your, in your app, you could just, you know, you, you put a little srid component in there and on the backend, SRID took care of all that. And it, you know, it really helped with, with spam filtering and getting black ball, black box and all these things. Um, you know, it's an interesting thing.

Like I, I've always had the opinion of why does someone want to spam mail? Why do, why do we need passwords? Why do we need all of this whole huge infrastructure we've all developed over, whether it's single sign on, federated identity, it's, it all really comes down to identity, doesn't it?

Right? It's identity and access management. And, you know, in the age of cloud, that became the killer app for, for, for, for cloud security in many ways, right?

I gotta know who you are and where you're allowed to go. We had 8 0 2 1 x when I was doing nac, right? It was a big thing, Fred, if you remember those days, right?

Uh, we've never saw, here we are, it's 2025 going to 2026, we're still talking about the same crap. We're still talking about the same crap. We haven't, we haven't solved it.

So, so Kimberly, your take on this, because I think we've reached a point where maybe the same crap is no longer sustainable. 'cause if I missed my guess, and I think Fred mentioned non-human identities, so now we're gonna have these AI agents and there might be a hundred AI agents for every human by the time we're done. So this current system just isn't gonna be able to cope with that.

Yeah, I, as I'm listening to this, because you guys know this space, I, I know about that much in it, but, um, I think it was, yeah, last December when I was part of the, was at the American Society for ai. We had a debate on, um, whether or not AI was a person or not. And, and it was a fascinating, I mean, it was, we, and it was one of those classic debates where you, you know, you had one group that had to get up there and defend it, the other one, you know, to take it down.

And, and by the time you're done, you're just like, you, you, you broadened your scope of thinking about how to look at these AI machines and that when we get into MCP and you get into agents and everything else talking to each other, my, my big thing is like, okay, I got this LLM or this agent over here saying one thing, I got another one over here. You know, what if they evolve and they, they go around the security protection that we have. I mean, I'm laughing about it, but I'm like going, this is, this is real stuff, you know?

And yes, we're starting again because we've just inserted a new person into this world of ours that we haven't had before, and that person is called AI or agents or whatever it is, and it's got a real EI mean, we are handing over the keys to these guys. Um, these guys, see, I'm actually calling it a, a person person name. We're handing it over to this coat, uh, and we're giving it names for crying out loud.

Um, and you know, when, when you and I interact with chat, GPT, you know, you can't help but getting sucked in to the fact that you're talking to somebody. Um, so yeah, it's, we have to reinvent because we have all this brand new technology, and I hope that Fred, you and your team, people out there that are developing all this stuff are smart enough to protect us because it's, it could really have, it's a really wild, wild west situation. I think, Uh, it's a super good point.

I, I, I like a couple of things about what you said that really focus on how we need to think about the next set of relationships that we develop, uh, whether we consider, you know, non-human identities, uh, human identities or not. The, the focus here is really when we think about building infrastructure, for example, right? We have a bunch of ENT things and you know, we have a bunch of MCP tool chain and all the things that go with it, right?

When we look at all of those components separate, and aside from anybody communicating with anything that we do outside of our business or, and I believe a lot of other folks who are in the same boat, we need to make sure that those are authentic and authorized behaviors that happen. And so, you know, there's a couple of, if, if you read this article, right, there's a bunch of different listed, uh, available open source technologies. Well, I don't wanna pay somebody else for n number of, of users non-human, uh, identities that I use, uh, either, right?

So, and, and I need to have a source of truth and I need to have an identity, uh, uh, broker, uh, as well as an access control methodology authorization authentication that supports those standards because at some time later, I also wanna make sure I can interact with other folks that have, you know, support of those standards. And so, when we think about it at least, uh, from a microcosm of a, you know, tiny startup and a, you know, ragtag fugitive fleet of, of folks building stuff like this in this market today, they've gotta start somewhere that does not include these giant, you know, arbiters of, of brokered identity trust because it costs too much money to do it. So, and the complexity is ri you know, is rigorous.

So when you go tie into, uh, you know, a very large organization that supports only a Microsoft identity or a Google identity or what have you, you probably need to know how to deal with that. And where do you start? You start with the, the tools that make it easiest.

And so some of those may be key cloak or, you know, fusion Auth is great for folks that do, you know, devices, right? If you were interested in managing, you know, a thousand consoles in, in your retail locations, terrific for that. Uh, if you look at Descope to make all of your automated flows better, there's all kinds of tools that are coming out to help enable that as a developer to supplant the sort of historical, you know, cost model of the ma bell of identity.

You know, somebody tried to make somebody, sorry, somebody tried to make me feel better about this because they told me that the AI agent would inherit my permissions. And I was like, well, given the fact that my permissions are not very well managed, I was even more terrified than I was before. So it was, the report this week was, um, Amazon was yelling at perplexity because perplexity was placing orders on Amazon.

So there's a battle going on between them. Um, so, and I think about that, okay, so perplexity based upon me getting in there, I haven't used it, but, uh, from what I understand, looking in there and it can go on and go take my order and go to Amazon, search for the right t right thing to buy from me and go buy whatever I'm wanting and ship it to me. That to me, and well, let's go back to our, our, our B block that we talked about is scary because all of a sudden my data is being passed between these two different companies that are not financial institutions.

Thank you very much. You know, they're retail and whatever, but it's anyway that my brain can go all kinds of places. So I'll let it, I'll shut it down right now.

Lemme just, lemme just, it's not just about your, this isn't just about personal liability or personal harm. This, especially when you talk about machine identities and you know, is, is replacing phishing as a very easy way in to the, to the corporation's infrastructure that then do ransomware or inject malware or what have you. And you know, we live in a world where the machine identities outweigh human identities by an exponential factor, and his problem's not going away.

Unfortunately, we don't have enough time to solve it here today either. So I need, I need to, uh, pull the plug on this one. Kimberly, Fred Ira had to leave early, but we thank him and Mike is always you, hope you've enjoyed this.

We've got more text on TV as usual following up. But you know what, at the end of the day, have a great weekend, everyone. We're coming up.

Thanksgiving will be here in a few weeks. It's hard for me to wrap my head around that. But uh, enjoy your weekend, enjoy your weather, fall weather wherever you are, and we'll be back Monday with more text junk gang.